shinjuku-shielded 0.3.39 → 0.3.40

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "5f5ca189829786779ba9e05c237bb6edf057a06d4745f0a601212136aa0bf68f",
-  "bytes": 11216201,
-  "sourceCommit": "c72d3c75917cf35191aa263f3e30878779ed814b",
+  "sha256": "5b21a788efa0e47f3e83f413f73a4c11a70f068edda47f4f68be3bd6c0855955",
+  "bytes": 11226333,
+  "sourceCommit": "40a82beaab73a8c1e1dbd6d44682b4d2cd93e402",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.39",
+  "version": "0.3.40",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "5f5ca189",
-  "shinjukuSha256": "5f5ca189829786779ba9e05c237bb6edf057a06d4745f0a601212136aa0bf68f",
+  "shinjukuRelease": "5b21a788",
+  "shinjukuSha256": "5b21a788efa0e47f3e83f413f73a4c11a70f068edda47f4f68be3bd6c0855955",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -42330,6 +42330,54 @@ var init_pool_denomination = __esm({
   }
 });
 
+// spikes/shielded-x402-wallet/lib/rpc-url.mjs
+function flagValue(args, name) {
+  const index = args.indexOf(name);
+  if (index === -1) return void 0;
+  const value = args[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`rpc_flag_value_missing: ${name} requires a value`);
+  return value;
+}
+function resolveRpcUrl(args, { env = process.env, warn = (line) => console.error(line), fallback } = {}) {
+  const file = flagValue(args, "--rpc-file");
+  const inline = flagValue(args, "--rpc");
+  if (file !== void 0 && inline !== void 0) throw new Error("rpc_flags_conflict: use --rpc-file or --rpc, not both");
+  if (file !== void 0) {
+    let text3;
+    try {
+      text3 = readFileSync(file, "utf8");
+    } catch (error) {
+      throw new Error(`rpc_file_unreadable: --rpc-file could not be read (${typeof error?.code === "string" ? error.code : "read error"})`);
+    }
+    const value = text3.split(/\r?\n/)[0].trim();
+    if (!value) throw new Error("rpc_file_empty: --rpc-file holds no RPC URL on its first line");
+    return value;
+  }
+  if (inline !== void 0) {
+    if (rpcUrlLooksKeyed(inline)) {
+      warn("warning: --rpc shows this RPC URL, key included, to anyone who can list processes or read shell history; put the URL in a private file and pass --rpc-file <file>");
+    }
+    return inline;
+  }
+  return env.UNDERMARKET_SOLANA_RPC_URL || fallback;
+}
+function rpcUrlLooksKeyed(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return true;
+  }
+  if (url.search || url.username || url.password) return true;
+  return url.pathname.split("/").some((segment) => segment.length >= 16 && /^[A-Za-z0-9_-]+$/.test(segment) && /[0-9]/.test(segment) && /[A-Za-z]/.test(segment));
+}
+var init_rpc_url = __esm({
+  "spikes/shielded-x402-wallet/lib/rpc-url.mjs"() {
+    "use strict";
+    init_fs();
+  }
+});
+
 // spikes/shielded-x402-wallet/lib/prove.mjs
 import { createHash as createHash4 } from "node:crypto";
 import { join as join2, resolve as resolve2 } from "node:path";
@@ -42507,7 +42555,7 @@ function readRpcFileLine(path) {
     return void 0;
   }
 }
-function resolveRpcUrl({ rpcFile, rpc: rpc2, env = process.env, origin, readFile: readFile5, notice } = {}) {
+function resolveRpcUrl2({ rpcFile, rpc: rpc2, env = process.env, origin, readFile: readFile5, notice } = {}) {
   if (rpcFile !== void 0) {
     const url2 = (readFile5 ?? readRpcFileLine)(rpcFile);
     if (!url2) throw new Error("rpc_file_unreadable: --rpc-file could not be read, or its first line is empty");
@@ -54782,12 +54830,23 @@ async function prepareFinalizedP03RecoveryFold(history, { sliceMs = 20 } = {}) {
   if (REBUILT_BY_REPORT.has(authenticated)) return;
   const running = FOLDS_IN_FLIGHT.get(authenticated);
   if (running !== void 0) return running;
+  if (foldInFlight !== void 0) markPhase("fold-wait");
+  while (foldInFlight !== void 0) {
+    await foldInFlight.catch(() => {
+    });
+    if (REBUILT_BY_REPORT.has(authenticated)) return;
+    const joined = FOLDS_IN_FLIGHT.get(authenticated);
+    if (joined !== void 0) return joined;
+  }
   const folding = foldInSlices(authenticated, sliceMs);
   FOLDS_IN_FLIGHT.set(authenticated, folding);
+  foldInFlight = folding;
   try {
-    return await folding;
+    await folding;
+    markPhase("fold-done");
   } finally {
     FOLDS_IN_FLIGHT.delete(authenticated);
+    if (foldInFlight === folding) foldInFlight = void 0;
   }
 }
 async function foldInSlices(authenticated, sliceMs) {
@@ -54816,6 +54875,7 @@ function* rebuildOrderedPrefixSteps(history) {
     while (resumed < prior.leaves.length && contexts[resumed].outCommitment === prior.leaves[resumed] && contexts[resumed].appendRoot === prior.roots[resumed + 1]) resumed += 1;
     if (resumed !== prior.leaves.length) resumed = 0;
   }
+  markPhase(resumed > 0 ? "fold-reused" : "fold-cold");
   let nodes = resumed > 0 ? prior.nodes : zeroRoots2.slice(0, OUTER_DEPTH);
   let root = resumed > 0 ? prior.roots[resumed] : zeroRoots2[OUTER_DEPTH];
   const roots = resumed > 0 ? prior.roots.slice(0, resumed + 1) : [root];
@@ -54990,7 +55050,7 @@ function canonicalField(value, label) {
   }
   return value;
 }
-var FIELD_MODULUS4, SUBTREE_LEAVES2, LOCAL_DEPTH, OUTER_DEPTH, TREE_DEPTH, P03_RECOVERY_PATH_SOURCE_MODEL, P03_PINNED_POSEIDON_PARAMETERS_SHA256, P03_PINNED_ZERO_LEAF, hashCalls, hash3, REBUILT_BY_REPORT, lastFold, FOLDS_IN_FLIGHT, ZERO_UPPER_ROOTS, LOCAL_ZERO_ROOTS, lastOuter;
+var FIELD_MODULUS4, SUBTREE_LEAVES2, LOCAL_DEPTH, OUTER_DEPTH, TREE_DEPTH, P03_RECOVERY_PATH_SOURCE_MODEL, P03_PINNED_POSEIDON_PARAMETERS_SHA256, P03_PINNED_ZERO_LEAF, hashCalls, hash3, REBUILT_BY_REPORT, lastFold, FOLDS_IN_FLIGHT, foldInFlight, ZERO_UPPER_ROOTS, LOCAL_ZERO_ROOTS, lastOuter;
 var init_recoveryPath = __esm({
   "wallet/src/recovery/recoveryPath.mjs"() {
     "use strict";
@@ -54998,6 +55058,7 @@ var init_recoveryPath = __esm({
     init_reference2();
     init_notes2();
     init_walk();
+    init_phaseTiming();
     FIELD_MODULUS4 = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
     SUBTREE_LEAVES2 = 128n;
     LOCAL_DEPTH = 7;
@@ -56109,6 +56170,7 @@ async function loadOrExtendFinalizedP03History({
     cached = null;
     fallbacks += 1;
   }
+  let laggingRetries = 0;
   for (let laggingTry = 0; cached; laggingTry += 1) {
     try {
       const extended = await extendFromCache({
@@ -56132,11 +56194,14 @@ async function loadOrExtendFinalizedP03History({
         mode: extended.mode,
         fallbacks,
         coverage: extended.coverageMode,
+        laggingRetries,
         ...extended.window ? { window: extended.window } : {}
       };
     } catch (error) {
       onEvent("extension_failed", error);
+      if (isProgramDataIdentityError(error)) throw error;
       if (isLaggingNodeRpcError(error) && laggingTry < EXTENSION_LAGGING_RETRY_MS.length) {
+        laggingRetries += 1;
         await new Promise((resolve38) => setTimeout(resolve38, EXTENSION_LAGGING_RETRY_MS[laggingTry]));
         continue;
       }
@@ -56158,7 +56223,7 @@ async function loadOrExtendFinalizedP03History({
   await beforePersist?.(full);
   await persistCache(cache, full, programIdBase58, poolBase58);
   remember(full);
-  return { report: full.report, mode: "full", fallbacks, coverage: full.coverageMode };
+  return { report: full.report, mode: "full", fallbacks, coverage: full.coverageMode, laggingRetries };
 }
 async function extendFromCache({ connection, programId, pool: pool2, deploymentIdentity, cached: stored, concurrency, lighterWalk, historySource, forceRead = false, liveRead }) {
   const program = new import_web398.PublicKey(programId);
@@ -59768,9 +59833,9 @@ async function runDepositReclaimCommand(args, cli) {
   const to = cli.flag(args, "--to");
   const serviceUrl2 = cli.flag(args, "--service");
   const keyFile = cli.flag(args, "--fee-payer-key-file");
-  const rpcUrl = cli.flag(args, "--rpc") ?? process.env.UNDERMARKET_SOLANA_RPC_URL;
+  const rpcUrl = cli.rpcUrl(args);
   if (!pool2 || !programId || !depositId || !to || !rpcUrl || Boolean(serviceUrl2) === Boolean(keyFile)) {
-    throw new Error("deposit-reclaim requires --pool, --program, --deposit-id, --to, exactly one of --service or --fee-payer-key-file, and --rpc or UNDERMARKET_SOLANA_RPC_URL");
+    throw new Error("deposit-reclaim requires --pool, --program, --deposit-id, --to, exactly one of --service or --fee-payer-key-file, and --rpc-file <file> (or --rpc, or UNDERMARKET_SOLANA_RPC_URL)");
   }
   const store = cli.openStore(pool2);
   if (store.state.pool !== pool2) throw new Error("deposit pool does not match wallet");
@@ -59786,11 +59851,11 @@ async function runDepositReclaimCommand(args, cli) {
 }
 async function runDepositScanCommand(args, cli) {
   const pool2 = cli.flag(args, "--pool");
-  const rpcUrl = cli.flag(args, "--rpc") ?? process.env.UNDERMARKET_SOLANA_RPC_URL;
+  const rpcUrl = cli.rpcUrl(args);
   const fromFlag = cli.flag(args, "--from") ?? "0";
   const countFlag = cli.flag(args, "--count") ?? String(RELAY_KEY_PROBES);
   if (!pool2 || !rpcUrl || !/^(0|[1-9][0-9]{0,9})$/.test(fromFlag) || !/^[1-9][0-9]{0,3}$/.test(countFlag)) {
-    throw new Error(`deposit-scan requires --pool, --rpc or UNDERMARKET_SOLANA_RPC_URL, and optional whole numbers --from (default 0) and --count (1 to ${MAX_SCAN_COUNT}, default ${RELAY_KEY_PROBES})`);
+    throw new Error(`deposit-scan requires --pool, --rpc-file <file> (or --rpc, or UNDERMARKET_SOLANA_RPC_URL), and optional whole numbers --from (default 0) and --count (1 to ${MAX_SCAN_COUNT}, default ${RELAY_KEY_PROBES})`);
   }
   const from = Number(fromFlag);
   const count2 = Number(countFlag);
@@ -59829,9 +59894,9 @@ async function reclaimLandedDepositRent({ store, connection, programId, deps = {
 async function runDepositCompactCommand(args, cli) {
   const pool2 = cli.flag(args, "--pool");
   const programId = cli.flag(args, "--program");
-  const rpcUrl = cli.flag(args, "--rpc") ?? process.env.UNDERMARKET_SOLANA_RPC_URL;
+  const rpcUrl = cli.rpcUrl(args);
   if (!pool2 || !programId || !rpcUrl) {
-    throw new Error("deposit-compact requires --pool, --program, and --rpc or UNDERMARKET_SOLANA_RPC_URL");
+    throw new Error("deposit-compact requires --pool, --program, and --rpc-file <file> (or --rpc, or UNDERMARKET_SOLANA_RPC_URL)");
   }
   const path = cli.walletPath(pool2);
   let release;
@@ -60180,11 +60245,26 @@ var init_recoveryCache = __esm({
 
 // wallet/src/recovery/memoDecryptPool.mjs
 import { availableParallelism } from "node:os";
+import { performance as performance2 } from "node:perf_hooks";
 import { Worker as Worker2 } from "node:worker_threads";
-function sharedXOnMainThread(xs, eta) {
+function sliceClock() {
+  let started = performance2.now();
+  return async () => {
+    if (performance2.now() - started < SLICE_MS) return;
+    await yieldTurn();
+    started = performance2.now();
+  };
+}
+async function sharedXOnMainThread(xs, eta) {
   mainThreadSharedX ??= new Function(`${CURVE_SOURCE}
 return memoSharedX;`)();
-  return xs.map((x) => mainThreadSharedX(x, eta));
+  const turn = sliceClock();
+  const out = [];
+  for (const x of xs) {
+    out.push(mainThreadSharedX(x, eta));
+    await turn();
+  }
+  return out;
 }
 function workerCount() {
   let cores = 1;
@@ -60274,7 +60354,10 @@ async function trialDecryptBundles(jobs, eta) {
   const xs = records.flatMap((list) => list.map((record) => Buffer.from(record.subarray(0, 32)).toString("hex")));
   const shared2 = await memoSharedXs(xs, scalar);
   if (shared2.length !== xs.length) throw new Error("memo decrypt pool answered the wrong count");
-  return jobs.map((job, index) => {
+  const turn = sliceClock();
+  const results = [];
+  for (let index = 0; index < jobs.length; index += 1) {
+    const job = jobs[index];
     const context = {
       poolDomain: BigInt(job.poolDomain),
       outCommitment: BigInt(job.outCommitment),
@@ -60286,15 +60369,17 @@ async function trialDecryptBundles(jobs, eta) {
       if (record.length !== RECORD_BYTES2) return void 0;
       return openRecord(record, slot3, shared2[index * RECORD_COUNT2 + slot3], context);
     });
-    return acceptMemoPlaintexts({
+    results.push(acceptMemoPlaintexts({
       plaintexts,
       outCommitment: job.outCommitment,
       zeroLeaf: job.zeroLeaf,
       subtreeStartIndex: job.subtreeStartIndex
-    });
-  });
+    }));
+    await turn();
+  }
+  return results;
 }
-var CURVE_SOURCE, WORKER_SOURCE, mainThreadSharedX, MAX_WORKERS, pool, nextJob;
+var CURVE_SOURCE, WORKER_SOURCE, SLICE_MS, yieldTurn, mainThreadSharedX, MAX_WORKERS, pool, nextJob;
 var init_memoDecryptPool = __esm({
   "wallet/src/recovery/memoDecryptPool.mjs"() {
     "use strict";
@@ -60424,6 +60509,10 @@ parentPort.on("message", ({ id, eta, xs }) => {
   parentPort.postMessage({ id, out: xs.map((x) => memoSharedX(x, scalar)) });
 });
 `;
+    SLICE_MS = 25;
+    yieldTurn = () => new Promise((resolve38) => {
+      setImmediate(resolve38);
+    });
     MAX_WORKERS = 8;
     nextJob = 0;
   }
@@ -60492,6 +60581,7 @@ var init_successorHistories = __esm({
 // wallet/src/recovery/recover.mjs
 import { createHash as createHash15 } from "node:crypto";
 import { join as join10, resolve as resolve10 } from "node:path";
+import { performance as performance3 } from "node:perf_hooks";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function pinnedGenerator2(profileVector) {
   if (profileVector?.payerKeys?.generator) return profileVector.payerKeys.generator;
@@ -60513,6 +60603,16 @@ function replayValueOf(kind, poolDomain, commitment, eta, leafIndex) {
   REPLAY_VALUES.set(key, value);
   return value;
 }
+function decryptedKey(eta, programId, pool2, digest2, context) {
+  return createHash15("sha256").update(`${String(eta)}|${programId}|${pool2}|${digest2}|${[
+    context.transitionKind,
+    context.poolDomain,
+    context.outCommitment,
+    context.contextCommitment,
+    context.epoch,
+    context.subtreeStartIndex
+  ].map((value) => String(value)).join(":")}`).digest("base64");
+}
 function assertFinalizedRecoveryContext(context, digest2, programId, pool2) {
   const kinds = Object.freeze({ deposit: 1, payment: 2, withdraw: 3, "note-exit": 4, move: 5 });
   const field4 = (value) => typeof value === "bigint" && value >= 0n && value < FIELD_MODULUS6;
@@ -60550,6 +60650,24 @@ function walMemoBundles(store) {
   }
   return bundles;
 }
+async function walMemoBundlesSliced(store) {
+  const bundles = /* @__PURE__ */ new Map();
+  let started = performance3.now();
+  for (const name of store.listWal()) {
+    const record = store.readWal(name);
+    if (record?.memoBundleHex) {
+      const bytes2 = Uint8Array.from(Buffer.from(hexOf2(record.memoBundleHex), "hex"));
+      bundles.set(hexOf2(record.memoDigest ?? bundleDigest2(bytes2)), bytes2);
+    }
+    if (performance3.now() - started >= 25) {
+      await new Promise((resolve38) => {
+        setImmediate(resolve38);
+      });
+      started = performance3.now();
+    }
+  }
+  return bundles;
+}
 function decryptJob(bytes2, context, eta) {
   return {
     bundleBytes: bytes2,
@@ -60568,6 +60686,30 @@ async function decryptAll(decrypt, items, eta) {
   const results = await trialDecryptBundles(items.map(({ bytes: bytes2, context }) => decryptJob(bytes2, context, eta)), eta);
   return results.map((result) => result.accepted);
 }
+async function decryptKept(decrypt, items, eta, chainProgramId, pool2) {
+  if (decrypt !== void 0) return decryptAll(decrypt, items, eta);
+  const program = chainProgramId.toBase58();
+  const poolKey = pool2.toBase58();
+  const keys3 = items.map(({ digest: digest2, context }) => decryptedKey(eta, program, poolKey, digest2, context));
+  const outputs = keys3.map((key) => {
+    const kept = DECRYPTED.get(key);
+    return kept === void 0 ? void 0 : copyOutputs(kept);
+  });
+  const missing = items.filter((_, index) => outputs[index] === void 0);
+  if (missing.length > 0) {
+    const fresh = await decryptAll(void 0, missing, eta);
+    let next = 0;
+    outputs.forEach((value, index) => {
+      if (value !== void 0) return;
+      const result = fresh[next];
+      next += 1;
+      if (DECRYPTED.size >= DECRYPTED_MAX) DECRYPTED.clear();
+      DECRYPTED.set(keys3[index], copyOutputs(result));
+      outputs[index] = result;
+    });
+  }
+  return outputs;
+}
 async function legacyOutputs({ store, digests, serviceUrl: serviceUrl2, fresh, deps, chainProgramId, pool: pool2, eta, decrypt }) {
   const bundles = [];
   const seen = /* @__PURE__ */ new Set();
@@ -60620,7 +60762,7 @@ async function syncedOutputs({ store, finalizedHistory: finalizedHistory2, diges
     }
     if (!fresh) store.listWal();
     let wal;
-    const walFor = () => wal ??= fresh ? /* @__PURE__ */ new Map() : walMemoBundles(store);
+    const walFor = async () => wal ??= fresh ? /* @__PURE__ */ new Map() : await walMemoBundlesSliced(store);
     const reader = deps.memoReader ?? createMemoReader(serviceUrl2, { fetchImpl: deps.fetchImpl ?? fetch, ...deps.pause ? { pause: deps.pause } : {} });
     (deps.notice ?? ((text3) => process.stderr.write(text3)))(
       `reading ${pending.length} memos from the memo service, ${Math.ceil(pending.length / MEMO_BATCH_MAX)} request(s)
@@ -60637,10 +60779,17 @@ async function syncedOutputs({ store, finalizedHistory: finalizedHistory2, diges
         }
       }
       const items = [];
+      let sliceStart = performance3.now();
       for (const context of chunk) {
+        if (performance3.now() - sliceStart >= 25) {
+          await new Promise((resolve38) => {
+            setImmediate(resolve38);
+          });
+          sliceStart = performance3.now();
+        }
         const digest2 = hexOf2(context.memoDigest);
         const fromService = served.get(digest2);
-        const bytes2 = fromService ?? walFor().get(digest2);
+        const bytes2 = fromService ?? (await walFor()).get(digest2);
         if (!bytes2) {
           absent2 += 1;
           continue;
@@ -60648,7 +60797,7 @@ async function syncedOutputs({ store, finalizedHistory: finalizedHistory2, diges
         assertBundle(digest2, bytes2);
         items.push({ context, digest: digest2, bytes: bytes2, fromService });
       }
-      const outputs = await decryptAll(decrypt, items, eta);
+      const outputs = await decryptKept(decrypt, items, eta, chainProgramId, pool2);
       items.forEach(({ context, digest: digest2, fromService }, index) => {
         decrypted += 1;
         found.set(context, outputs[index]);
@@ -60834,7 +60983,7 @@ async function runRecover({ store, connection, programId, digests, serviceUrl: s
     ...Array.isArray(digests) && digests.length > 0 ? { narrowedByDigests: true } : {}
   };
 }
-var import_web3102, FIELD_MODULUS6, MODEL_DIR, seedBytes3, committedGenerator, REPLAY_VALUES, REPLAY_VALUES_MAX, hexOf2;
+var import_web3102, FIELD_MODULUS6, MODEL_DIR, seedBytes3, committedGenerator, REPLAY_VALUES, REPLAY_VALUES_MAX, DECRYPTED, DECRYPTED_MAX, copyOutputs, hexOf2;
 var init_recover = __esm({
   "wallet/src/recovery/recover.mjs"() {
     "use strict";
@@ -60856,6 +61005,13 @@ var init_recover = __esm({
     seedBytes3 = (state) => Uint8Array.from(Buffer.from(state.seedHex, "hex"));
     REPLAY_VALUES = /* @__PURE__ */ new Map();
     REPLAY_VALUES_MAX = 5e4;
+    DECRYPTED = /* @__PURE__ */ new Map();
+    DECRYPTED_MAX = 5e4;
+    copyOutputs = (outputs) => outputs.map((output2) => ({
+      ...output2,
+      ...output2.account ? { account: { ...output2.account } } : {},
+      ...output2.note ? { note: { ...output2.note } } : {}
+    }));
     hexOf2 = (value) => String(value).replace(/^0x/, "").toLowerCase();
   }
 });
@@ -62284,8 +62440,11 @@ var init_errorCodes = __esm({
       "programdata_address_mismatch",
       "programdata_derivation_drift",
       "recovery_program_unexpectedly_deployed",
+      "rpc_file_empty",
       "rpc_file_invalid",
       "rpc_file_unreadable",
+      "rpc_flag_value_missing",
+      "rpc_flags_conflict",
       "settler_is_retired_production_settler",
       "settler_is_staging_settler",
       "settler_is_upgrade_authority",
@@ -70161,13 +70320,13 @@ function readPoolDenominationFlag(args) {
   if (typeof value !== "string" || value === "" || value.startsWith("--")) return "";
   return value;
 }
-function resolveExitDenominationPolicy({ pool: pool2, flagValue, envValue, allowOffDenomination = false }) {
+function resolveExitDenominationPolicy({ pool: pool2, flagValue: flagValue2, envValue, allowOffDenomination = false }) {
   let poolDenominationAtomic;
   let configError;
   const warnings = [];
-  if (flagValue !== void 0) {
-    if (isCanonicalDenominationAtomic(flagValue)) poolDenominationAtomic = flagValue;
-    else if (flagValue === "") configError = "--pool-denomination requires a value";
+  if (flagValue2 !== void 0) {
+    if (isCanonicalDenominationAtomic(flagValue2)) poolDenominationAtomic = flagValue2;
+    else if (flagValue2 === "") configError = "--pool-denomination requires a value";
     else configError = "--pool-denomination must be a canonical positive u64 atomic string";
   } else if (envValue !== void 0 && envValue !== "") {
     let map;
@@ -70805,8 +70964,8 @@ async function runRecoverCommand(args) {
   }
   const pool2 = flag(args, "--pool") ?? requiredPoolFromHome();
   const store = openWalletStore(walletPath(pool2), passphrase());
-  const rpcUrl = flag(args, "--rpc") ?? process.env.UNDERMARKET_SOLANA_RPC_URL;
-  if (!rpcUrl) throw new Error("recover requires --rpc or UNDERMARKET_SOLANA_RPC_URL");
+  const rpcUrl = resolveRpcUrl(args);
+  if (!rpcUrl) throw new Error("rpc_required: recover requires --rpc-file <file> (or --rpc, or UNDERMARKET_SOLANA_RPC_URL)");
   const programId = flag(args, "--program");
   if (!programId) throw new Error("recover requires --program <program id>");
   const digestsFile = flag(args, "--digests");
@@ -70914,7 +71073,7 @@ async function main(argv = process.argv.slice(2)) {
     case "status": {
       const pool2 = flag(args, "--pool") ?? requiredPoolFromHome();
       const store = openWalletStore(walletPath(pool2), passphrase());
-      const rpcUrl = flag(args, "--rpc") ?? process.env.UNDERMARKET_SOLANA_RPC_URL;
+      const rpcUrl = resolveRpcUrl(args);
       const solana = import_web3105.Keypair.fromSecretKey(Uint8Array.from(store.state.solanaSecretKey));
       const report = {
         pool: canonicalPoolKey(store.state.pool),
@@ -70960,11 +71119,11 @@ async function main(argv = process.argv.slice(2)) {
       await runValueMove(command, args);
       return;
     case "deposit-compact":
-      return runDepositCompactCommand(args, { flag, walletPath, acquireLease: acquireWalletProcessLease, openStore: (pool2) => openWalletStore(walletPath(pool2), passphrase()), connect });
+      return runDepositCompactCommand(args, { flag, rpcUrl: (cliArgs) => resolveRpcUrl(cliArgs), walletPath, acquireLease: acquireWalletProcessLease, openStore: (pool2) => openWalletStore(walletPath(pool2), passphrase()), connect });
     case "deposit-reclaim":
-      return runDepositReclaimCommand(args, { flag, openStore: (pool2) => openWalletStore(walletPath(pool2), passphrase()), connect });
+      return runDepositReclaimCommand(args, { flag, rpcUrl: (cliArgs) => resolveRpcUrl(cliArgs), openStore: (pool2) => openWalletStore(walletPath(pool2), passphrase()), connect });
     case "deposit-scan":
-      return runDepositScanCommand(args, { flag, openStore: (pool2) => openWalletStore(walletPath(pool2), passphrase()), connect });
+      return runDepositScanCommand(args, { flag, rpcUrl: (cliArgs) => resolveRpcUrl(cliArgs), openStore: (pool2) => openWalletStore(walletPath(pool2), passphrase()), connect });
     case "withdraw": {
       await runValueMove(command, args);
       return;
@@ -70972,8 +71131,8 @@ async function main(argv = process.argv.slice(2)) {
     case "note-exit": {
       const pool2 = flag(args, "--pool") ?? requiredPoolFromHome();
       const store = openWalletStore(walletPath(pool2), passphrase());
-      const rpcUrl = flag(args, "--rpc") ?? process.env.UNDERMARKET_SOLANA_RPC_URL;
-      if (!rpcUrl) throw new Error("note-exit requires --rpc or UNDERMARKET_SOLANA_RPC_URL");
+      const rpcUrl = resolveRpcUrl(args);
+      if (!rpcUrl) throw new Error("rpc_required: note-exit requires --rpc-file <file> (or --rpc, or UNDERMARKET_SOLANA_RPC_URL)");
       const programId = flag(args, "--program");
       const recipientTokenAccount = flag(args, "--to");
       const serviceUrl2 = flag(args, "--service");
@@ -71094,18 +71253,18 @@ async function main(argv = process.argv.slice(2)) {
         "usage: shielded-wallet <init|restore|address|status|deposit|pay|withdraw|recover|note-exit|backup-export|backup-verify> [options]",
         "  restore --pool <pubkey> --network <caip-2> --asset <mint> --recovery <init's recovery file>",
         "          (a lost wallet from init's recovery text; then recover, deposit-scan, pocket scan)",
-        "  deposit --pool <pubkey> --program <id> --proof-tools <file> --deposit-id <id> --amount <atomic> [--rpc <url>]",
+        "  deposit --pool <pubkey> --program <id> --proof-tools <file> --deposit-id <id> --amount <atomic> [--rpc-file <file>]",
         "          (first run proves and records; back up; then add --submit --service <url>)",
         "          [--relay --service <url> [--one-time-index <n>]]  USDC from a one-time address; the facilitator pays every fee",
-        "  deposit-reclaim --pool <pubkey> --program <id> --deposit-id <id> --to <token account> (--service <url> | --fee-payer-key-file <file>) [--rpc <url>]",
+        "  deposit-reclaim --pool <pubkey> --program <id> --deposit-id <id> --to <token account> (--service <url> | --fee-payer-key-file <file>) [--rpc-file <file>]",
         "          (a relayed deposit that did not land: its USDC back out of the one-time address)",
-        "  deposit-scan --pool <pubkey> [--from <index>] [--count <n>] [--rpc <url>]",
+        "  deposit-scan --pool <pubkey> [--from <index>] [--count <n>] [--rpc-file <file>]",
         "          (after a restore from the recovery text: funded one-time addresses in one index range, default 0-63)",
         "  backup-export --pool <pubkey> --to <new directory>",
         "  backup-verify --pool <pubkey> --backup-dir <directory>",
-        "  recover --pool <pubkey> --program <id> --proof-tools <file> [--rpc <url>] [--fresh] [--history-rpc <own|url>]",
+        "  recover --pool <pubkey> --program <id> --proof-tools <file> [--rpc-file <file>] [--fresh] [--history-rpc <own|url>]",
         "  note-exit --pool <pubkey> --program <id> --to <token account> --service <url> --proof-tools <file> [--exit-amount <atomic>]",
-        "            [--rpc <url>] [--digests <file>] [--note <commitment>]",
+        "            [--rpc-file <file>] [--digests <file>] [--note <commitment>]",
         "            [--min-delay-ms <ms>] [--jitter-ms <ms>] [--exit-now]",
         "            [--pool-denomination <atomic>] [--allow-off-denomination]",
         "            [--recipient-owner <pubkey> --allow-foreign-recipient]  pay a token account another key owns",
@@ -71122,9 +71281,9 @@ async function runSelfCustodyDeposit(args) {
   const programId = flag(args, "--program");
   const depositId = flag(args, "--deposit-id");
   const amount = flag(args, "--amount");
-  const rpcUrl = flag(args, "--rpc") ?? process.env.UNDERMARKET_SOLANA_RPC_URL;
+  const rpcUrl = resolveRpcUrl(args);
   if (!programId || !depositId || !/^[1-9][0-9]*$/.test(amount ?? "") || !rpcUrl) {
-    throw new Error("deposit requires --program, --deposit-id, --amount <atomic>, --proof-tools, and --rpc or UNDERMARKET_SOLANA_RPC_URL");
+    throw new Error("deposit requires --program, --deposit-id, --amount <atomic>, --proof-tools, and --rpc-file <file> (or --rpc, or UNDERMARKET_SOLANA_RPC_URL)");
   }
   const proofTools = loadP03PublicPaymentProofTools(flag(args, "--proof-tools"));
   const path = walletPath(pool2);
@@ -71209,7 +71368,7 @@ async function runValueMove(command, args) {
   const { profile, vector, artifactDir, production } = loadProfileDirectory(profileDir);
   const pool2 = new import_web3105.PublicKey(flag(args, "--pool") ?? profile.pool ?? poolFromProfile(profile));
   const store = openWalletStore(walletPath(pool2.toBase58()), passphrase());
-  const rpcUrl = flag(args, "--rpc") ?? process.env.UNDERMARKET_SOLANA_RPC_URL ?? profile.rpcUrl;
+  const rpcUrl = resolveRpcUrl(args, { fallback: profile.rpcUrl });
   if (!rpcUrl) throw new Error("an RPC URL is required");
   const connection = connect(rpcUrl);
   await assertBroadcastAllowed(connection);
@@ -71502,6 +71661,7 @@ var init_shielded_wallet = __esm({
     init_notes();
     init_memo();
     init_pool_denomination();
+    init_rpc_url();
     init_prove();
     init_chain();
     init_store2();
@@ -72614,6 +72774,7 @@ async function prepareRecoveredPayment({
       circuitSource,
       anchor
     });
+    markPhase("account-path");
   }
   if (wantedNotes.length > MAX_RESPEND_NOTES) fail15("too_many_notes");
   if (wantedNotes.length > 0) await prepareFold(deps.buildRecoveryPath);
@@ -72623,11 +72784,13 @@ async function prepareRecoveredPayment({
     circuitSource,
     anchor
   }));
+  markPhase("note-paths");
   if (reserved !== void 0 && [accountPath, ...notePaths].some((path) => path?.replayValue === void 0 || reserved.has(BigInt(path.replayValue).toString()))) {
     heldInputsWait();
   }
   await prepareFold(deps.buildFrontier);
   const frontier = (deps.buildFrontier ?? buildFinalizedP03Frontier)({ history, circuitSource });
+  markPhase("frontier");
   const outputAccountI = anchor.index;
   const atomicOf = (entries, key) => entries.reduce((sum2, entry) => sum2 + BigInt(entry[key].b), 0n);
   if (accountFile === void 0 && accounts.length > 1 && BigInt(account2.account.b) + atomicOf(wantedNotes, "note") < BigInt(witnessQuote.amountAtomic) && atomicOf(accounts, "account") + atomicOf(notes, "note") >= BigInt(witnessQuote.amountAtomic)) {
@@ -92561,7 +92724,11 @@ async function finalizePendingReceipt({ store, connection, programId, name, time
         strict = true;
         const [tipClock, finalClock] = await Promise.all([finalizedClock(connection, "confirmed"), finalizedClock(connection)]);
         const tip = tipClock.slot;
-        const target = tip > finalClock.slot ? tip + FINALITY_GATE_MARGIN_SLOTS : tip;
+        let target = tip > finalClock.slot ? tip + FINALITY_GATE_MARGIN_SLOTS : tip;
+        const settleSlot = receiptSettleSlot(record.answeredSettleSlot);
+        if (settleSlot !== void 0 && BigInt(settleSlot) >= tip - FINALITY_GATE_SETTLE_WINDOW_SLOTS && BigInt(settleSlot) + FINALITY_GATE_SETTLE_MARGIN_SLOTS < target) {
+          target = BigInt(settleSlot) + FINALITY_GATE_SETTLE_MARGIN_SLOTS;
+        }
         gateClock = finalClock;
         while (gateClock.slot < target && now() < deadline) {
           await sleep5(Math.min(pollMs, FINALITY_GATE_POLL_MS));
@@ -93231,12 +93398,21 @@ async function payResourceOnce({
     if (landed) recordLandedWithoutAnswer(store, walName2, record);
     throw error;
   }
-  store.writeWal(walName2, { ...record, state: "receipt", receipt, resultBase64, receiptFinality: "pending", answeredAtMs: Date.now() });
+  const answeredSettleSlot = receiptSettleSlot(receipt.extra?.settleSlot);
+  store.writeWal(walName2, {
+    ...record,
+    state: "receipt",
+    receipt,
+    resultBase64,
+    receiptFinality: "pending",
+    answeredAtMs: Date.now(),
+    ...answeredSettleSlot !== void 0 ? { answeredSettleSlot } : {}
+  });
   mark("receipt-pending");
   withPhaseScope(mark, "anchor-next", () => requestSubAnchorForNewLeaf());
   return { replayed: false, receipt, resultBase64, receiptFinality: "pending" };
 }
-var import_web3111, fail19, failUnresolved, hash9, OWNER_UNSHIELD_REQUEST, OWNER_UNSHIELD_ORIGIN, POCKET_FILL_ID, POOL_MOVE_PATH, RECEIPT_FINALITY_TIMEOUT_MS, RECEIPT_FINALITY_POLL_MS, FINALITY_GATE_MARGIN_SLOTS, FINALITY_GATE_POLL_MS, FINALITY_GATE_SKIP_AFTER_MS, PENDING_FINALITY, isPending, REPLAY_INPUTS, PAYMENT_OUTPUT_INPUT2, QUOTE_MARGIN_SECONDS, SELLER_REFUSED_PAY_AGAIN, SELLER_REASON_FACILITATOR_UNDERFUNDED, ANCHOR_EPOCH_MS, ANCHOR_MARGIN_MS, ANCHOR_WAIT_CAP_MS, DEAD_PAYMENT_MARGIN_SECONDS, SYSVAR_OWNER, quoteLiveAt, replayValuesOf, finalPayments, FINAL_UNCHANGED;
+var import_web3111, fail19, failUnresolved, hash9, OWNER_UNSHIELD_REQUEST, OWNER_UNSHIELD_ORIGIN, POCKET_FILL_ID, POOL_MOVE_PATH, RECEIPT_FINALITY_TIMEOUT_MS, RECEIPT_FINALITY_POLL_MS, FINALITY_GATE_MARGIN_SLOTS, FINALITY_GATE_POLL_MS, FINALITY_GATE_SETTLE_MARGIN_SLOTS, FINALITY_GATE_SETTLE_WINDOW_SLOTS, receiptSettleSlot, FINALITY_GATE_SKIP_AFTER_MS, PENDING_FINALITY, isPending, REPLAY_INPUTS, PAYMENT_OUTPUT_INPUT2, QUOTE_MARGIN_SECONDS, SELLER_REFUSED_PAY_AGAIN, SELLER_REASON_FACILITATOR_UNDERFUNDED, ANCHOR_EPOCH_MS, ANCHOR_MARGIN_MS, ANCHOR_WAIT_CAP_MS, DEAD_PAYMENT_MARGIN_SECONDS, SYSVAR_OWNER, quoteLiveAt, replayValuesOf, finalPayments, FINAL_UNCHANGED;
 var init_payResource = __esm({
   "wallet/src/pay/payResource.mjs"() {
     "use strict";
@@ -93280,6 +93456,9 @@ var init_payResource = __esm({
     RECEIPT_FINALITY_POLL_MS = 2e3;
     FINALITY_GATE_MARGIN_SLOTS = 10n;
     FINALITY_GATE_POLL_MS = 1e3;
+    FINALITY_GATE_SETTLE_MARGIN_SLOTS = 2n;
+    FINALITY_GATE_SETTLE_WINDOW_SLOTS = 150n;
+    receiptSettleSlot = (value) => typeof value === "string" && /^[1-9][0-9]{0,15}$/.test(value) && Number.isSafeInteger(Number(value)) ? value : void 0;
     FINALITY_GATE_SKIP_AFTER_MS = 6e4;
     PENDING_FINALITY = /* @__PURE__ */ new Set(["pending", "confirmed"]);
     isPending = (record) => record?.state === "receipt" && PENDING_FINALITY.has(record.receiptFinality);
@@ -93324,7 +93503,7 @@ async function main2(args = process.argv.slice(2)) {
   const needed = options["cancel-request"] ? ["wallet", "passphrase-file"] : REQUIRED;
   if (needed.some((key) => !options[key])) throw new Error("p03_resource_cli_arguments_missing");
   const historyUrl = historyRpcUrl(options["history-rpc"]);
-  const rpcUrl = () => resolveRpcUrl({
+  const rpcUrl = () => resolveRpcUrl2({
     rpcFile: options["rpc-file"],
     origin: options["memo-service"],
     readFile: (path) => readFileSync(resolve16(path), "utf8").trim()
@@ -94673,9 +94852,16 @@ var init_EncryptedJsonFile = __esm({
       }
       /** write(), returning the exact text it put in the file. */
       async writeReturningPayload(value) {
+        return this.writeText(this.encryptToText(value));
+      }
+      /**
+       * write()'s file step for text made by encryptToText (this file's key, or
+       * another file's with the same key): the same temp file, fsync, rename and
+       * directory fsync. Returns the text. Lets a caller that keeps two copies of
+       * one value under one key encrypt it once (the P03 settle journal).
+       */
+      async writeText(payload2) {
         await mkdir3(dirname18(this.filePath), { recursive: true });
-        const body = JSON.stringify(value);
-        const payload2 = this.keyMaterial ? JSON.stringify(this.encrypt(body)) : body;
         const temporaryPath = `${this.filePath}.${process.pid}.${randomBytes16(6).toString("hex")}.tmp`;
         await writeFile2(temporaryPath, payload2, { mode: 384 });
         if (this.options.durable) {
@@ -94723,7 +94909,11 @@ var init_EncryptedJsonFile = __esm({
         this.writeTextSync(payload2);
         return payload2;
       }
-      /** The exact text writeSync would put in the file for `value` (a caller can hash it before the write). */
+      /**
+       * The exact text writeSync would put in the file for `value` (a caller can hash it before the write).
+       * Compact on purpose: the payload is encrypted (pretty-printing ciphertext buys nothing and inflates
+       * every full-file rewrite), and the plaintext fallback only exists for local dev without an encryption key.
+       */
       encryptToText(value) {
         return this.keyMaterial ? JSON.stringify(this.encrypt(JSON.stringify(value))) : JSON.stringify(value);
       }
@@ -96434,7 +96624,10 @@ function publicReceipt(receipt) {
       pool: extra.pool,
       programId: extra.programId,
       quoteCommitment: extra.quoteCommitment,
-      memoAvailabilityDigest: extra.memoAvailabilityDigest
+      memoAvailabilityDigest: extra.memoAvailabilityDigest,
+      // The settle's confirmed slot: the payer's next finality gate waits for it (payResource.mjs
+      // FINALITY_GATE_SETTLE_MARGIN_SLOTS, 2026-10-16). A public chain fact of this payment.
+      settleSlot: extra.settleSlot
     }
   };
 }
@@ -97481,7 +97674,7 @@ async function main3(args = process.argv.slice(2)) {
     const feeKey = import_web3121.Keypair.fromSecretKey(Uint8Array.from(store.state.solanaSecretKey)).publicKey;
     const recipientOwner = new import_web3121.PublicKey(options["recipient-owner"]);
     if (recipientOwner.equals(feeKey)) fail28("recipient_owner_is_deposit_key");
-    const connection = connect2(resolveRpcUrl({
+    const connection = connect2(resolveRpcUrl2({
       rpcFile: options["rpc-file"],
       origin: origin.origin,
       readFile: (path) => readFileSync(resolve19(path), "utf8").trim()
@@ -116425,7 +116618,7 @@ async function v0bMain(name, values, deps) {
       const rpc3 = values.has("--rpc-file") ? createV0bRpc(readSecretFile(values.get("--rpc-file"), "--rpc-file")) : void 0;
       return print(await v0bBalance({ store, rpc: rpc3 }));
     }
-    const rpc2 = createV0bRpc(resolveRpcUrl({
+    const rpc2 = createV0bRpc(resolveRpcUrl2({
       rpcFile: values.get("--rpc-file"),
       env: deps.env ?? process.env,
       origin: values.get("--service"),
@@ -118165,7 +118358,7 @@ function playTokenOf(values) {
 }
 function rpcOf(name, values, { origin, env, err }) {
   if (!(READS_CHAIN.has(name) || name === "laneb receipts" && values.has("--verify") || values.has("--rpc-file"))) return void 0;
-  const { url } = resolveRpcUrl({
+  const { url } = resolveRpcUrl2({
     rpcFile: values.get("--rpc-file"),
     env,
     origin,
@@ -121263,7 +121456,7 @@ async function main4(args = process.argv.slice(2), io = { out: (text3) => consol
       io.out(JSON.stringify({ success: true, ...releasePendingFill(store) }));
       return;
     }
-    const connection = connect2(resolveRpcUrl({
+    const connection = connect2(resolveRpcUrl2({
       rpcFile: options["rpc-file"],
       origin: options.facilitator,
       readFile: (path) => readFileSync(resolve20(path), "utf8").trim()
@@ -124150,7 +124343,7 @@ function acknowledgeSuccessionNotice(store, fromPool, state, { now = Date.now()
 }
 var MODEL_VECTORS = fileURLToPath16(new URL("../../vendor/shielded-x402-model/vectors/rust-vectors.json", new URL("__bundled_source__/wallet/src/succession/scheduler.mjs", import.meta.url).href));
 var pinnedGenerator6 = () => JSON.parse(readFileSync(MODEL_VECTORS, "utf8")).payerKeys.generator;
-var yieldTurn = () => new Promise((resolveTurn) => {
+var yieldTurn2 = () => new Promise((resolveTurn) => {
   setImmediate(resolveTurn);
 });
 var CIRCUIT_SOURCE = Object.freeze({ poseidonParametersSha256: P03_PINNED_POSEIDON_PARAMETERS_SHA256, zeroLeaf: P03_PINNED_ZERO_LEAF });
@@ -124174,9 +124367,9 @@ async function prepareSuccessionMove({ entry, verified, store, targetStore, conn
     deploymentIdentity: toolsB.deploymentIdentity
   });
   const recoverSource = async () => {
-    await yieldTurn();
+    await yieldTurn2();
     const history2 = await loadHistory({ store, connection: split5, programId: entry.programId, pool: entry.from, deploymentIdentity: toolsA.deploymentIdentity });
-    await yieldTurn();
+    await yieldTurn2();
     const successors = await loadSuccessorHistories({
       history: history2,
       store,
@@ -124185,7 +124378,7 @@ async function prepareSuccessionMove({ entry, verified, store, targetStore, conn
       deploymentIdentity: toolsB.deploymentIdentity,
       loadHistory
     });
-    await yieldTurn();
+    await yieldTurn2();
     const walStates = captureWalStates(store);
     const recovery2 = await recover({
       store,
@@ -124200,7 +124393,7 @@ async function prepareSuccessionMove({ entry, verified, store, targetStore, conn
     return { recovery: recovery2, history: history2 };
   };
   const { recovery, history } = await recoverSource();
-  await yieldTurn();
+  await yieldTurn2();
   const movable = recovery.recovered.filter((output2) => output2.spendStatus === "succession-movable");
   const eta = deriveWalletViewingAuthority2({ seedBytes: Uint8Array.from(Buffer.from(store.state.seedHex, "hex")), generator: pinnedGenerator6() }).eta;
   const anchor = { index: BigInt(verified.record.finalIndex), root: BigInt(`0x${verified.record.finalRoot}`) };
@@ -125832,6 +126025,8 @@ init_serviceUrl();
 init_anchorClock();
 var shownCaps = (caps) => Object.fromEntries(Object.entries(caps).map(([name, value]) => [name, String(value) === NO_LIMIT_ATOMIC2 ? "none" : value]));
 var RESOURCE_PAYMENT_WAL_PREFIX2 = "resource-payment-";
+var POOL_LAYOUT_CODE = /pool_state_length_or_magic_invalid|pool_layout_table_invalid|pool_state_anchor_layout_invalid/;
+var POOL_LAYOUT_UPDATE = "This wallet release cannot read the pool account: the pool program most likely changed its layout in an upgrade. Tell the user to restart this MCP server in the host (or restart the host app): each start loads the latest shinjuku-shielded";
 var SELF_PAY_ORIGIN3 = "https://self-pay.invalid/";
 var REQUEST_ID2 = /^[A-Za-z0-9._:-]{1,128}$/;
 var POSITIVE_ATOMIC4 = /^[1-9][0-9]{0,30}$/;
@@ -126271,6 +126466,14 @@ function selfPayMayHaveSigned(store, unshieldId) {
   if (record && record.state !== "started") return true;
   return Boolean(store.readWal(`${RESOURCE_PAYMENT_WAL_PREFIX2}${sha256Hex2(Buffer.from(selfPayRequestId(unshieldId), "utf8"))}`));
 }
+function leg1SettleSlot(store, float, requestId) {
+  try {
+    const inner = typeof float?.innerRequestId === "string" && float.innerRequestId ? float.innerRequestId : floatInnerRequestId(requestId);
+    return store?.readWal(`${RESOURCE_PAYMENT_WAL_PREFIX2}${sha256Hex2(Buffer.from(inner, "utf8"))}`)?.answeredSettleSlot;
+  } catch {
+    return void 0;
+  }
+}
 function bindUnshieldRecipient(store, unshieldId, amountAtomic, to) {
   const name = `self-pay-${unshieldId}`;
   const record = store.readWal(name);
@@ -126421,6 +126624,8 @@ var CAP_BALANCE_RETRY_MS = 5e3;
 var REFRESH_RETRY_MS = 6e4;
 var FINALITY_POLL_MS = 2e3;
 var FINALITY_WAIT_MS = 6e4;
+var FINALITY_REFRESH_LIMIT_MS = 18e4;
+var FINALITY_SETTLE_WINDOW_SLOTS = 150;
 var PUBLIC_READ_ANSWER_MS = 3e3;
 var SWITCH_WAIT_MS = 4e4;
 var ELICIT_TIMEOUT_MS = 5 * 6e4;
@@ -126488,7 +126693,7 @@ function createWalletTools({
     deps: ops.autoPockets ?? {}
   });
   if (money.autoPockets === true) autoPockets.start();
-  const mover = createMoveScheduler({ session, underLease, log, onSettled: refreshAtFinality, deps: ops.move && typeof ops.move === "object" ? ops.move : {} });
+  const mover = createMoveScheduler({ session, underLease, log, onSettled: () => refreshAtFinality(), deps: ops.move && typeof ops.move === "object" ? ops.move : {} });
   if (ops.move !== false) mover.start();
   const succession = ops.succession === false ? void 0 : {
     successionStatus,
@@ -126647,31 +126852,52 @@ function createWalletTools({
   let finalityClosed = false;
   const finalityPollMs = ops.finalityPollMs ?? FINALITY_POLL_MS;
   const finalityWaitMs = ops.finalityWaitMs ?? FINALITY_WAIT_MS;
-  function refreshAtFinality(signature) {
-    if (typeof signature !== "string" || !signature || finalityClosed) return;
-    finalityTarget = signature;
+  const finalityRefreshMs = ops.finalityRefreshMs ?? FINALITY_REFRESH_LIMIT_MS;
+  const readSlot = (commitment) => withTimeout(
+    Promise.resolve().then(() => (ops.slot ?? ((c) => session.connection.getSlot(c)))(commitment)),
+    ops.slotReadMs ?? PUBLIC_READ_TIMEOUT_MS
+  );
+  function refreshAtFinality(settleSlot) {
+    if (finalityClosed) return;
+    const given = typeof settleSlot === "number" && Number.isSafeInteger(settleSlot) && settleSlot >= 0 ? settleSlot : typeof settleSlot === "string" && /^(0|[1-9][0-9]{0,15})$/.test(settleSlot) && Number.isSafeInteger(Number(settleSlot)) ? Number(settleSlot) : void 0;
+    const next = readSlot("confirmed").catch(() => void 0).then((tip) => {
+      if (!Number.isSafeInteger(tip)) return given;
+      if (given === void 0 || given > tip || given < tip - FINALITY_SETTLE_WINDOW_SLOTS) return tip;
+      return given;
+    });
+    const prior = finalityTarget;
+    finalityTarget = Promise.all([prior, next]).then(([a, b]) => {
+      const known = [a, b].filter((slot3) => Number.isSafeInteger(slot3));
+      return known.length ? Math.max(...known) : void 0;
+    });
     finalityDeadline = Date.now() + finalityWaitMs;
-    if (finalityWait) return;
-    const statuses = ops.signatureStatuses ?? ((signatures) => session.connection.getSignatureStatuses(signatures));
+    if (!finalityWait) startFinalityWait();
+  }
+  function startFinalityWait() {
+    let watched;
     finalityWait = (async () => {
       for (; ; ) {
-        const watched = finalityTarget;
-        let status;
+        watched = finalityTarget;
+        const target = await watched;
+        if (finalityClosed) return;
+        if (target === void 0) {
+          log("MCP_FINALITY_WAIT_FAILED no settle slot");
+          return;
+        }
+        let finalized;
         try {
-          status = (await statuses([watched]))?.value?.[0] ?? void 0;
+          finalized = await readSlot("finalized");
         } catch {
-          status = void 0;
+          finalized = void 0;
         }
         if (finalityClosed) return;
-        if (watched === finalityTarget && status?.err) {
-          log("MCP_FINALITY_WAIT_FAILED_TRANSACTION");
-          return;
-        }
-        if (watched === finalityTarget && status?.confirmationStatus === "finalized") {
+        if (watched === finalityTarget && Number.isSafeInteger(finalized) && finalized >= target) {
           log("MCP_FINALITY_REFRESH");
-          await refreshShared({ background: true }).catch(() => {
+          await withTimeout(refreshShared({ background: true }), finalityRefreshMs).catch((error) => {
+            if (error?.timedOut) log("MCP_FINALITY_REFRESH_SLOW");
           });
-          return;
+          if (watched === finalityTarget || finalityClosed) return;
+          continue;
         }
         if (Date.now() + finalityPollMs > finalityDeadline) {
           log("MCP_FINALITY_WAIT_EXPIRED");
@@ -126684,6 +126910,8 @@ function createWalletTools({
       }
     })().finally(() => {
       finalityWait = void 0;
+      if (finalityClosed || finalityTarget === watched) finalityTarget = void 0;
+      else startFinalityWait();
     });
   }
   async function refreshIfStale() {
@@ -126969,7 +127197,7 @@ function createWalletTools({
       const floatPaid = float?.state === "receipt";
       const amounts = floatPaid ? { priceAtomic: float.priceAtomic, feeAtomic: float.feeAtomic, amountAtomic: float.paidAtomic } : { priceAtomic: receipt.amountAtomic ?? null, feeAtomic: "0", amountAtomic: receipt.amountAtomic ?? null };
       const one = paidStore ? localBalanceOf(paidStore) : null;
-      if (receipt.replayed !== true) refreshAtFinality(floatPaid ? float.floatSettleTransaction : transaction);
+      if (receipt.replayed !== true) refreshAtFinality(floatPaid ? leg1SettleSlot(paidStore, float, requestId) : receipt.extra?.settleSlot);
       mark("mcp-result");
       return answerResult(paidAnswerContent({
         status: response.status,
@@ -127034,6 +127262,8 @@ function createWalletTools({
       next = `PAID: the chain shows the payment landed${error?.transaction ? ` (transaction ${error.transaction})` : ""}, but the seller did not return its answer and refuses the same payment. Do not call x402_pay again with this request_id. Tell the user it was paid without an answer; pay again only with a NEW request_id if the user wants a second payment`;
     } else if (code === "wallet_locked") {
       next = `another shinjuku-wallet command is using this wallet; wait for it, then call x402_pay again with request_id "${requestId}"`;
+    } else if (POOL_LAYOUT_CODE.test(code)) {
+      next = `${POOL_LAYOUT_UPDATE}. Then call x402_pay again with request_id "${requestId}" and the same url, method, headers, and body: it pays once. If the latest release says the same, tell your owner: ${code}`;
     } else if (OWNER_CAP_CODES.has(code)) {
       next = ownerOnlyNext(`${code}: ${rest || "a wallet-file cap refused this payment"}`.replace(/[.;\s]+$/, ""), code);
     } else if (code === "fetch_offer_confidential" || /confidential_(retired|use_laneb_pay_url)$/.test(code)) {
@@ -127557,6 +127787,7 @@ function createWalletTools({
     else if (/insufficient_token_balance|above_balance/.test(code)) next = "Nothing was moved. The wallet's own key holds less public USDC than amount_atomic (wallet_balance unshieldedAtomic). Tell the user, or call wallet_shield with a NEW request_id and a smaller amount_atomic";
     else if (/insufficient_sol/.test(code)) next = `Nothing new was moved. This request_id is a deposit an older version started that pays its own network fee, and the wallet's own key${ownAddress ? ` ${ownAddress}` : " (init's solanaFeePayer)"} holds too little SOL for it. Tell your owner: ${code}. A NEW request_id needs no SOL: the facilitator pays its fees`;
     else if (/pool_at_deposit_cap|pool_value_cap|above_pool_deposit_cap|above_cap|pool_terminal|id_reused/.test(code)) next = `Nothing new was moved. Do not retry this request. Tell your owner: ${code}.${atAddress}`;
+    else if (POOL_LAYOUT_CODE.test(code)) next = `${POOL_LAYOUT_UPDATE}. Then ${again(kind, job)}: it continues where it stopped and never moves the money twice. If the latest release says the same, tell your owner: ${code}`;
     else if (code === "mcp_unshield_to_not_allowed") next = unboundNext(job.requestId, job.amountAtomic);
     else if (code === "mcp_unshield_to_invalid") next = "Nothing was paid. Tell the user: this address has no USDC token account of the pool mint; it must have one first";
     else if (code === "wallet_locked") next = `another shinjuku-wallet command is using this wallet; ${again(kind, job)} in ${POLL_SECONDS2} s: it continues where it stopped and never moves the money twice`;
@@ -127853,7 +128084,7 @@ function createWalletTools({
       job.result = result;
       log(`MCP_${kind.toUpperCase()}_DONE requestId=${job.requestId}`);
       if (kind !== "unshield") afterShield(job);
-      else refreshAtFinality(result?.exitTransaction ?? result?.selfPayTransaction);
+      else refreshAtFinality();
     }, (error) => {
       job.failedStage = job.stage;
       job.state = "failed";
@@ -128132,7 +128363,7 @@ function createWalletTools({
           session,
           underLease,
           log,
-          deps: { onSettled: refreshAtFinality }
+          deps: { onSettled: () => refreshAtFinality() }
         });
       } catch (error) {
         log(`MCP_POOL_SWITCH_SCHEDULER_NOT_STARTED: ${error?.name ?? "Error"}`);
@@ -129467,7 +129698,7 @@ async function main5(args = process.argv.slice(2)) {
     let steps;
     const runOne = async ({ id, amountAtomic, accountCommitment: accountCommitment3 }) => {
       if (!steps) {
-        const connection = connect2(resolveRpcUrl({
+        const connection = connect2(resolveRpcUrl2({
           rpcFile: options["rpc-file"],
           origin: origin.origin,
           readFile: (path) => readFileSync(resolve27(path), "utf8").trim()
@@ -130090,7 +130321,7 @@ async function main6(args = process.argv.slice(2)) {
   try {
     const store = openWalletStore(walletPath2, passphrase2);
     timing("store-open");
-    const connection = connect2(resolveRpcUrl({
+    const connection = connect2(resolveRpcUrl2({
       rpcFile: options["rpc-file"],
       origin: options["memo-service"],
       readFile: (path) => readFileSync(resolve28(path), "utf8").trim()
@@ -130168,7 +130399,7 @@ async function keepWarmOnce(values, { io, env = process.env }) {
   const walletPath2 = resolve29(values.get("--wallet"));
   const passphrase2 = assertPassphrase(values.has("--passphrase-file") ? readFileSync(resolve29(values.get("--passphrase-file")), "utf8").trim() : String(env.SHIELDED_WALLET_PASSPHRASE ?? ""));
   const store = openWalletStore(walletPath2, passphrase2);
-  const connection = connect2(resolveRpcUrl({
+  const connection = connect2(resolveRpcUrl2({
     rpcFile: values.get("--rpc-file"),
     origin: values.get("--memo-service"),
     readFile: (path) => readFileSync(resolve29(path), "utf8").trim()
@@ -133261,7 +133492,7 @@ async function addFunds(values, deps) {
   const { io } = deps;
   const run5 = runValues(values, deps);
   const passphrase2 = readPrivateLine(run5.passphraseFile, "--passphrase-file");
-  const rpcUrl = run5.rpcFile !== void 0 ? readPrivateLine(run5.rpcFile, "--rpc-file") : resolveRpcUrl({ env: deps.env, origin: run5.service, notice: (text3) => io.err(text3) }).url;
+  const rpcUrl = run5.rpcFile !== void 0 ? readPrivateLine(run5.rpcFile, "--rpc-file") : resolveRpcUrl2({ env: deps.env, origin: run5.service, notice: (text3) => io.err(text3) }).url;
   if (values.get("--route") === "privacy-cash") {
     try {
       run5.source = readSourceKeyFile(run5.fromKeyFile).publicKey.toBase58();
@@ -133672,7 +133903,7 @@ var sessionLease = (session) => (task) => {
   };
   return typeof session.serial === "function" ? session.serial(run5) : run5();
 };
-var spendRpcUrl = (values, deps) => deps.rpcUrlFromFile ?? values.get("--rpc") ?? deps.env[RPC_ENV3] ?? resolveRpcUrl({
+var spendRpcUrl = (values, deps) => deps.rpcUrlFromFile ?? values.get("--rpc") ?? deps.env[RPC_ENV3] ?? resolveRpcUrl2({
   env: {},
   origin: facilitatorOriginOf(values.get("--service"), values.get("--facilitator"), values.get("--memo-service")),
   notice: () => {
@@ -135386,7 +135617,7 @@ async function runMoveCommand(values, deps, io) {
 `);
     return;
   }
-  const rpcUrl = values.has("--rpc-file") ? deps.readRpcFile(values.get("--rpc-file")) : deps.env[RPC_ENV3] || resolveRpcUrl({ env: {}, origin: facilitator, notice: io.err }).url;
+  const rpcUrl = values.has("--rpc-file") ? deps.readRpcFile(values.get("--rpc-file")) : deps.env[RPC_ENV3] || resolveRpcUrl2({ env: {}, origin: facilitator, notice: io.err }).url;
   const lease = (walletFile) => async (task) => {
     let release;
     try {
@@ -135740,7 +135971,7 @@ function rpcFileArgs(command, args, values, deps, io) {
     const index = args.indexOf("--rpc-file");
     return { args: [...args.slice(0, index), "--rpc", url2, ...args.slice(index + 2)], url: url2 };
   }
-  const { url } = resolveRpcUrl({ env: {}, origin: facilitatorOriginOf(values.get("--service"), values.get("--facilitator"), values.get("--memo-service")), notice: io.err });
+  const { url } = resolveRpcUrl2({ env: {}, origin: facilitatorOriginOf(values.get("--service"), values.get("--facilitator"), values.get("--memo-service")), notice: io.err });
   return { args: [...args, "--rpc", url], url };
 }
 function runSellerIdentity(values, deps, io) {
@@ -136110,7 +136341,7 @@ async function adoptOneTimeForBalance({ store, values, deps, io }) {
     const pools = [...config ? knownPools(config) : [], ...Object.keys(RETIRED_POOLS)];
     const wallets = openEarlierWallets({ home, store, passphrase: deps.env[PASSPHRASE_ENV2], pools });
     if (!wallets.some((wallet) => wallet.state === "open")) return [];
-    const rpcUrl = values.get("--rpc") ?? deps.rpcUrlFromFile ?? deps.env[RPC_ENV3] ?? resolveRpcUrl({ env: {}, origin: new URL(values.get("--service")).origin, notice: io.err }).url;
+    const rpcUrl = values.get("--rpc") ?? deps.rpcUrlFromFile ?? deps.env[RPC_ENV3] ?? resolveRpcUrl2({ env: {}, origin: new URL(values.get("--service")).origin, notice: io.err }).url;
     return await adoptOneTimeDeposits({ wallets, run: {
       store,
       connection: (deps.connectRpc ?? connect2)(rpcUrl, "finalized"),
@@ -136811,7 +137042,7 @@ async function runShinjukuWallet(argv, overrides = {}) {
       applyStoredChannel({ home: setupHome(runDeps.env) });
     } catch {
     }
-    const familyRpcUrl = () => rpc2.url ?? values.get("--rpc") ?? runDeps.env[RPC_ENV3] ?? resolveRpcUrl({
+    const familyRpcUrl = () => rpc2.url ?? values.get("--rpc") ?? runDeps.env[RPC_ENV3] ?? resolveRpcUrl2({
       env: {},
       origin: facilitatorOriginOf(values.get("--service"), values.get("--facilitator"), values.get("--memo-service")),
       notice: io.err