shinjuku-shield 0.3.82 → 0.3.83

package/README.md

@@ -6,13 +6,13 @@ answers privately, in a terminal chat or for your agent app. Its `mcp`
 command runs a local MCP server (stdio) for your agent. Your keys never
 leave your machine.
 
-This is version 0.3.82. The npm packages `shinjuku-shield` and
+This is version 0.3.83. The npm packages `shinjuku-shield` and
 `shinjuku-shielded` hold the same files; `shinjuku` is the short command.
 
 ## Set up
 
 ```sh
-npx -y --no-audit --no-fund shinjuku-shield@0.3.82 setup
+npx -y --no-audit --no-fund shinjuku-shield@0.3.83 setup
 ```
 
 Setup makes the wallet on this machine, a private passphrase file, and the
@@ -24,7 +24,7 @@ server to that host's config.
 ## The `shinjuku` command
 
 ```sh
-npm install -g shinjuku@0.3.82
+npm install -g shinjuku@0.3.83
 shinjuku help
 ```
 
@@ -36,13 +36,13 @@ Every wallet command works after `shinjuku`, for example `shinjuku balance`,
 Claude Code:
 
 ```sh
-claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.82 mcp
+claude mcp add --scope user shinjuku-shielded -- npx -y --no-audit --no-fund shinjuku-shield@0.3.83 mcp
 ```
 
 Claude Desktop (`claude_desktop_config.json`) or Cursor (`~/.cursor/mcp.json`):
 
 ```json
-{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.82", "mcp"] } } }
+{ "mcpServers": { "shinjuku-shielded": { "command": "npx", "args": ["-y", "--no-audit", "--no-fund", "shinjuku-shield@0.3.83", "mcp"] } } }
 ```
 
 On native Windows, if the host cannot find `npx`, use `"command": "cmd"` and

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "eaf7063ed1fe0dbcbf1c1f689e1ce60018401d669fe8bad7a7d4483cb875da0a",
-  "bytes": 12477292,
-  "sourceCommit": "9e701778bde2c7c186ff3ca9b631773c3abc02b2",
+  "sha256": "a59aa27b98cd1822c4651ed0567cd35b3f03e087818d8e5cfdb71e6320b7ffae",
+  "bytes": 12484127,
+  "sourceCommit": "ad531c40fe817d116a109d33472895bbbd854158",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",
@@ -1282,5 +1282,5 @@
       "version": "1.8.0"
     }
   ],
-  "publishedAt": "2026-10-23T17:26:04.670Z"
+  "publishedAt": "2026-10-23T18:18:57.601Z"
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shield",
-  "version": "0.3.82",
+  "version": "0.3.83",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "eaf7063e",
-  "shinjukuSha256": "eaf7063ed1fe0dbcbf1c1f689e1ce60018401d669fe8bad7a7d4483cb875da0a",
+  "shinjukuRelease": "a59aa27b",
+  "shinjukuSha256": "a59aa27b98cd1822c4651ed0567cd35b3f03e087818d8e5cfdb71e6320b7ffae",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -47211,8 +47211,9 @@ function reexec(args, mode, plainProxy) {
     ...proxyEnv(proxy),
     [MARK]: `${mode} ${proxy}`
   };
-  delete env[QUIET_CHAT_MARK];
-  if (quietChatRun(args)) env[QUIET_CHAT_MARK] = "1";
+  delete env[QUIET_RUN_MARK];
+  const quiet = quietRun(args);
+  if (quiet) env[QUIET_RUN_MARK] = quiet;
   return new Promise((resolvePromise) => {
     const child = spawn(process.execPath, [...process.execArgv, process.argv[1], ...args], { env, stdio: "inherit" });
     const ignore = () => {
@@ -47232,8 +47233,9 @@ async function proxyEntry(argv2, run5, { err = (text3) => process.stderr.write(t
   const proxied = process.env[MARK];
   if (proxied) {
     const [mode, proxy] = proxied.split(" ");
-    const quiet = process.env[QUIET_CHAT_MARK] === "1";
-    delete process.env[QUIET_CHAT_MARK];
+    const quietMark = process.env[QUIET_RUN_MARK];
+    const quiet = Object.hasOwn(QUIET_NOTICE, quietMark ?? "") ? QUIET_NOTICE[quietMark] : void 0;
+    delete process.env[QUIET_RUN_MARK];
     refuseDirectSockets(proxy);
     if (!canSwitchTorTag()) {
       err(`shinjuku: proxy_node_unsupported: Node ${process.versions.node} does not send its requests through a proxy (it ignores NODE_USE_ENV_PROXY), so this run cannot keep them private; nothing was sent. Install the current Node 22 or 24 release (Node 22.23 and 24.13 work), then rerun
@@ -47255,7 +47257,7 @@ async function proxyEntry(argv2, run5, { err = (text3) => process.stderr.write(t
       }
       return 1;
     }
-    err(`${quiet ? QUIET_NOTICE[mode] : NOTICE[mode]}
+    err(`${quiet ? quiet[mode] : NOTICE[mode]}
 `);
     const ohttp = startOhttp(argv2, { tor: mode === "tor", err });
     if (ohttp.exitCode !== void 0) return ohttp.exitCode;
@@ -47289,7 +47291,7 @@ async function proxyEntry(argv2, run5, { err = (text3) => process.stderr.write(t
   }
   return reexec(options.args, options.mode, options.proxy);
 }
-var TOR_HTTP_TUNNEL, TOR_CHECK, PROOF_TIMEOUT_MS, LOCAL_PROOF_TIMEOUT_MS, LOCAL_PROOF_MAX_BYTES, torProvenAt, proxyProvenAt, MARK, TOR_RUN_STARTED_ENV, ownProxyRefused, ONION_V3, RETRY_AFTER_CAP_MS, RETRY_AFTER_FLOOR_MS, RETRY_AFTER_DEFAULT_MS, RPC_NO_ANSWER_LIMIT_MS, RPC_PACING_CAP_MS, PACING_NOTICE_EVERY_MS, PACING_RATE_WINDOW_MS, TOR_MAX_ROTATIONS, runStartedAt, rpcNotBefore, pacingWaiters, pacingSince, pacedMs, rpcAnswered, lastAnswerAt, readSteps, pacingNoticeAt, pacingSamples, torMoves, torCircuitId, torMovesRefused, pendingMove, inTorRun, runNetworkMode, isOnionOrigin, ProxyUsageError, isOnionHost, TOR_EXPERT_BUNDLE, TUNNEL_LINE, TOR_INSTALL, OS_NAMES, osKey, torNotRunningMessage, NOTICE, QUIET_CHAT_MARK, QUIET_NOTICE, quietChatRun, TOR_TROUBLE_LINE, quietTorErr, withRunTag, proxyEnv, pacedSoFar, RESENDABLE_METHOD, torCircuit, GLOBAL_DISPATCHER2, laneDispatchers, paymentWarmStop;
+var TOR_HTTP_TUNNEL, TOR_CHECK, PROOF_TIMEOUT_MS, LOCAL_PROOF_TIMEOUT_MS, LOCAL_PROOF_MAX_BYTES, torProvenAt, proxyProvenAt, MARK, TOR_RUN_STARTED_ENV, ownProxyRefused, ONION_V3, RETRY_AFTER_CAP_MS, RETRY_AFTER_FLOOR_MS, RETRY_AFTER_DEFAULT_MS, RPC_NO_ANSWER_LIMIT_MS, RPC_PACING_CAP_MS, PACING_NOTICE_EVERY_MS, PACING_RATE_WINDOW_MS, TOR_MAX_ROTATIONS, runStartedAt, rpcNotBefore, pacingWaiters, pacingSince, pacedMs, rpcAnswered, lastAnswerAt, readSteps, pacingNoticeAt, pacingSamples, torMoves, torCircuitId, torMovesRefused, pendingMove, inTorRun, runNetworkMode, isOnionOrigin, ProxyUsageError, isOnionHost, TOR_EXPERT_BUNDLE, TUNNEL_LINE, TOR_INSTALL, OS_NAMES, osKey, torNotRunningMessage, NOTICE, QUIET_RUN_MARK, QUIET_NOTICE, quietRun, TOR_TROUBLE_LINE, quietTorErr, withRunTag, proxyEnv, pacedSoFar, RESENDABLE_METHOD, torCircuit, GLOBAL_DISPATCHER2, laneDispatchers, paymentWarmStop;
 var init_proxy = __esm({
   "wallet/src/net/proxy.mjs"() {
     "use strict";
@@ -47349,9 +47351,16 @@ var init_proxy = __esm({
       tor: "tor: every request of this run goes through Tor, so the facilitator, the RPC provider, and other servers see a Tor exit, not your IP. It does not hide what a request carries or when: a keyed RPC URL still names its account holder (use a key-free RPC), and timing still links your requests.",
       proxy: "proxy: every request of this run goes through the proxy, so servers see its address, not yours; the proxy sees every request. It does not hide what a request carries or when: a keyed RPC URL still names its account holder (use a key-free RPC), and timing still links your requests."
     };
-    QUIET_CHAT_MARK = "SHINJUKU_WALLET_QUIET_CHAT";
-    QUIET_NOTICE = { tor: "Private: this chat goes through Tor.", proxy: "Private: this chat goes through your proxy." };
-    quietChatRun = (args) => args[0] === "chat" && !args.includes("--verbose");
+    QUIET_RUN_MARK = "SHINJUKU_WALLET_QUIET_RUN";
+    QUIET_NOTICE = {
+      chat: { tor: "Private: this chat goes through Tor.", proxy: "Private: this chat goes through your proxy." },
+      funds: { tor: "Private: every request of this run goes through Tor.", proxy: "Private: every request of this run goes through your proxy." }
+    };
+    quietRun = (args) => {
+      if (args.includes("--verbose")) return void 0;
+      if (args[0] === "chat") return "chat";
+      return ["add-funds", "funds-status"].includes(args[0]) && process.stdout.isTTY && !args.includes("--json") ? "funds" : void 0;
+    };
     TOR_TROUBLE_LINE = /\bno (?:other )?(?:history-proxy )?onion\b|\bgave no answer\b|\bstalled\b|\bHTTP 429\b|\bcannot move\b/;
     quietTorErr = (err) => (text3) => {
       if (/^tor: /.test(text3) && !TOR_TROUBLE_LINE.test(text3) && !/\bWARNING\b/.test(text3)) return;
@@ -97243,7 +97252,11 @@ async function payViaFloat({
       });
     }
     const watched = watch.verdict();
-    const known = watched?.state === "final" || watched?.state === "dead" ? watched : lostAnswer ? await readFloatTransferState(record, fetchImpl) : void 0;
+    let known = watched?.state === "final" || watched?.state === "dead" ? watched : lostAnswer || watched?.state === "landed" ? await readFloatTransferState(record, fetchImpl) : void 0;
+    for (let read = 0; known?.state === "landed" && read < LANDED_READS; read += 1) {
+      await (deps.floatStatusSleep ?? sleep6)(LANDED_POLL_MS);
+      known = await readFloatTransferState(record, fetchImpl) ?? known;
+    }
     if (known?.state === "final") {
       record = {
         ...record,
@@ -97269,7 +97282,7 @@ async function payViaFloat({
       state: "refund_pending",
       sellerStatus: response.status,
       refundPendingAtMs: record.refundPendingAtMs ?? Date.now(),
-      ...known?.state !== "dead" && (lostAnswer || earlierAmbiguous === true) ? { ambiguous: true } : {}
+      ...known?.state !== "dead" && (lostAnswer || earlierAmbiguous === true || known?.state === "landed") ? { ambiguous: true } : {}
     };
     store.writeWal(walName2, record);
     fail18("p03_float_refund_pending", {
@@ -97553,7 +97566,7 @@ function paidResult(record, replayed) {
     float: { floatId: record.floatId }
   };
 }
-var import_web3109, FLOAT_PAYMENT_SCHEMA, REGENERATE_CODES, FLOAT_PAYMENT_WAL_PREFIX, FLOAT_CONFIG_SCHEMA, FLOAT_PAY_PATH, FLOAT_MEMO_PATH, FLOAT_STATUS_PATH, MAX_BODY_BYTES, FLOAT_REFUND_ETA_SECONDS, REFUND_SETTLED_AFTER_MS, REFUND_OUTCOME_NEWS_MS, FINISHING_POLL_MS, FINISHING_LIMIT_MS, SELLER_TIMEOUT_MS, FLOAT_STATUS_START_MS, FLOAT_STATUS_POLL_MS, FLOAT_STATUS_TIMEOUT_MS, FLOAT_TRANSFER_DEAD, CONFIG_TIMEOUT_MS, MEMO_UPLOAD_TIMEOUT_MS, CONFIG_CACHE_MS, FLOAT_POOL_WARM_MS, DECIMAL3, POSITIVE, PENDING_CODES, FLOAT_FRONT_HEADER, hash8, fail18, FEE_PAYER_RESENDS, FEE_PAYER_RESEND_MS, GLOBAL_DISPATCHER4, sortedJson, MODEL_ID, floatPaymentWalName, floatRecordName, FLOAT_KEEP_BYTES_MS, memoryAnswers, MEMORY_ANSWERS_MAX, memoryAnswerKey, requestHashes, FLOAT_KEEP_OPEN_REQUEST_MS, configCache, configGeneration, configReadSequence, configReads, configRefreshes, SPECULATED_MAX_AGE_MS, speculatedQuotes, poolDomains, FLOAT_FACTS_SCHEMA, floatFacts, floatFactsKey, floatFactsMac, poolDomainReads, poolDomainWarmFailedAt, WARM_RETRY_MS, payerGenerator, etaEntry, loadPayerGenerator, plainText, BROADCAST_REFUSED, BROADCAST_REFUSED_STANDARD, BROADCAST_DEAD, TRANSFER_LANDING_WINDOW_MS, PROOF_DELIVERY_MS, SELF_BROADCAST_LEG1_LEFT_MS, BROADCAST_UNSIGNED, BROADCAST_NO_LOOKUP, BROADCAST_LANDED, BROADCAST_LIMIT_MS, BROADCAST_QUOTE_MARGIN_MS, SELF_BROADCAST_RESEND_MS, SELF_BROADCAST_UNANSWERED_RESEND_MS, SELLER_HEADERS_MAX_COUNT, SELLER_HEADERS_MAX_BYTES, SELLER_HEADERS_KEPT;
+var import_web3109, FLOAT_PAYMENT_SCHEMA, REGENERATE_CODES, FLOAT_PAYMENT_WAL_PREFIX, FLOAT_CONFIG_SCHEMA, FLOAT_PAY_PATH, FLOAT_MEMO_PATH, FLOAT_STATUS_PATH, MAX_BODY_BYTES, FLOAT_REFUND_ETA_SECONDS, REFUND_SETTLED_AFTER_MS, REFUND_OUTCOME_NEWS_MS, FINISHING_POLL_MS, FINISHING_LIMIT_MS, SELLER_TIMEOUT_MS, FLOAT_STATUS_START_MS, FLOAT_STATUS_POLL_MS, FLOAT_STATUS_TIMEOUT_MS, FLOAT_TRANSFER_DEAD, LANDED_POLL_MS, LANDED_READS, CONFIG_TIMEOUT_MS, MEMO_UPLOAD_TIMEOUT_MS, CONFIG_CACHE_MS, FLOAT_POOL_WARM_MS, DECIMAL3, POSITIVE, PENDING_CODES, FLOAT_FRONT_HEADER, hash8, fail18, FEE_PAYER_RESENDS, FEE_PAYER_RESEND_MS, GLOBAL_DISPATCHER4, sortedJson, MODEL_ID, floatPaymentWalName, floatRecordName, FLOAT_KEEP_BYTES_MS, memoryAnswers, MEMORY_ANSWERS_MAX, memoryAnswerKey, requestHashes, FLOAT_KEEP_OPEN_REQUEST_MS, configCache, configGeneration, configReadSequence, configReads, configRefreshes, SPECULATED_MAX_AGE_MS, speculatedQuotes, poolDomains, FLOAT_FACTS_SCHEMA, floatFacts, floatFactsKey, floatFactsMac, poolDomainReads, poolDomainWarmFailedAt, WARM_RETRY_MS, payerGenerator, etaEntry, loadPayerGenerator, plainText, BROADCAST_REFUSED, BROADCAST_REFUSED_STANDARD, BROADCAST_DEAD, TRANSFER_LANDING_WINDOW_MS, PROOF_DELIVERY_MS, SELF_BROADCAST_LEG1_LEFT_MS, BROADCAST_UNSIGNED, BROADCAST_NO_LOOKUP, BROADCAST_LANDED, BROADCAST_LIMIT_MS, BROADCAST_QUOTE_MARGIN_MS, SELF_BROADCAST_RESEND_MS, SELF_BROADCAST_UNANSWERED_RESEND_MS, SELLER_HEADERS_MAX_COUNT, SELLER_HEADERS_MAX_BYTES, SELLER_HEADERS_KEPT;
 var init_floatPay = __esm({
   "wallet/src/pay/floatPay.mjs"() {
     "use strict";
@@ -97593,6 +97606,8 @@ var init_floatPay = __esm({
     FLOAT_STATUS_POLL_MS = 5e3;
     FLOAT_STATUS_TIMEOUT_MS = 5e3;
     FLOAT_TRANSFER_DEAD = /* @__PURE__ */ new Set(["dead", "refund_queued", "refund_sent", "refunded"]);
+    LANDED_POLL_MS = 2e3;
+    LANDED_READS = 15;
     CONFIG_TIMEOUT_MS = 3e4;
     MEMO_UPLOAD_TIMEOUT_MS = 1e4;
     CONFIG_CACHE_MS = 6e4;
@@ -110009,15 +110024,16 @@ function refreshErrorWords(code2, lockedBy) {
   return void 0;
 }
 function balanceSay(a) {
-  const line = balanceLine(a);
   const settled = ATOMIC3.test(String(a.balanceAtomic ?? "")) && a.refreshing !== true && !a.refreshError && !positive(usdcText(a.landingAtomic));
   const card = settled && typeof a.card === "string" && a.card ? " The wallet card shows the rest." : "";
   const fits = (text3) => words(text3) <= SAY_MAX_WORDS;
   const count2 = Array.isArray(a.ownKeyTokens) ? a.ownKeyTokens.length + (Number.isSafeInteger(a.ownKeyTokensMore) ? a.ownKeyTokensMore : 0) : 0;
-  const withTokens = count2 < 1 ? line : `${line} The wallet's own key holds ${count2} other token${count2 === 1 ? "" : "s"} (ownKeyTokens).`;
+  const tokens = count2 < 1 ? "" : ` The wallet's own key holds ${count2} other token${count2 === 1 ? "" : "s"} (ownKeyTokens).`;
+  const line = balanceLine(a);
+  const withTokens = `${balanceLine(a, SAY_MAX_WORDS - words(tokens))}${tokens}`;
   return [`${withTokens}${card}`, withTokens, `${line}${card}`].find(fits) ?? line;
 }
-function balanceLine(a) {
+function balanceLine(a, room = SAY_MAX_WORDS) {
   const balance = usdcText(a.balanceAtomic);
   const pub = usdcText(a.unshieldedAtomic);
   const landing = usdcText(a.landingAtomic);
@@ -110072,6 +110088,13 @@ function balanceLine(a) {
   const held = heldByPaymentSay(a.detail);
   if (balance === "0" && held) return held;
   if (balance === "0" && !pubPart) return "Your private balance is empty. Use wallet_add_funds to get an address to send USDC to.";
+  const parts = Number.isSafeInteger(a.balanceParts) && a.balanceParts > 1 && !a.sendWaiting ? a.balanceParts : 0;
+  if (parts) {
+    const minutes = Number.isSafeInteger(a.joinMinutes) && a.joinMinutes > 0 ? minutesText(a.joinMinutes) : "";
+    const forms = minutes ? [`sending all of it first joins them, about ${minutes}`, `sending all of it takes about ${minutes}`] : ["sending all of it first joins them"];
+    const split5 = forms.map((form) => have(` (in ${parts} parts: ${form}).${pubPart}`)).find((text3) => words(text3) <= room && (!positive(refund) || /\brefund/.test(text3)));
+    if (split5) return split5;
+  }
   return have(`.${pubPart}`);
 }
 function previewReason(a, npmVersion) {
@@ -110212,12 +110235,14 @@ function build(a, tool, npmVersion) {
     const amount = usdcText(a.done === true ? a.sentAtomic ?? a.amountAtomic : a.amountAtomic);
     const what = amount ? `${amount} USDC` : "the USDC";
     if (a.done !== true) return `Sending ${what} privately to ${a.to}.`;
+    const took = Number.isSafeInteger(a.joinedParts) && a.joinedParts > 1 && Number.isSafeInteger(a.tookSeconds) && a.tookSeconds >= 0 ? ` It took about ${a.tookSeconds} s because the wallet first joined your balance's ${a.joinedParts} parts.` : "";
     if (typeof a.exitTransaction === "string" && a.privateSend === void 0) {
       const head = `Sent ${what} to ${a.to} (transaction ${a.exitTransaction}).`;
+      if (took) return withBalance(`${head}${took}`, a);
       const known = withBalance(head, a, (balance) => ` Your private balance is now ${balance} USDC; nothing to do.`);
       return known !== head ? known : `${head} Your private balance shows it in a few seconds; nothing to do.`;
     }
-    return withBalance(`Sent ${what} to ${a.to}.`, a);
+    return withBalance(`Sent ${what} to ${a.to}.${took}`, a);
   }
   if (typeof a.address === "string" && a.address && typeof a.stage === "string") return linkSay(a);
   if (a.stage === "waiting_for_funds" && typeof a.depositAddress === "string") {
@@ -120879,7 +120904,7 @@ function proofWalkReportOf(store, programId) {
     if (movedInAfterSnapshot(store, store.state, snapshot) > 0n) return null;
     const report = computeBalance({ store, snapshotRead: { snapshot }, source: "local" });
     const one = oneBalance(report, store, snapshot);
-    return one.balanceAtomic === null ? null : { report, one };
+    return one.balanceAtomic === null ? null : { report, one, snapshot };
   } catch {
     return null;
   }
@@ -121326,6 +121351,18 @@ function createWalletTools({
       if (storeWriteCount() !== writesBefore) lastWriterEndedAt = Date.now();
     }
   });
+  async function assertNotPromisedFresh(store, amountAtomic) {
+    const shortfall = promisedShortfall(store, amountAtomic);
+    if (shortfall?.error === "spend_private_send_unknown" && shortfall.pendingAtomic !== null) {
+      try {
+        await (ops.refresh ?? refreshWallet)({ session, store });
+        log("MCP_PROMISED_REFRESH ok");
+      } catch (error) {
+        log(`MCP_PROMISED_REFRESH failed ${errorCode2(error, "mcp_refresh_failed")}`);
+      }
+    }
+    assertUnshieldNotPromised(store, amountAtomic);
+  }
   const autoPockets = createAutoPockets({
     session,
     money,
@@ -122712,7 +122749,7 @@ ${canonical5}`;
   const balance = {
     name: "wallet_balance",
     title: "Balance",
-    description: `Use this when the user asks "what is my balance" or "how much USDC do I have": it answers ONE balance (balanceAtomic, what x402_pay can spend) and the public (unshielded) USDC. Pays nothing and signs nothing. When the user asks to see the wallet ("show my wallet"), print \`card\` as it is: at most 8 lines with the private balance, the public USDC, Tor on or off, the last 3 payments (time UTC, seller host, USDC), and example requests. balanceAtomic is one number; breakdown names its parts (breakdown.shieldedAtomic is what wallet_unshield can send; privateSendPendingAtomic is the part of a running private send (wallet_unshield with parts or max_delay_minutes) not sent yet, already taken off shieldedAtomic; refundsInFlightAtomic is a Shinjuku refund on its way back; setAsideAtomic (only when not 0) is value an older version of this wallet set aside to pay sellers; during a pool move, pools lists each pool's part and movingAtomic is value on its way from the old pool to the new one; the move field shows the move, poolSwitches each switch). UNSHIELDED (unshieldedAtomic) is the plain public USDC on the wallet's own Solana key (ownAddress), the USDC wallet_shield makes private; unshieldedSolLamports is that key's SOL, information only: wallet_shield needs none (the facilitator's relayer pays every fee and rent). When the local balance is stale (a new deposit, a received payment), it reads the chain by itself first; when that takes longer than about 20 s it answers the last balance with refreshing: true and finishes in the background (call wallet_balance again in 30 s). A balance with refreshing: true and refreshReason is exact (payment_settling: a payment settles and the number counts it; account_join: the wallet joins its own balance parts and the number counts them; pool_move: value from the old pool arrives and the number counts it; first_check: a new wallet's first history check, the number is its own landed deposits). status reading (balanceAtomic null): the first balance read of a wallet that may hold money is not done; call wallet_balance again in 30 s. If the public read fails, unshieldedAtomic is null with unshieldedReason; the rest still answers. ownKeyTokens (only when there are any): the other tokens on ownAddress (not its USDC), each { mint, amountAtomic, decimals, amount }, at most 10 (ownKeyTokensMore counts the rest); a token is its mint, never a name or symbol; wallet_transfer_token with that mint as token_mint sells one and sends the USDC privately. earlierDeposits (only when there are any): USDC found at a one-time deposit address of an earlier pool, each with a notice line to tell the user; the wallet moves it into the current pool by itself. addFunds (only when there are any): each wallet_add_funds address still open, with its state and the USDC known to wait there (heldAtomic; null with heldNote when the address was not checked yet). startsAtNextRequest true (old name): its deposit is not sent yet; once the wallet has seen USDC there, it sends it by itself in about startsInMinutes + 1 minutes, in every host, with no ask. landingAtomic (only when not 0): USDC you added whose deposit landed on chain and that balanceAtomic does not count yet; this call finishes it and waits about 20 s for it, past that it is being counted: call wallet_balance again as next says (at once in the same turn when this call waited its 20 s, else in 30 s). session shows the spending limits (null or "none": no limit), what is left, where the limits come from, and how to change them (session.summary). verbose: true adds \`internal\` (accounts, notes, and other engineering numbers); the default answer leaves them out. To add money, use wallet_add_funds. Amounts are atomic units (USDC: 1000000 = 1 USDC); say and usdc give them in USDC.`,
+    description: `Use this when the user asks "what is my balance" or "how much USDC do I have": it answers ONE balance (balanceAtomic, what x402_pay can spend) and the public (unshielded) USDC. Pays nothing and signs nothing. When the user asks to see the wallet ("show my wallet"), print \`card\` as it is: at most 8 lines with the private balance, the public USDC, Tor on or off, the last 3 payments (time UTC, seller host, USDC), and example requests. balanceParts (only above 1): the balance is in that many parts, and a send of all of it joins them first (next says the minutes). balanceAtomic is one number; breakdown names its parts (breakdown.shieldedAtomic is what wallet_unshield can send; privateSendPendingAtomic is the part of a running private send (wallet_unshield with parts or max_delay_minutes) not sent yet, already taken off shieldedAtomic; refundsInFlightAtomic is a Shinjuku refund on its way back; setAsideAtomic (only when not 0) is value an older version of this wallet set aside to pay sellers; during a pool move, pools lists each pool's part and movingAtomic is value on its way from the old pool to the new one; the move field shows the move, poolSwitches each switch). UNSHIELDED (unshieldedAtomic) is the plain public USDC on the wallet's own Solana key (ownAddress), the USDC wallet_shield makes private; unshieldedSolLamports is that key's SOL, information only: wallet_shield needs none (the facilitator's relayer pays every fee and rent). When the local balance is stale (a new deposit, a received payment), it reads the chain by itself first; when that takes longer than about 20 s it answers the last balance with refreshing: true and finishes in the background (call wallet_balance again in 30 s). A balance with refreshing: true and refreshReason is exact (payment_settling: a payment settles and the number counts it; account_join: the wallet joins its own balance parts and the number counts them; pool_move: value from the old pool arrives and the number counts it; first_check: a new wallet's first history check, the number is its own landed deposits). status reading (balanceAtomic null): the first balance read of a wallet that may hold money is not done; call wallet_balance again in 30 s. If the public read fails, unshieldedAtomic is null with unshieldedReason; the rest still answers. ownKeyTokens (only when there are any): the other tokens on ownAddress (not its USDC), each { mint, amountAtomic, decimals, amount }, at most 10 (ownKeyTokensMore counts the rest); a token is its mint, never a name or symbol; wallet_transfer_token with that mint as token_mint sells one and sends the USDC privately. earlierDeposits (only when there are any): USDC found at a one-time deposit address of an earlier pool, each with a notice line to tell the user; the wallet moves it into the current pool by itself. addFunds (only when there are any): each wallet_add_funds address still open, with its state and the USDC known to wait there (heldAtomic; null with heldNote when the address was not checked yet). startsAtNextRequest true (old name): its deposit is not sent yet; once the wallet has seen USDC there, it sends it by itself in about startsInMinutes + 1 minutes, in every host, with no ask. landingAtomic (only when not 0): USDC you added whose deposit landed on chain and that balanceAtomic does not count yet; this call finishes it and waits about 20 s for it, past that it is being counted: call wallet_balance again as next says (at once in the same turn when this call waited its 20 s, else in 30 s). session shows the spending limits (null or "none": no limit), what is left, where the limits come from, and how to change them (session.summary). verbose: true adds \`internal\` (accounts, notes, and other engineering numbers); the default answer leaves them out. To add money, use wallet_add_funds. Amounts are atomic units (USDC: 1000000 = 1 USDC); say and usdc give them in USDC.`,
     inputSchema: { type: "object", properties: {
       verbose: { type: "boolean", description: "Optional. true adds `internal`: the engineering numbers (funded accounts, notes, payments without waiting, a 0 set-aside value). Default false." }
     }, additionalProperties: false },
@@ -122963,8 +123000,7 @@ ${canonical5}`;
       else if (unshielded.unshieldedAtomic && unshielded.unshieldedAtomic !== "0" && shieldEnabled) next = 'to make the public USDC private, call wallet_shield with amount (like "0.37")';
       else if (one.balanceAtomic === "0" && shieldEnabled) {
         next = elsewhereEnabled ? `the shielded balance is 0, so x402_pay cannot pay yet. To add funds, call wallet_add_funds: it gives a one-time address; up to ${usdcText2(payMeRoundMax())} USDC sent there on Solana becomes private a few minutes after it arrives while this MCP server runs (or call wallet_add_funds with its request_id to finish it at once)` : `the shielded balance is 0, so x402_pay cannot pay yet. To add funds: send USDC on Solana to ownAddress (this wallet's own key), then call wallet_shield with amount (any amount from ${usdcText2(10000n)} to ${usdcText2(MAX_SHIELDED_BALANCE_ATOMIC)} USDC)`;
-      } else if (parts?.parts > 1) next = `Your balance is in ${parts.parts} parts. A send of the whole balance first joins them: about ${minutesText2(parts.minutes)}`;
-      else next = "nothing to do; x402_pay pays from balanceAtomic, wallet_unshield sends from breakdown.shieldedAtomic";
+      } else next = "nothing to do; x402_pay pays from balanceAtomic, wallet_unshield sends from breakdown.shieldedAtomic";
       let landingAtomic = 0n;
       try {
         landingAtomic = landedNotCounted(store);
@@ -123073,6 +123109,10 @@ ${canonical5}`;
       if (sendWaiting) {
         next = `${next}. Tell the user: the send of ${usdcText2(sendWaiting.amountAtomic)} USDC to ${sendWaiting.to.slice(0, 4)}...${sendWaiting.to.slice(-4)} (request_id "${sendWaiting.requestId}") ${sendWaiting.state === "sending" ? "is being sent now" : sendWaiting.state === "retrying" ? retryWords(sendWaiting) : `waits for the join of the balance parts: ${joinAsksText(waitingPlan)}`}; it cannot be cancelled`;
       }
+      const balanceParts = parts?.parts > 1 && ATOMIC_TEXT.test(String(one.balanceAtomic ?? "")) ? parts.parts : void 0;
+      if (balanceParts && !sendWaiting) {
+        next = `${next}. The balance is in ${balanceParts} parts: if the user asks to send all of it, tell them first that it takes about ${minutesText2(parts.minutes)}`;
+      }
       if (earlierDeposits.length) next = `${next}. Tell the user each earlierDeposits notice`;
       const notices = takeRefundNotices();
       if (notices.refundNotices) next = `${next}. Tell the user each refundNotices line`;
@@ -123136,6 +123176,8 @@ ${canonical5}`;
         balanceAtomic: one.balanceAtomic,
         balance: one.balance,
         card: walletCard({ one, unshielded, landingAtomic, parts, store }),
+        // joinMinutes: the card's minutes, so say.mjs names them too.
+        ...balanceParts ? { balanceParts, ...Number.isSafeInteger(parts.minutes) ? { joinMinutes: parts.minutes } : {} } : {},
         ...report.detail ? { detail: detailPublic } : {},
         breakdown,
         ...refresh,
@@ -123206,12 +123248,13 @@ ${canonical5}`;
         continue;
       }
       if (record?.state === "submitted") {
-        const age = Number.isSafeInteger(record.submittedAtMs) ? Date.now() - record.submittedAtMs : NaN;
-        if (age > SUBMITTED_READ_AFTER_MS && age < 2 * STALE_REFUND_MS) names.push(name);
+        const age2 = Number.isSafeInteger(record.submittedAtMs) ? Date.now() - record.submittedAtMs : NaN;
+        if (age2 > SUBMITTED_READ_AFTER_MS && age2 < 2 * STALE_REFUND_MS) names.push(name);
         continue;
       }
       if (record?.state !== "refund_pending" || record.refundOutcome === "refund_arrived" || !Number.isSafeInteger(record.refundPendingAtMs)) continue;
-      if (Date.now() - record.refundPendingAtMs > STALE_REFUND_MS) names.push(name);
+      const age = Date.now() - record.refundPendingAtMs;
+      if (age > STALE_REFUND_MS || record.ambiguous === true && age > SUBMITTED_READ_AFTER_MS) names.push(name);
     }
     return names;
   }
@@ -123280,8 +123323,9 @@ ${canonical5}`;
         const { ambiguous: _settled, ...rest } = record;
         store.writeWal(name, { ...rest, state: "refund_pending", refundPendingAtMs: Date.now() });
       } else {
+        const { ambiguous: _known, ...record_ } = record;
         store.writeWal(name, {
-          ...record,
+          ...record_,
           state: "seller_kept",
           sellerKeptAtMs: record.sellerKeptAtMs ?? Date.now(),
           .../^[1-9A-HJ-NP-Za-km-z]{64,90}$/.test(String(transaction ?? "")) ? { landedTransaction: transaction } : {}
@@ -123291,6 +123335,12 @@ ${canonical5}`;
     }
     return written;
   }
+  const refundStateWords = (floatState) => ({
+    dead: "sure: the transfer to the seller expired, so Shinjuku sends the refund",
+    refund_queued: "sure: Shinjuku is sending the refund",
+    refund_sent: "sent by Shinjuku (refundTransaction)",
+    refunded: "sent by Shinjuku (refundTransaction)"
+  })[floatState] ?? floatState;
   function paymentRows(store, names, refundReads = /* @__PURE__ */ new Map()) {
     const floats = names.filter((name) => name.startsWith(FLOAT_PAYMENT_WAL_PREFIX)).map((name) => ({ name, record: store.readWal(name) }));
     const ENDED = /* @__PURE__ */ new Set(["receipt", "refund_pending", "seller_kept", "submitted"]);
@@ -123300,7 +123350,7 @@ ${canonical5}`;
     const refundHeld = (record) => {
       if (walk === void 0) {
         try {
-          walk = readBalanceSnapshot(store).snapshot ?? null;
+          walk = proofWalkReportOf(store, session.programId)?.snapshot ?? readBalanceSnapshot(store).snapshot ?? null;
         } catch {
           walk = null;
         }
@@ -123359,7 +123409,7 @@ ${canonical5}`;
               refundAtomic: paid,
               refund: held ? "arrived" : "on its way",
               ...FLOAT_ID.test(String(record.floatId)) ? { floatId: record.floatId } : {},
-              refundState: shinjuku.floatState,
+              refundState: refundStateWords(shinjuku.floatState),
               ...shinjuku.refundTransaction ? { refundTransaction: shinjuku.refundTransaction } : {},
               note: held ? "the seller did not take this payment; the whole amount came back to the private balance" : sent ? "the seller did not take this payment; Shinjuku sent the refund (refundTransaction), and the private balance counts it at its next read" : "the seller did not take this payment; the whole amount comes back to the private balance by itself"
             } : { note: landed ? `the transfer to the seller landed, but the seller has not served the request yet; ${ask} to get it` : `the seller has not served this request yet; ${ask}. If the seller never takes the payment, Shinjuku sends the whole amount back by itself in about ${Math.ceil(FLOAT_REFUND_ETA_SECONDS / 60)} minutes` }
@@ -123380,7 +123430,7 @@ ${canonical5}`;
           refundAtomic: paid,
           refund: arrived ? "arrived" : notSeen ? "not seen" : "on its way",
           ...FLOAT_ID.test(String(record.floatId)) ? { floatId: record.floatId } : {},
-          ...shinjuku?.floatState ? { refundState: shinjuku.floatState } : {},
+          ...shinjuku?.floatState ? { refundState: refundStateWords(shinjuku.floatState) } : {},
           ...shinjuku?.refundTransaction ? { refundTransaction: shinjuku.refundTransaction } : {},
           note: arrived ? "the seller did not take this payment; the whole amount came back to the private balance" : notSeen ? "the seller did not take this payment; its refund is not seen in the balance (the seller may have kept it)" : sent ? "the seller did not take this payment; Shinjuku sent the refund (refundTransaction), and the private balance counts it at its next read" : "the seller did not take this payment; the whole amount comes back to the private balance by itself"
         };
@@ -123629,7 +123679,7 @@ ${canonical5}`;
   const receipts = {
     name: "wallet_receipts",
     title: "List recent receipts and wallet moves",
-    description: `List this wallet's most recent receipts, newest first. Payments (kind x402 or inference): seller (the URL paid), sellerHost, item (what was bought), priceAtomic, feeAtomic, amountAtomic (the total), sellerTransaction, privateTransaction (this wallet's private payment), facilitator, answeredAt, and transaction / host (the seller's when known). pay.shinjukustaition.com is Shinjuku, the private payment facilitator, never the seller. A payment the seller did not take shows state refund_pending (the refund is on its way; floatId, and refundState and refundTransaction from Shinjuku) until the balance holds it, then refunded. A payment the seller has not served yet shows waiting_for_seller (or seller_paid_not_served once the transfer to the seller landed): call x402_pay again with its requestId to get it. The wallet's own moves (kind shield, add-funds, unshield, private-send, token-transfer, or an older deposit kind): requestId, amountAtomic, state, transaction, at; a private-send row with parts still to go shows partsAt (each part's time and state) and next (it is not stuck); a token-transfer row (wallet_transfer_token) shows tokenMint, tokenAmountAtomic, usdcAtomic (what the sell gave) and sentAtomic; an add-funds row also shows heldAtomic, the USDC waiting at its address (it becomes private by itself after a random privacy wait: never close an address that holds USDC). An add-funds row with via "cli" was made by the shinjuku add-funds command in a terminal: fundsId, route, amountAtomic, state (done or not_finished), transaction; it has no requestId, and wallet_add_funds never continues it. requestId is shown for payments made by this MCP process; older ones show requestKey (its SHA-256). kind "payments" or "moves" lists one group only.`,
+    description: `List this wallet's most recent receipts, newest first. Payments (kind x402 or inference): seller (the URL paid), sellerHost, item (what was bought), priceAtomic, feeAtomic, amountAtomic (the total), sellerTransaction, privateTransaction (this wallet's private payment), facilitator, answeredAt, and transaction / host (the seller's when known). pay.shinjukustaition.com is Shinjuku, the private payment facilitator, never the seller. A payment the seller did not take shows state refund_pending (the refund is on its way; floatId, refundState (Shinjuku's refund step in words) and refundTransaction from Shinjuku) until the balance holds it, then refunded. A payment the seller has not served yet shows waiting_for_seller (or seller_paid_not_served once the transfer to the seller landed): call x402_pay again with its requestId to get it. The wallet's own moves (kind shield, add-funds, unshield, private-send, token-transfer, or an older deposit kind): requestId, amountAtomic, state, transaction, at; a private-send row with parts still to go shows partsAt (each part's time and state) and next (it is not stuck); a token-transfer row (wallet_transfer_token) shows tokenMint, tokenAmountAtomic, usdcAtomic (what the sell gave) and sentAtomic; an add-funds row also shows heldAtomic, the USDC waiting at its address (it becomes private by itself after a random privacy wait: never close an address that holds USDC). An add-funds row with via "cli" was made by the shinjuku add-funds command in a terminal: fundsId, route, amountAtomic, state (done or not_finished), transaction; it has no requestId, and wallet_add_funds never continues it. requestId is shown for payments made by this MCP process; older ones show requestKey (its SHA-256). kind "payments" or "moves" lists one group only.`,
     inputSchema: {
       type: "object",
       properties: {
@@ -124259,7 +124309,9 @@ ${canonical5}`;
     else if (POOL_LAYOUT_CODE.test(code2)) next = `${POOL_LAYOUT_UPDATE}. Then ${again(kind, job)}: it continues where it stopped and never moves the money twice. If the latest release says the same, tell your owner: ${code2}`;
     else if (code2 === "mcp_unshield_to_not_allowed") next = unboundNext(job.requestId, job.amountAtomic);
     else if (code2 === "mcp_unshield_to_invalid") next = UNSHIELD_TO_INVALID_NEXT;
-    else if (kind === "unshield" && /^spend_private_send_(reserved|unknown)$/.test(code2)) next = PROMISED_NEXT;
+    else if (kind === "unshield" && code2 === "spend_private_send_unknown") {
+      next = `Nothing was sent. The wallet is finishing a part of its private send, so the value free beside it is not known yet. In about a minute, ${again(kind, job)}`;
+    } else if (kind === "unshield" && code2 === "spend_private_send_reserved") next = PROMISED_NEXT;
     else if (kind === "unshield" && /send_part_id_taken/.test(code2)) {
       next = `Nothing was sent. A part id of this private send (mp<n>-${job.requestId}) already names another unshield of this wallet: call wallet_unshield with a NEW request_id`;
     } else if (kind === "unshield" && /accounts_split_merge_first/.test(line)) {
@@ -124622,8 +124674,21 @@ ${canonical5}`;
       }
     };
     let told;
+    let joinedParts;
+    let joinSeen = false;
+    let startLogged = false;
+    let waitIntent;
+    try {
+      [waitIntent] = openJoinIntents(session.openStore(), requestId);
+    } catch {
+      waitIntent = void 0;
+    }
+    if (waitIntent) {
+      joinSeen = true;
+      if (Number.isSafeInteger(waitIntent.parts) && waitIntent.parts > 1) joinedParts = waitIntent.parts;
+    }
     joinWaitingCalls += 1;
-    line("wait");
+    line("wait", Number.isSafeInteger(waitIntent?.joinAtMs) ? ` startInMs=${Math.max(0, waitIntent.joinAtMs - Date.now())}` : "");
     try {
       for (; ; ) {
         const job2 = jobs.get(key);
@@ -124640,9 +124705,9 @@ ${canonical5}`;
             line("final", Number.isSafeInteger(finalAtMs) ? ` finalMs=${finalAtMs - startedAt}` : "");
           }
           line("send");
-          await Promise.race([statusWait([job2.promise], Math.max(0, until - Date.now()), progress3, "sending privately").catch(() => {
+          await Promise.race([statusWait([job2.answered ?? job2.promise], Math.max(0, until - Date.now()), progress3, "sending privately").catch(() => {
           }), stopped]);
-          line(job2.state === "done" ? "done" : job2.state === "running" ? signal?.aborted ? "cancel" : "cap" : "ended");
+          line(job2.answeredEarly ? "answered" : job2.state === "done" ? "done" : job2.state === "running" ? signal?.aborted ? "cancel" : "cap" : "ended");
           break;
         }
         if (job2.state !== "failed" || job2.error?.code !== "unshield_joining_accounts") break;
@@ -124665,6 +124730,8 @@ ${canonical5}`;
           intent = void 0;
         }
         if (!intent) break;
+        joinSeen = true;
+        if (Number.isSafeInteger(intent.parts) && intent.parts > 1) joinedParts = intent.parts;
         const phase = Number.isSafeInteger(intent.joinFinalAtMs) ? "final" : Number.isSafeInteger(intent.joinSentAtMs) ? "join" : void 0;
         if (phase && phase !== told) {
           told = phase;
@@ -124675,6 +124742,10 @@ ${canonical5}`;
         const about = `about ${Math.max(1, left.minutes + (left.asks === 2 ? left.thenMinutes : 0))} min`;
         tell(intent.joinAtMs > Date.now() ? `joining your balance's ${parts} first (${about}): the join starts in about ${Math.ceil((intent.joinAtMs - Date.now()) / 1e3)} s (a random wait), then the send` : phase === "join" ? `joining your balance's ${parts} first (${about}): the join is sent; the send follows once it is final` : `joining your balance's ${parts} first (${about}), then the send`);
         if (intent.joinAtMs <= Date.now()) {
+          if (!startLogged && phase === void 0) {
+            startLogged = true;
+            line("start");
+          }
           const result = await joiner.tick();
           if (result?.state === "failed" || result?.skipped === "failed_recently") {
             const last = joiner.status().last ?? result;
@@ -124705,12 +124776,29 @@ ${canonical5}`;
       joinWaitingCalls -= 1;
     }
     const job = jobs.get(key);
-    return job ? jobAnswer("unshield", job) : refuse12(
-      "mcp_unshield_failed",
-      "the send was not found in this process; nothing new was sent by this call",
-      `call wallet_unshield again with request_id "${requestId}" for its state`,
-      { requestId }
-    );
+    if (!job) {
+      return refuse12(
+        "mcp_unshield_failed",
+        "the send was not found in this process; nothing new was sent by this call",
+        `call wallet_unshield again with request_id "${requestId}" for its state`,
+        { requestId }
+      );
+    }
+    const answer = jobAnswer("unshield", job);
+    if (job.state !== "done" || !joinSeen) return answer;
+    let done;
+    try {
+      done = JSON.parse(answer.text);
+    } catch {
+      return answer;
+    }
+    const tookSeconds = Math.round((Date.now() - startedAt) / 1e3);
+    return json3({
+      ...done,
+      ...joinedParts ? { joinedParts } : {},
+      tookSeconds,
+      next: `${done.next}. Tell the user it took about ${tookSeconds} s because the wallet first joined the balance's ${joinedParts ? `${joinedParts} ` : ""}parts (a private move inside the wallet, no fee)`
+    });
   }
   function joinFailedAnswer(job, last) {
     const code2 = typeof last?.code === "string" && last.code ? last.code : "wallet_join_failed";
@@ -125151,9 +125239,9 @@ ${canonical5}`;
         try {
           shortfall = promisedShortfall(session.openStore(), request.amountAtomic);
         } catch {
-          shortfall = { error: "spend_private_send_unknown" };
+          shortfall = { error: "spend_private_send_unknown", pendingAtomic: null };
         }
-        if (shortfall) {
+        if (shortfall && !(shortfall.error === "spend_private_send_unknown" && shortfall.pendingAtomic !== null)) {
           return refuse12(
             shortfall.error,
             promisedShortfallText(shortfall, request.amountAtomic).replace(/^[a-z_]+: /, ""),
@@ -125538,8 +125626,8 @@ ${canonical5}`;
   }
   function runUnshieldJob(job, onStage) {
     if (isSplitSend(job)) return runPrivateSendJob(job, onStage);
-    return underLease((opened) => {
-      if (!opened.readWal(`self-pay-${moneyId(job.requestId)}`)) assertUnshieldNotPromised(opened, job.amountAtomic);
+    return underLease(async (opened) => {
+      if (!opened.readWal(`self-pay-${moneyId(job.requestId)}`)) await assertNotPromisedFresh(opened, job.amountAtomic);
       return unshieldPart(opened, job, moneyId(job.requestId), job.amountAtomic, onStage, (answer) => answerUnshieldEarly(job, answer));
     });
   }
@@ -125560,9 +125648,9 @@ ${canonical5}`;
   async function runPrivateSendJob(job, onStage) {
     const sendId = moneyId(job.requestId);
     let store;
-    const plan = await underLease((opened) => {
+    const plan = await underLease(async (opened) => {
       store = opened;
-      if (!opened.readWal(privateSendPlanName(sendId))) assertUnshieldNotPromised(opened, job.amountAtomic);
+      if (!opened.readWal(privateSendPlanName(sendId))) await assertNotPromisedFresh(opened, job.amountAtomic);
       return planPrivateSend({
         store,
         sendId,
@@ -126207,7 +126295,7 @@ ${canonical5}`;
   const unshield = {
     name: "wallet_unshield",
     title: "Send USDC privately from the shielded balance",
-    description: `Use this when the user says "send 2 USDC to <address>" or "withdraw to my wallet" (leave \`to\` out for the owner's own wallet when one is set): it sends amount (USDC, like "2"; or amount_atomic) from the SHIELDED balance as plain USDC to \`to\`, a public Solana address (the USDC goes to its USDC token account). Privately: the chain shows the pool paying the address, not which wallet paid. The wallet's own key (ownAddress in wallet_balance) is this wallet's public address: it holds the public USDC, wallet_shield deposits from it, and wallet_transfer_token sells from it. So it is refused as \`to\`: an exit there would show on chain that the private balance belongs to this wallet. This holds whether or not that key ever deposited: wallet_add_funds deposits come from one-time addresses, not from this key, so never tell the user the deposits came from it. The facilitator pays every network fee; no SOL is needed. The owner's --unshield-to addresses send at once. Any other address is sent only after the user confirms it in the MCP client (a confirmation dialog); a client that cannot ask is refused (mcp_unshield_to_not_allowed) and a decline sends nothing (mcp_unshield_declined). \`to\` must already hold USDC (have a USDC token account): an address without one is refused before any dialog (mcp_unshield_to_invalid). It takes minutes (one wait of up to 5 minutes is normal): the call answers within about 20 s with stage (confirming, queued, refreshing, self-pay = preparing, exit = sending, done; joining = the balance is in several parts and the wallet joins them first, then sends; the answer says how many more asks and when (joinAsks, joinMinutes), ok: true); call wallet_unshield again with the SAME request_id, amount, and to for the status (each call answers within about 20 s, at once when the send ends; a confirmation dialog the user answers may take longer). One exception: for a single send (no parts, no delay) whose balance is in several parts, when this MCP app sends a progress token with the call, that one call joins the parts and then sends, taking up to ${JOIN_CALL_MAX_MS / 6e4} minutes, with a progress line every ${JOIN_STEP_MS / 1e3} s ("joining your balance's N parts first (about M min)"); tell the user it waits for the join. Without a progress token it answers within about 20 s with stage joining and when to ask again. The same request_id never sends twice, also after a restart. request_id is optional: without it the answer names the id it made, and the same call again within 10 minutes after it ends reads that same send. When it lands, the wallet writes an encrypted backup (backupPath). x402_pay calls wait while it runs. An optional owner cap (--max-unshield) may bound each call and what this wallet sends in any 24 hours, from every MCP process (mcp_unshield_cap_exceeded: tell the owner). Other refusals: mcp_argument_invalid, mcp_request_id_reused, mcp_unshield_to_invalid, wallet_locked, mcp_tool_disabled, mcp_unshield_failed, and the unshield's own p03_* codes. PRIVATE SEND (optional): when the user says "send it in parts", "spread it out", or "do not send it all at once", pass parts (2-8) WITH max_delay_minutes (1-60; parts with no wait are refused: they would leave together): the amount is split into parts exits of unequal size (each at least 0.01 USDC), each sent after a random wait of up to max_delay_minutes (part 1 too), so the chain shows no single exit of this amount at this time. max_delay_minutes alone delays one exit. ` + SEND_RUNS_ON + ` Late parts never go together. While parts are unsent, x402_pay may spend only the rest of the balance. The plan is saved in the wallet before part 1, so the same request_id (with the same parts and max_delay_minutes) continues after a restart and never sends a part twice; the answer's privateSend lists each part (state, amount, when it may go, transactions), sentAtomic, and remainingAtomic. The user confirms the whole send once. Both left out: one exit, as before. Each part is a full unshield, so it takes as long as one, and the facilitator pays the network fee of each. Privacy limit: every part goes to the SAME \`to\`, so anyone who adds up that address's incoming transfers sees the total; the parts hide the time and the single amount of the exit, not the sum the address received. wallet_cancel with the same request_id stops the parts not sent yet (their value stays in the shielded balance); while a part is being sent, that call waits for the part to finish, up to about ${CALL_BUDGET_MS / 1e3} s.`,
+    description: `Use this when the user says "send 2 USDC to <address>" or "withdraw to my wallet" (leave \`to\` out for the owner's own wallet when one is set): it sends amount (USDC, like "2"; or amount_atomic) from the SHIELDED balance as plain USDC to \`to\`, a public Solana address (the USDC goes to its USDC token account). Privately: the chain shows the pool paying the address, not which wallet paid. The wallet's own key (ownAddress in wallet_balance) is this wallet's public address: it holds the public USDC, wallet_shield deposits from it, and wallet_transfer_token sells from it. So it is refused as \`to\`: an exit there would show on chain that the private balance belongs to this wallet. This holds whether or not that key ever deposited: wallet_add_funds deposits come from one-time addresses, not from this key, so never tell the user the deposits came from it. The facilitator pays every network fee; no SOL is needed. The owner's --unshield-to addresses send at once. Any other address is sent only after the user confirms it in the MCP client (a confirmation dialog); a client that cannot ask is refused (mcp_unshield_to_not_allowed) and a decline sends nothing (mcp_unshield_declined). \`to\` must already hold USDC (have a USDC token account): an address without one is refused before any dialog (mcp_unshield_to_invalid). It takes minutes (one wait of up to 5 minutes is normal): the call answers within about 20 s with stage (confirming, queued, refreshing, self-pay = preparing, exit = sending, done; joining = the balance is in several parts and the wallet joins them first, then sends; the answer says how many more asks and when (joinAsks, joinMinutes), ok: true); call wallet_unshield again with the SAME request_id, amount, and to for the status (each call answers within about 20 s, at once when the send ends; a confirmation dialog the user answers may take longer). One exception: for a single send (no parts, no delay) whose balance is in several parts, when this MCP app sends a progress token with the call, that one call joins the parts and then sends, taking up to ${JOIN_CALL_MAX_MS / 6e4} minutes, with a progress line every ${JOIN_STEP_MS / 1e3} s ("joining your balance's N parts first (about M min)"). Some apps show nothing during this call: BEFORE it, when wallet_balance shows balanceParts above 1, tell the user that sending all of it first joins the parts and takes about the minutes wallet_balance names. Without a progress token it answers within about 20 s with stage joining and when to ask again. The same request_id never sends twice, also after a restart. request_id is optional: without it the answer names the id it made, and the same call again within 10 minutes after it ends reads that same send. When it lands, the wallet writes an encrypted backup (backupPath). x402_pay calls wait while it runs. An optional owner cap (--max-unshield) may bound each call and what this wallet sends in any 24 hours, from every MCP process (mcp_unshield_cap_exceeded: tell the owner). Other refusals: mcp_argument_invalid, mcp_request_id_reused, mcp_unshield_to_invalid, wallet_locked, mcp_tool_disabled, mcp_unshield_failed, and the unshield's own p03_* codes. PRIVATE SEND (optional): when the user says "send it in parts", "spread it out", or "do not send it all at once", pass parts (2-8) WITH max_delay_minutes (1-60; parts with no wait are refused: they would leave together): the amount is split into parts exits of unequal size (each at least 0.01 USDC), each sent after a random wait of up to max_delay_minutes (part 1 too), so the chain shows no single exit of this amount at this time. max_delay_minutes alone delays one exit. ` + SEND_RUNS_ON + ` Late parts never go together. While parts are unsent, x402_pay may spend only the rest of the balance. The plan is saved in the wallet before part 1, so the same request_id (with the same parts and max_delay_minutes) continues after a restart and never sends a part twice; the answer's privateSend lists each part (state, amount, when it may go, transactions), sentAtomic, and remainingAtomic. The user confirms the whole send once. Both left out: one exit, as before. Each part is a full unshield, so it takes as long as one, and the facilitator pays the network fee of each. Privacy limit: every part goes to the SAME \`to\`, so anyone who adds up that address's incoming transfers sees the total; the parts hide the time and the single amount of the exit, not the sum the address received. wallet_cancel with the same request_id stops the parts not sent yet (their value stays in the shielded balance); while a part is being sent, that call waits for the part to finish, up to about ${CALL_BUDGET_MS / 1e3} s.`,
     inputSchema: {
       type: "object",
       properties: {
@@ -126948,12 +127036,12 @@ ${canonical5}`;
     send: async (plan) => {
       const job = { requestId: plan.id, to: plan.to };
       let store;
-      const sendPlan = await withLockRetry(() => underLease((opened) => {
+      const sendPlan = await withLockRetry(() => underLease(async (opened) => {
         store = opened;
         const name = privateSendPlanName(plan.sendId);
         if (!opened.readWal(name) && readTransferToken(opened, plan.id)?.state === "cancelled") return null;
         const amount = transferSendAtomic(plan, opened);
-        if (!opened.readWal(name)) assertUnshieldNotPromised(opened, amount);
+        if (!opened.readWal(name)) await assertNotPromisedFresh(opened, amount);
         const written = planPrivateSend({
           store: opened,
           sendId: plan.sendId,
@@ -130209,69 +130297,6 @@ var init_stdioServer = __esm({
   }
 });
 
-// wallet/src/net/torMissingMcp.mjs
-var torMissingMcp_exports = {};
-__export(torMissingMcp_exports, {
-  RESTART: () => RESTART,
-  serveTorMissingMcp: () => serveTorMissingMcp
-});
-async function serveTorMissingMcp({ message, recheck = async () => false, input = process.stdin, output: output2 = process.stdout, log = () => {
-} }) {
-  const error = "mcp_tor_unavailable";
-  const match = /^([a-z][a-z0-9_]*): ([\s\S]*)$/.exec(String(message));
-  const cause = match ? match[1] : "tor_not_running";
-  const detail = match ? match[2] : String(message);
-  const answer = async () => {
-    let ready = false;
-    try {
-      ready = await recheck() === true;
-    } catch {
-      ready = false;
-    }
-    const body = ready ? {
-      say: `Tor runs on this machine now, but this wallet started before it did. ${RESTART}.`,
-      ok: false,
-      error: "mcp_restart_needed",
-      next: `Tell the user: ${RESTART}. Nothing was paid.`
-    } : {
-      say: `The wallet is set to run behind Tor, and Tor is not running on this machine, so nothing was sent and nothing was paid.`,
-      ok: false,
-      error,
-      cause,
-      detail,
-      next: `Tell the user what to install, with the command for their OS from detail; when Tor runs: ${RESTART}.`
-    };
-    log(`MCP_TOR_MISSING_ANSWER ${body.error}`);
-    return { text: JSON.stringify(body, null, 2), isError: true };
-  };
-  const hidden = new Set(MCP_HIDDEN_TOOL_NAMES);
-  const tools = [...MCP_TOOL_NAMES, "wallet_status"].map((name) => ({
-    name,
-    title: name,
-    description: `Not available yet: Tor is not running on this machine. Call it for the install command (it moves no money).`,
-    inputSchema: { type: "object", properties: {}, additionalProperties: true },
-    annotations: { readOnlyHint: true },
-    hidden: hidden.has(name),
-    run: answer
-  }));
-  const dispatch = createMcpDispatcher({
-    tools,
-    aliases: MCP_TOOL_ALIASES,
-    instructions: `The Shinjuku Shield wallet is set to run behind Tor, and Tor is not running on this machine. Call wallet_balance: its answer has the install command for the user's OS. ${RESTART} after Tor starts.`
-  });
-  await serveStdio({ input, output: output2, dispatch, log });
-  return 1;
-}
-var RESTART;
-var init_torMissingMcp = __esm({
-  "wallet/src/net/torMissingMcp.mjs"() {
-    "use strict";
-    init_stdioServer();
-    init_tools();
-    RESTART = "Restart this MCP server in your app (or restart the app), then ask again";
-  }
-});
-
 // wallet/src/inference/chat.mjs
 var chat_exports = {};
 __export(chat_exports, {
@@ -130281,7 +130306,7 @@ __export(chat_exports, {
   isProgressLine: () => isProgressLine,
   runChat: () => runChat
 });
-import { randomBytes as randomBytes28 } from "node:crypto";
+import { randomBytes as randomBytes27 } from "node:crypto";
 import { createInterface } from "node:readline";
 function chosenCap(value) {
   const text3 = value === void 0 || value === null ? "" : String(value);
@@ -130561,7 +130586,7 @@ async function runChat({ io, values, deps = {} }) {
           if (state.pending) say6("(The unfinished answer is dropped; this is a new question.)");
           state.pending = void 0;
           await runTurn({
-            requestId: `chat-${randomBytes28(8).toString("hex")}`,
+            requestId: `chat-${randomBytes27(8).toString("hex")}`,
             model: state.model,
             messages: [...state.history, { role: "user", content: text3 }],
             capAtomic: void 0
@@ -130612,6 +130637,69 @@ var init_chat = __esm({
   }
 });
 
+// wallet/src/net/torMissingMcp.mjs
+var torMissingMcp_exports = {};
+__export(torMissingMcp_exports, {
+  RESTART: () => RESTART,
+  serveTorMissingMcp: () => serveTorMissingMcp
+});
+async function serveTorMissingMcp({ message, recheck = async () => false, input = process.stdin, output: output2 = process.stdout, log = () => {
+} }) {
+  const error = "mcp_tor_unavailable";
+  const match = /^([a-z][a-z0-9_]*): ([\s\S]*)$/.exec(String(message));
+  const cause = match ? match[1] : "tor_not_running";
+  const detail = match ? match[2] : String(message);
+  const answer = async () => {
+    let ready = false;
+    try {
+      ready = await recheck() === true;
+    } catch {
+      ready = false;
+    }
+    const body = ready ? {
+      say: `Tor runs on this machine now, but this wallet started before it did. ${RESTART}.`,
+      ok: false,
+      error: "mcp_restart_needed",
+      next: `Tell the user: ${RESTART}. Nothing was paid.`
+    } : {
+      say: `The wallet is set to run behind Tor, and Tor is not running on this machine, so nothing was sent and nothing was paid.`,
+      ok: false,
+      error,
+      cause,
+      detail,
+      next: `Tell the user what to install, with the command for their OS from detail; when Tor runs: ${RESTART}.`
+    };
+    log(`MCP_TOR_MISSING_ANSWER ${body.error}`);
+    return { text: JSON.stringify(body, null, 2), isError: true };
+  };
+  const hidden = new Set(MCP_HIDDEN_TOOL_NAMES);
+  const tools = [...MCP_TOOL_NAMES, "wallet_status"].map((name) => ({
+    name,
+    title: name,
+    description: `Not available yet: Tor is not running on this machine. Call it for the install command (it moves no money).`,
+    inputSchema: { type: "object", properties: {}, additionalProperties: true },
+    annotations: { readOnlyHint: true },
+    hidden: hidden.has(name),
+    run: answer
+  }));
+  const dispatch = createMcpDispatcher({
+    tools,
+    aliases: MCP_TOOL_ALIASES,
+    instructions: `The Shinjuku Shield wallet is set to run behind Tor, and Tor is not running on this machine. Call wallet_balance: its answer has the install command for the user's OS. ${RESTART} after Tor starts.`
+  });
+  await serveStdio({ input, output: output2, dispatch, log });
+  return 1;
+}
+var RESTART;
+var init_torMissingMcp = __esm({
+  "wallet/src/net/torMissingMcp.mjs"() {
+    "use strict";
+    init_stdioServer();
+    init_tools();
+    RESTART = "Restart this MCP server in your app (or restart the app), then ask again";
+  }
+});
+
 // packages/ctvault-v0b/node_modules/@solana/errors/dist/index.node.mjs
 function encodeValue16(value) {
   if (Array.isArray(value)) {
@@ -154551,9 +154639,10 @@ init_fs();
 init_balance();
 init_deposit();
 import { spawn as spawn8 } from "node:child_process";
-import { randomBytes as randomBytes27, randomInt as randomInt9 } from "node:crypto";
+import { randomBytes as randomBytes28, randomInt as randomInt9 } from "node:crypto";
 import { tmpdir as tmpdir4 } from "node:os";
 import { join as join36, resolve as resolve32 } from "node:path";
+init_chat();
 init_proxy();
 init_rpcDefault();
 init_usdcWords();
@@ -154812,8 +154901,12 @@ function fundsSummary(view2) {
     `Next: ${view2.next}.`
   ].join("\n");
 }
-function printEnd(deps, view2) {
-  deps.io.out(deps.stdoutIsTTY?.() === true ? `${fundsSummary(view2)}
+function fundsOutput(values, deps) {
+  const terminal = deps.stdoutIsTTY?.() === true && !values.has("--json");
+  return { terminal, quiet: terminal && !values.has("--verbose") };
+}
+function printEnd(deps, view2, terminal) {
+  deps.io.out(terminal ? `${fundsSummary(view2)}
 ` : `${JSON.stringify(view2, null, 2)}
 `);
 }
@@ -154829,14 +154922,14 @@ function fundsStatusSummary(view2) {
     `Privacy: ${view2.privacy}.`,
     ...view2.otherRuns?.length ? [`Other add-funds runs of this wallet: ${view2.otherRuns.join(", ")} (add --funds-id <id> to see one).`] : [],
     next,
-    "For the whole status as JSON, send this command's output to a file or a program."
+    "For the whole status as JSON, add --json (or send this command's output to a file or a program)."
   ].join("\n");
 }
-var HELD = /^(shinjuku(?:-wallet)?\b.*\bfailed: |hint: |Help: |next: |Examples?:|Every flag: |  shinjuku(?:-wallet)? )/;
+var HELD = /^(shinjuku(?:-wallet)?\b.*\bfailed: |shinjuku(?:-wallet)?\b.*: waiting for funds, nothing failed \(|hint: |Help: |next: |Examples?:|Every flag: |  shinjuku(?:-wallet)? )/;
 var STEP_TOR_LINE = /^(?:tor|proxy): /;
 async function runStep(ctx, argv2) {
   if (ctx.signal.aborted) return { exit: 1, held: [], codes: [], details: {}, aborted: true };
-  const file = join36(ctx.tempDir, `step-${randomBytes27(8).toString("hex")}.json`);
+  const file = join36(ctx.tempDir, `step-${randomBytes28(8).toString("hex")}.json`);
   const held = [];
   let last;
   const proc = spawn8(process.execPath, [...process.execArgv, ctx.entry, ...ctx.proxyArgs, ...argv2], {
@@ -154853,6 +154946,7 @@ async function runStep(ctx, argv2) {
     }
     if (STEP_TOR_LINE.test(text3) && !TOR_TROUBLE_LINE.test(text3) && !/\bWARNING\b/.test(text3)) return;
     if (text3.trim()) last = text3;
+    if (ctx.quiet && isProgressLine(text3)) return;
     if (!text3.trim() || ctx.shown.has(text3)) return;
     ctx.shown.add(text3);
     ctx.io.err(`  ${text3}
@@ -155234,6 +155328,7 @@ var STAGE_START = Object.freeze({
   pocket: (plan) => `fills ${plan.pockets} ready pocket${plan.pockets === 1 ? "" : "s"} of ${usdc5(plan.pocketSizeAtomic)} USDC for sellers that take standard exact only (pocket fill); a payment from a pocket takes seconds`,
   balance: () => "reads the new balance from the chain (balance --refresh)"
 });
+var STEP_WORDS = / \((?:deposit --relay|balance --refresh|pocket fill|privacy-cash (?:deposit|withdraw))[^)]*\)/g;
 function readPrivateLine(path, flag3) {
   try {
     const text3 = readSecretText(path, flag3);
@@ -155438,7 +155533,7 @@ async function addFunds(values, deps) {
   }
   const tempDir = mkdtempSync(join36(tmpdir4(), "shinjuku-funds-"));
   const abort = new AbortController();
-  const ctx = { io, store, values: run5, tempDir, now: deps.now, signal: abort.signal, shown: /* @__PURE__ */ new Set(), transient: 0, entry: process.argv[1] };
+  const ctx = { io, store, values: run5, tempDir, now: deps.now, signal: abort.signal, shown: /* @__PURE__ */ new Set(), transient: 0, entry: process.argv[1], ...fundsOutput(values, deps) };
   const onSignal = (signal) => {
     if (abort.signal.aborted) return;
     abort.abort();
@@ -155452,7 +155547,7 @@ async function addFunds(values, deps) {
     if (resolved.shown) {
       io.err(`add-funds ${plan.fundsId} is ready already; nothing new was started (a new top-up needs a new --funds-id)
 `);
-      printEnd(deps, fundsView(store, plan, { now: deps.now() }));
+      printEnd(deps, fundsView(store, plan, { now: deps.now() }), ctx.terminal);
       return;
     }
     const save2 = () => store.writeWal(planName(plan.fundsId), plan);
@@ -155463,7 +155558,7 @@ async function addFunds(values, deps) {
       plan,
       proxyArgs: proxy.args,
       childEnv: { ...proxy.env, [PASSPHRASE_ENV]: passphrase2, [RPC_ENV2]: rpcUrl },
-      say: (stage, text3) => io.err(`add-funds ${plan.fundsId} [${stage}] ${text3}
+      say: (stage, text3) => io.err(`add-funds ${plan.fundsId} [${stage}] ${ctx.quiet ? text3.replace(STEP_WORDS, "") : text3}
 `),
       mark: (stage) => {
         if (plan.done?.[stage]) return;
@@ -155495,8 +155590,8 @@ async function addFunds(values, deps) {
         plan.status = { stage: "ready", at: iso2(deps.now()) };
         save2();
         const view3 = fundsView(openStore(), plan, { now: deps.now() });
-        ctx.say("ready", view3.status);
-        printEnd(deps, view3);
+        if (!ctx.terminal) ctx.say("ready", view3.status);
+        printEnd(deps, view3, ctx.terminal);
         return;
       }
       if (stage !== lastStage) {
@@ -155532,7 +155627,7 @@ async function addFunds(values, deps) {
       if (values.has("--once")) {
         plan.status = { ...plan.status, ended: iso2(deps.now()) };
         save2();
-        printEnd(deps, fundsView(store, plan, { now: deps.now(), running: false }));
+        printEnd(deps, fundsView(store, plan, { now: deps.now(), running: false }), ctx.terminal);
         return;
       }
       await sleep3(outcome.ms, abort.signal);
@@ -155542,7 +155637,7 @@ async function addFunds(values, deps) {
     const view2 = fundsView(store, plan, { now: deps.now(), running: false });
     io.err(`add-funds ${plan.fundsId} stopped at ${view2.stage}: nothing is lost. Rerun this same command to continue
 `);
-    printEnd(deps, view2);
+    printEnd(deps, view2, ctx.terminal);
   } finally {
     process.off("SIGINT", onSignal);
     process.off("SIGTERM", onSignal);
@@ -155559,7 +155654,7 @@ async function fundsStatus(values, deps) {
   const plans = fundsPlans(store);
   const wanted = values.get("--funds-id");
   const plan = wanted === void 0 ? plans.at(-1) : plans.find((entry) => entry.fundsId === wanted);
-  const terminal = deps.stdoutIsTTY?.() === true;
+  const { terminal } = fundsOutput(values, deps);
   if (!plan) {
     const none3 = {
       status: wanted === void 0 ? "this wallet has no add-funds run yet" : "this wallet has no add-funds run with that --funds-id",
@@ -157834,7 +157929,9 @@ var COMMANDS = [
       { ...TREE_RPC_FLAG, about: `--route privacy-cash: ${TREE_RPC_FLAG.about}` },
       flag2("--funds-id", "<id>", "the name of this funding run; default: the unfinished one, else a new funds-<n>. A new top-up after one is ready needs a new name"),
       flag2("--split", "<k|auto>", "default 1 (one deposit, one transfer). 1 to 8: k equal deposits of --amount/k (whole USDC each), each from its own one-time address, so k payments run in a row without waiting for a pool anchor. auto: up to 4 deposits, 1 USDC each and the rest in the last (5 USDC: 1, 1, 1 and 2 USDC). Exchange and changenow routes"),
-      bool2("--once", "run what can run now, print the status, and exit instead of waiting (for your own scheduler)")
+      bool2("--once", "run what can run now, print the status, and exit instead of waiting (for your own scheduler)"),
+      bool2("--json", "end with the status as JSON in a terminal too (a file or a program gets it without this flag)"),
+      bool2("--verbose", "also show the wallet's own progress lines in a terminal (Tor, the RPC relay, the pool history, the memo reads) and the command each step runs")
     ],
     examples: [
       `${CLI2} add-funds --route exchange --amount 2 ${FUNDS_BASE}`,
@@ -157856,7 +157953,7 @@ var COMMANDS = [
       "It changes no rule: the crowd hold, the dwell, whole-USDC deposits, and every refusal are the single commands' own. A refusal that a later run clears (the hold, the crowd count, the dwell, a paused facilitator) is a wait; any other refusal stops it with that command's own line and hint (exit 1), and the rerun continues after your fix. It has no override flag: run the single command (for example privacy-cash withdraw --hold-override) when you choose to give up a wait.",
       "--tor (or --proxy): each step runs as its own Tor run, as if you typed it: a new circuit and its own Tor check. With --tor, --service may be the facilitator's http://<v3 onion>/ origin.",
       `--history-rpc: the balance --refresh and pocket fill steps (and the dwell check) read the pool's public history from it (${CLI2} help balance says what it sees); the deposit and Privacy Cash steps never get it. Without it, those two steps read from the history proxy this wallet pins for the pool (its onion with --tor, else https on the facilitator's pay host; --history-rpc own keeps them on your own RPC). add-funds does not keep it: give it again on each rerun. It never falls back to your own RPC: a failed source fails the step with history_rpc_failed, and add-funds handles that as it handles the step's other refusals.`,
-      "In a terminal it ends with a short summary (ready with your balance, or where it stopped and what to do); when its output goes to a file or a program, it ends with the status as JSON, as funds-status prints it. While it waits for the USDC it checks the one-time address every 20 s for the first 5 minutes, then every 2 minutes.",
+      "In a terminal it shows one line per step and ends with a short summary (ready with your balance, or where it stopped and what to do); the wallet's own progress lines (Tor, the RPC relay, the pool history, the memo reads) show only with --verbose, and every warning or failure shows always. With --json, or when its output goes to a file or a program, it ends with the status as JSON, as funds-status prints it, and shows every progress line. While it waits for the USDC it checks the one-time address every 20 s for the first 5 minutes, then every 2 minutes.",
       '--once: run what can run now, print the status (the summary in a terminal; JSON for your scheduler, with "ready": false while it waits), and exit 0; run it again from your own scheduler.',
       "When it is ready, the same command again only shows its status; a new top-up needs a new --funds-id.",
       "One deposit by default: one transfer, one token-account rent for the sender. A payment spends one funded account, and its change (a pocket fill's too) can pay only after the next pool anchor (up to 5 minutes; about 30 s on some pools), so a second shielded spend before that anchor waits up to 5 minutes. The wallet sets money aside for payments in the background, where that wait costs you nothing, so one deposit is enough for most agents. --split auto (exchange and changenow) is for an agent that makes several shielded spends at once: up to 4 deposits, 1 USDC each and the rest in the last one (2 USDC: 1 and 1; 3 USDC: 1, 1 and 1; 5 USDC: 1, 1, 1 and 2; 20 USDC: 1, 1, 1 and 17). Each funded account pays one payment or one 1 USDC pocket fill per pool anchor without waiting, and a payment pays from the smallest account that covers it, so the large one stays for a payment above 1 USDC. With 5 USDC and --pockets 1: the pocket fill takes one 1 USDC account, and 3 more spends run before the next anchor without waiting (one deposit: the next spend after the fill waits up to 5 minutes for the anchor). What it costs: each deposit is its own one-time address, and the sender pays each address's USDC token account (about 0.0015 SOL each, so 4 deposits cost about 0.006 SOL), and you send 4 transfers instead of 1. --split <k> (2 to 8): k equal deposits of --amount/k, so the wallet holds k funded accounts. --amount must split into whole USDC (--amount 2 --split 2: two deposits of 1 USDC). add-funds records all k one-time addresses first, then prints them: send exactly --amount/k to EACH one, as k separate withdrawals (or k ChangeNOW exchanges); each address takes one deposit. Each deposit is its own record (deposit-<funds-id>, deposit-<funds-id>-part2, ...), so a rerun continues every part; it is ready when all k landed. What it shows: k public deposit amounts instead of one, read and landing close together, so they can show one depositor (about what one deposit of the total shows); the facilitator pays the fee and rent of each. --split (auto parts follow a new --amount) may change until any address is funded, never below the addresses already recorded. Not with --route privacy-cash. balance shows how many payments can run without waiting."
@@ -157864,6 +157961,8 @@ var COMMANDS = [
     next: `see where it is from any terminal: ${CLI2} funds-status --pool ${GUIDE.pool} --passphrase-file passphrase.txt`,
     nextInOutput: true,
     validate: (values) => validateAddFunds(values),
+    // In a terminal without --json or --verbose: its own progress lines stay off the screen (funds/addFunds.mjs fundsOutput).
+    quietProgress: (values, deps) => fundsOutput(values, deps).quiet,
     run: (args, values, deps, io) => deps.fundsMain("add-funds", values, { ...deps, io })
   },
   {
@@ -157873,12 +157972,13 @@ var COMMANDS = [
     flags: [
       flag2("--pool", "<address>", "the shielded pool", { required: true, check: "pubkey" }),
       flag2("--passphrase-file", "<file>", `the private file that holds the wallet passphrase (the one add-funds uses); or set ${PASSPHRASE_ENV2}`),
-      flag2("--funds-id", "<id>", "one add-funds run; default: the newest")
+      flag2("--funds-id", "<id>", "one add-funds run; default: the newest"),
+      bool2("--json", "print the status as JSON in a terminal too (a file or a program gets it without this flag)")
     ],
     examples: [`${CLI2} funds-status --pool ${GUIDE.pool} --passphrase-file passphrase.txt`],
     notes: [
       "It reads local files only (the wallet log and the add-funds lock) and makes no network call, so you can run it at any time: while add-funds runs, or after it stopped.",
-      "In a terminal it prints a short summary in plain words: the status, where to send the USDC while add-funds waits for it, the privacy cost, and what to do next. When its output goes to a file or a program, it prints the status as JSON, with the fields below.",
+      "In a terminal it prints a short summary in plain words: the status, where to send the USDC while add-funds waits for it, the privacy cost, and what to do next. With --json, or when its output goes to a file or a program, it prints the status as JSON, with the fields below.",
       'In the JSON, status is one line: the stage and what it waits for (next try at), "not running" when no add-funds runs for this wallet, "stopped" with what needs you, or "ready" with your balance; it ends with what the route shows, and to whom (privacy). running is true while an add-funds run holds this wallet. stages lists every stage: done (with its time), waiting, next, not running, stopped, or later.',
       "oneTimeAddress and send show while the deposit waits for USDC: on the exchange and changenow routes, send to it once, and only the amount shown. leftoverAtOneTimeAddress shows USDC beyond the amount that stays at that address, and what taking it back shows. With --split (k or auto): split and parts show each deposit (its amount, state, one-time address while it waits for USDC, and signature once it landed); send goes to every address listed, each with its own amount.",
       "Without --funds-id it shows the newest run; otherRuns names the others."
@@ -158391,7 +158491,7 @@ var COMMANDS = [
     // The same for its RPC: only the Tor run resolves it, so the relay line shows once, not once per process.
     rpcWhen: (values, env) => inProxiedRun(env),
     // The Tor run, the one that pays: its progress lines show only with --verbose (inference/chat.mjs hideProgressLines).
-    quietProgress: (values, env) => inProxiedRun(env) && !values.has("--verbose"),
+    quietProgress: (values, deps) => inProxiedRun(deps.env) && !values.has("--verbose"),
     run: (args, values, deps, io) => deps.chatMain(values, { ...deps, io })
   },
   {
@@ -160768,7 +160868,7 @@ This copy: ${walletVersionLine(deps.walletVersion())}
     const commandArgs = defaults.args;
     const runDeps = defaults.passphrase === void 0 ? deps : { ...deps, env: { ...deps.env, [PASSPHRASE_ENV2]: defaults.passphrase } };
     values = parseFlags(command2, commandArgs);
-    if (command2.quietProgress?.(values, runDeps.env) === true) showProgressAgain = hideProgressLines();
+    if (command2.quietProgress?.(values, runDeps) === true) showProgressAgain = hideProgressLines();
     const skip = command2.beforeValidate?.(values, runDeps, typedArgs, usdc9.oldForm) === SKIP_VALIDATE;
     if (!skip) validate3(command2, values, runDeps.env);
     retiredPoolGuard(command2, values, io, deps.walletVersion().npm);