shinjuku-shielded 0.3.48 → 0.3.49

package/manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "carbon-shielded-wallet/bundle-manifest/v1",
   "file": "shinjuku-wallet.mjs",
-  "sha256": "8d1268b754e192e52be5ba3d5cf134ed42eee552605d96c11076a6004204c737",
-  "bytes": 11402568,
-  "sourceCommit": "fd135a3c82678e9fa22dc8cd609cf6f818b5dd65",
+  "sha256": "4baf3bca327b51694452760cdb6a4f65d8e869a4c64040c832e92937f66ab395",
+  "bytes": 11416627,
+  "sourceCommit": "8b2cedd6f47d75d41eb39da9fc85caeed06be5c3",
   "sourceDirty": false,
   "installRecordMatchesLockfile": true,
   "releaseRule": "valid only when two fresh npm ci --ignore-scripts builds on different OSes give the same sha256; installRecordMatchesLockfile true means every entry npm installed equals its package-lock.json entry and every entry not marked optional, devOptional included, is installed: an optional entry (a package for another platform) may be absent",

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "shinjuku-shielded",
-  "version": "0.3.48",
+  "version": "0.3.49",
   "mcpName": "io.github.ShinjukuStaition/shinjuku-mcp",
   "description": "Shinjuku Shielded, the private x402 facilitator on Solana: the self-custody wallet CLI and its MCP server. Shield, pay, and unshield USDC from any MCP agent, under caps you set.",
-  "shinjukuRelease": "8d1268b7",
-  "shinjukuSha256": "8d1268b754e192e52be5ba3d5cf134ed42eee552605d96c11076a6004204c737",
+  "shinjukuRelease": "4baf3bca",
+  "shinjukuSha256": "4baf3bca327b51694452760cdb6a4f65d8e869a4c64040c832e92937f66ab395",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "Shinjuku Shielded",
   "homepage": "https://github.com/ShinjukuStaition/shinjuku-mcp#readme",

package/shinjuku-wallet.mjs

@@ -50460,7 +50460,7 @@ function connectSplit(own, historyUrl, commitment = "finalized", { pause: pause3
   const historyRpcWarm = () => {
     if (warmedSources.has(historyUrl)) return;
     warmedSources.add(historyUrl);
-    rpcFetch(historyUrl, { method: "GET" }).then((response) => response.body?.cancel()).catch(() => {
+    rpcFetch(historyUrl, keepAliveInit({ method: "GET" })).then((response) => response.arrayBuffer()).catch(() => {
     });
   };
   const historyRpcIntegrity = Object.freeze({
@@ -52739,7 +52739,7 @@ var init_quote2 = __esm({
       return bytes2;
     };
     TICKER_MINTS = Object.freeze({ USDC: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v" });
-    SELF_BROADCAST_MIN_LEFT_MS = 6e4;
+    SELF_BROADCAST_MIN_LEFT_MS = 16e4;
     QUOTE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
   }
 });
@@ -53087,7 +53087,11 @@ async function refreshFinalizedP03HistorySnapshot({
   keepPoolState(refreshed, snapshot);
   return refreshed;
 }
-async function readFinalizedPool(connection, program, pool2) {
+async function readFinalizedPool(connection, program, pool2, { treeSlices = false } = {}) {
+  if (treeSlices) {
+    const sliced = await readFinalizedPoolSliced(connection, program, pool2);
+    if (sliced !== void 0) return sliced;
+  }
   if (typeof connection.getMultipleAccountsInfoAndContext !== "function") {
     const response = await retryTransientRpc(() => connection.getAccountInfoAndContext(pool2, "finalized"));
     const only = parseFinalizedPool(response, program, pool2);
@@ -53118,6 +53122,107 @@ function withPoolStateOf(snapshot, wrapped) {
   if (entry !== void 0) SNAPSHOT_POOL_STATES.set(wrapped, entry);
   return wrapped;
 }
+function parseE1TreeHeader(header) {
+  const invalid4 = (detail) => {
+    throw new Error(`E1TreeAccountInvalid: ${detail}`);
+  };
+  if (!(header instanceof Uint8Array) || header.length !== E1_TREE_HEADER_BYTES) invalid4("length");
+  const bytes2 = Buffer.from(header.buffer, header.byteOffset, header.byteLength);
+  if (bytes2.subarray(0, 8).toString("latin1") !== E1_TREE_MAGIC) invalid4("magic");
+  if (bytes2[40] !== 1 || bytes2[41] !== E1.depth || bytes2.readUInt16LE(42) !== E1.bufferSize || bytes2[44] !== E1.canopyDepth) invalid4("header");
+  if (bytes2[45] !== 0 || bytes2[46] !== 0 || bytes2[47] !== 0) invalid4("reserved");
+  const u642 = (offset) => {
+    const value = bytes2.readBigUInt64LE(offset);
+    if (value > BigInt(Number.MAX_SAFE_INTEGER)) invalid4("u64");
+    return Number(value);
+  };
+  const activeIndex = u642(64);
+  if (activeIndex >= E1.bufferSize) invalid4("activeIndex");
+  return {
+    pool: new import_web396.PublicKey(bytes2.subarray(8, 40)).toBase58(),
+    creationSlot: u642(48),
+    sequenceNumber: u642(56),
+    activeIndex,
+    bufferSize: u642(72)
+  };
+}
+function slicesRefused(connection) {
+  const endpoint2 = connection.rpcEndpoint;
+  return typeof endpoint2 === "string" ? SLICES_REFUSED_ENDPOINTS.has(endpoint2) : SLICES_REFUSED_CONNECTIONS.has(connection);
+}
+function rememberSlicesRefused(connection) {
+  const endpoint2 = connection.rpcEndpoint;
+  if (typeof endpoint2 === "string") SLICES_REFUSED_ENDPOINTS.add(endpoint2);
+  else SLICES_REFUSED_CONNECTIONS.add(connection);
+}
+function slicesMethodMissing(error) {
+  const message = String(error?.message ?? "");
+  return /^(404|405|501)\b/.test(message) || /-3260[12]\b/.test(message);
+}
+function slicedAccountBytes(value, accountIndex) {
+  if (value === null || typeof value !== "object" || typeof value.owner !== "string" || !Number.isSafeInteger(value.space) || value.space < 0 || !Array.isArray(value.data) || value.data.length !== 2 || value.data[1] !== "base64" || typeof value.data[0] !== "string") {
+    return void 0;
+  }
+  const bytes2 = Buffer.from(value.data[0], "base64");
+  if (bytes2.toString("base64") !== value.data[0]) return void 0;
+  let expected = 0;
+  for (const [index, offset, length] of POOL_SLICES) {
+    if (index === accountIndex) expected += Math.max(0, Math.min(offset + length, value.space) - offset);
+  }
+  return bytes2.length === expected ? bytes2 : void 0;
+}
+function slicedSnapshot(result, program, pool2, tree) {
+  if (result === null || typeof result !== "object" || !Array.isArray(result.value) || result.value.length !== 2) return void 0;
+  const [poolValue, treeValue] = result.value;
+  const poolBytes2 = slicedAccountBytes(poolValue, 0);
+  if (poolBytes2 === void 0 || poolValue.space > REFRESH_READ_BYTES) return void 0;
+  const snapshot = parseFinalizedPool({ context: result.context, value: { owner: poolValue.owner, data: poolBytes2 } }, program, pool2);
+  if (snapshot.replayStore !== REPLAY_STORE_INDEXED) return snapshot;
+  const treeBytes = slicedAccountBytes(treeValue, 1);
+  if (treeBytes === void 0 || treeValue.space !== E1.treeBytes) return void 0;
+  const ownerProgramId = canonicalKey(treeValue.owner, "e1_tree_owner").toBase58();
+  if (ownerProgramId !== b58(program)) return void 0;
+  const header = Buffer.from(treeBytes.subarray(0, E1_TREE_HEADER_BYTES));
+  const { activeIndex } = parseE1TreeHeader(header);
+  const rootAt = SLICED_ROOTS_OFFSET + 32 * activeIndex;
+  return withPoolStateOf(snapshot, Object.freeze({
+    ...snapshot,
+    e1TreeSlices: Object.freeze({
+      slot: snapshot.slot,
+      address: tree.toBase58(),
+      ownerProgramId,
+      space: treeValue.space,
+      header,
+      root: Buffer.from(treeBytes.subarray(rootAt, rootAt + 32)),
+      leaves: treeBytes.readUInt32LE(SLICED_LEAVES_OFFSET)
+    })
+  }));
+}
+async function readFinalizedPoolSliced(connection, program, pool2) {
+  if (typeof connection._rpcRequest !== "function" || slicesRefused(connection)) return void 0;
+  const tree = new import_web396.PublicKey(e1TreeAddress2(b58(pool2), b58(program)));
+  let response;
+  try {
+    response = await connection._rpcRequest(P03_POOL_SLICES_METHOD, [[b58(pool2), tree.toBase58()], { commitment: "finalized", slices: POOL_SLICES }]);
+  } catch (error) {
+    if (slicesMethodMissing(error)) rememberSlicesRefused(connection);
+    markPhase(`pool-sliced-fallback-${reuseRefusalCause(error)}`);
+    return void 0;
+  }
+  if (response?.error !== void 0) {
+    if (response.error?.code === -32601 || response.error?.code === -32602) rememberSlicesRefused(connection);
+    markPhase("pool-sliced-fallback-refused");
+    return void 0;
+  }
+  let snapshot;
+  try {
+    snapshot = slicedSnapshot(response?.result, program, pool2, tree);
+  } catch {
+    snapshot = void 0;
+  }
+  markPhase(snapshot === void 0 ? "pool-sliced-fallback-answer" : "pool-sliced");
+  return snapshot;
+}
 async function readFinalizedPoolForRefresh(connection, program, pool2) {
   if (typeof connection.getMultipleAccountsInfoAndContext !== "function") return readFinalizedPool(connection, program, pool2);
   const tree = new import_web396.PublicKey(e1TreeAddress2(b58(pool2), b58(program)));
@@ -53861,29 +53966,44 @@ function assertP03E1TreeComplete({ program, pool: pool2, poolSnapshot, settles,
   const mismatch = (detail) => {
     throw new Error(`p03_history_e1_tree_mismatch:${detail}`);
   };
-  const tree = poolSnapshot.e1TreeAccount;
+  const sliced = poolSnapshot.e1TreeSlices;
+  const tree = sliced ?? poolSnapshot.e1TreeAccount;
   if (!tree || tree.slot !== poolSnapshot.slot) mismatch("tree_snapshot_missing");
   if (tree.address !== e1TreeAddress2(b58(pool2), b58(program))) mismatch("tree_address");
-  const empty = tree.data === null || tree.ownerProgramId === null || tree.ownerProgramId === SYSTEM_PROGRAM && tree.data.every((byte) => byte === 0);
+  const empty = sliced === void 0 && (tree.data === null || tree.ownerProgramId === null || tree.ownerProgramId === SYSTEM_PROGRAM && tree.data.every((byte) => byte === 0));
   if (closed) {
     if (!empty) mismatch("closed_pool_has_tree");
     return Object.freeze({ state: "closed", address: tree.address, slot: BigInt(poolSnapshot.slot) });
   }
   if (empty) mismatch("tree_empty_without_close");
-  if (tree.ownerProgramId !== b58(program) || tree.data.length !== E1.treeBytes) mismatch("tree_owner_or_length");
+  const space = sliced !== void 0 ? sliced.space : tree.data.length;
+  if (tree.ownerProgramId !== b58(program) || space !== E1.treeBytes) mismatch("tree_owner_or_length");
   let header;
+  let treeRoot;
+  let treeLeaves;
   try {
-    header = readE1TreeAccount(tree.data);
+    if (sliced !== void 0) {
+      header = parseE1TreeHeader(sliced.header);
+      if (!(sliced.root instanceof Uint8Array) || sliced.root.length !== 32 || !Number.isSafeInteger(sliced.leaves)) throw new Error("E1TreeAccountInvalid: slices");
+      treeRoot = sliced.root;
+      treeLeaves = sliced.leaves;
+    } else {
+      const data = Buffer.from(tree.data.buffer, tree.data.byteOffset, tree.data.byteLength);
+      header = parseE1TreeHeader(data.subarray(0, E1_TREE_HEADER_BYTES));
+      const rootAt = E1_CHANGELOGS_OFFSET + E1_CHANGELOG_BYTES * header.activeIndex;
+      treeRoot = data.subarray(rootAt, rootAt + 32);
+      treeLeaves = data.readUInt32LE(E1_LEAF_COUNT_OFFSET);
+    }
   } catch (error) {
     mismatch(`tree_header:${error?.message ?? "invalid"}`);
   }
   if (header.pool !== b58(pool2)) mismatch("tree_pool");
   const mirror = E1TreeMirror.fromOrderedValues(settles.flatMap((values) => e1SortValues(values)));
   const leaves = mirror.leaves();
-  if (header.leaves !== leaves) mismatch(`leaves:${header.leaves}/${leaves}`);
+  if (treeLeaves !== leaves) mismatch(`leaves:${treeLeaves}/${leaves}`);
   if (Number(header.sequenceNumber) !== 2 * leaves - 1) mismatch(`sequence:${header.sequenceNumber}/${2 * leaves - 1}`);
   const root = Buffer.from(mirror.root()).toString("hex");
-  if (Buffer.from(header.root).toString("hex") !== root) mismatch("root");
+  if (Buffer.from(treeRoot).toString("hex") !== root) mismatch("root");
   return Object.freeze({ state: "open", address: tree.address, slot: BigInt(poolSnapshot.slot), root, leaves });
 }
 function sameE1TreeHeader(snapshot, verified, program, pool2) {
@@ -54683,7 +54803,7 @@ function base58Decode(value) {
   while (zeros < value.length && value[zeros] === "1") zeros += 1;
   return Uint8Array.from(Buffer.concat([Buffer.alloc(zeros), body]));
 }
-var import_web396, b58Cache, b58, REPLAY_STORE_INDEXED, CLOSE_REPLAY_TREE_TAG, EXTEND_ANCHOR_RING_TAG, WIDEN_ANCHOR_RING_TAG, WIDE_ANCHOR_RING_POOL_BYTES, LINK_SUCCESSOR_TAG, IMPORT_REPLAY_LEAVES_TAG, SETTLE_MOVE_TAG, SWEEP_PREDECESSOR_VAULT_TAG, RELINK_SUCCESSOR_TAG, ROTATE_PAYMENT_SETTLER_TAG, IMPORT_A_LEAF_BYTES, IMPORT_MEMBERSHIP_BYTES, IMPORT_PRESENT_SHIFT, IMPORT_MAX_ENTRIES, MOVE_HEAD_BYTES, MOVE_INSERTED_VALUES, DEFAULT_KEY, FIELD_BYTES2, PRIMARY_PROOF_BYTES, SUBTREE_LEAVES, PAGE_SIZE, FIELD_MODULUS3, BPF_LOADER_UPGRADEABLE_PROGRAM_ID, SYSTEM_PROGRAM, TEST_EXECUTABLES, derivationMemo, memo, reviewedExecutables, isProgramDataIdentityError, ASSUMED_ORIGINAL_EXECUTABLE, AUTHENTICATED_HISTORY_REPORTS, HISTORY_ATTESTATIONS, SNAPSHOT_POOL_STATES, REPORT_POOL_STATES, hasExecutableEvidence, P03_FINALIZED_HISTORY_SOURCE_MODEL, P03_PROGRAMDATA_COVERAGE_SOURCE_MODEL, P03_RUN_RECOVER_UNAVAILABLE_FROM_CHAIN, PROFILES, P03_SETTLEMENT_TAGS, P03_INLINE_SETTLEMENT_TAGS, P03_PAYMENT_REPLAY_INDICES, NO_CONTEXTS, REFRESH_READ_BYTES, E1_TREE_HEADER_BYTES, HISTORY_FETCH_CONCURRENCY, HISTORY_BULK_TRANSACTIONS, HISTORY_BULK_ADDRESSES, TRANSIENT_RPC_ATTEMPTS, TRANSIENT_RPC_BASE_DELAY_MS, LAGGING_NODE_STEP_OF_BASE, LAGGING_NODE_MAX_RETRIES, LAGGING_NODE_FAST_RETRIES, LAGGING_NODE_SLOW_STEP_OF_BASE, LAGGING_NODE_RPC_CODES;
+var import_web396, b58Cache, b58, REPLAY_STORE_INDEXED, CLOSE_REPLAY_TREE_TAG, EXTEND_ANCHOR_RING_TAG, WIDEN_ANCHOR_RING_TAG, WIDE_ANCHOR_RING_POOL_BYTES, LINK_SUCCESSOR_TAG, IMPORT_REPLAY_LEAVES_TAG, SETTLE_MOVE_TAG, SWEEP_PREDECESSOR_VAULT_TAG, RELINK_SUCCESSOR_TAG, ROTATE_PAYMENT_SETTLER_TAG, IMPORT_A_LEAF_BYTES, IMPORT_MEMBERSHIP_BYTES, IMPORT_PRESENT_SHIFT, IMPORT_MAX_ENTRIES, MOVE_HEAD_BYTES, MOVE_INSERTED_VALUES, DEFAULT_KEY, FIELD_BYTES2, PRIMARY_PROOF_BYTES, SUBTREE_LEAVES, PAGE_SIZE, FIELD_MODULUS3, BPF_LOADER_UPGRADEABLE_PROGRAM_ID, SYSTEM_PROGRAM, TEST_EXECUTABLES, derivationMemo, memo, reviewedExecutables, isProgramDataIdentityError, ASSUMED_ORIGINAL_EXECUTABLE, AUTHENTICATED_HISTORY_REPORTS, HISTORY_ATTESTATIONS, SNAPSHOT_POOL_STATES, REPORT_POOL_STATES, hasExecutableEvidence, P03_FINALIZED_HISTORY_SOURCE_MODEL, P03_PROGRAMDATA_COVERAGE_SOURCE_MODEL, P03_RUN_RECOVER_UNAVAILABLE_FROM_CHAIN, PROFILES, P03_SETTLEMENT_TAGS, P03_INLINE_SETTLEMENT_TAGS, P03_PAYMENT_REPLAY_INDICES, NO_CONTEXTS, REFRESH_READ_BYTES, E1_TREE_HEADER_BYTES, E1_TREE_MAGIC, E1_CHANGELOG_BYTES, E1_CHANGELOGS_OFFSET, E1_RIGHTMOST_OFFSET, E1_LEAF_COUNT_OFFSET, E1_CANOPY_OFFSET, E1_CANOPY_NODES, P03_POOL_SLICES_METHOD, POOL_SLICES, SLICED_ROOTS_OFFSET, SLICED_LEAVES_OFFSET, SLICES_REFUSED_ENDPOINTS, SLICES_REFUSED_CONNECTIONS, HISTORY_FETCH_CONCURRENCY, HISTORY_BULK_TRANSACTIONS, HISTORY_BULK_ADDRESSES, TRANSIENT_RPC_ATTEMPTS, TRANSIENT_RPC_BASE_DELAY_MS, LAGGING_NODE_STEP_OF_BASE, LAGGING_NODE_MAX_RETRIES, LAGGING_NODE_FAST_RETRIES, LAGGING_NODE_SLOW_STEP_OF_BASE, LAGGING_NODE_RPC_CODES;
 var init_walk = __esm({
   "wallet/src/history/walk.mjs"() {
     "use strict";
@@ -54943,6 +55063,25 @@ var init_walk = __esm({
     NO_CONTEXTS = Object.freeze([]);
     REFRESH_READ_BYTES = 4096;
     E1_TREE_HEADER_BYTES = 80;
+    E1_TREE_MAGIC = "SX402T01";
+    E1_CHANGELOG_BYTES = 32 + 32 * E1.depth + 8;
+    E1_CHANGELOGS_OFFSET = E1_TREE_HEADER_BYTES;
+    E1_RIGHTMOST_OFFSET = E1_CHANGELOGS_OFFSET + E1.bufferSize * E1_CHANGELOG_BYTES;
+    E1_LEAF_COUNT_OFFSET = E1_RIGHTMOST_OFFSET + 32 * E1.depth + 32;
+    E1_CANOPY_OFFSET = E1_RIGHTMOST_OFFSET + E1_CHANGELOG_BYTES;
+    E1_CANOPY_NODES = 2 ** (E1.canopyDepth + 1) - 2;
+    if (E1_CANOPY_OFFSET + 32 * E1_CANOPY_NODES !== E1.treeBytes) throw new Error("p03_history_e1_tree_mismatch:layout");
+    P03_POOL_SLICES_METHOD = "getMultipleAccountsSlices";
+    POOL_SLICES = Object.freeze([
+      Object.freeze([0, 0, REFRESH_READ_BYTES]),
+      Object.freeze([1, 0, E1_TREE_HEADER_BYTES]),
+      ...Array.from({ length: E1.bufferSize }, (_, index) => Object.freeze([1, E1_CHANGELOGS_OFFSET + E1_CHANGELOG_BYTES * index, 32])),
+      Object.freeze([1, E1_LEAF_COUNT_OFFSET, 4])
+    ]);
+    SLICED_ROOTS_OFFSET = E1_TREE_HEADER_BYTES;
+    SLICED_LEAVES_OFFSET = SLICED_ROOTS_OFFSET + 32 * E1.bufferSize;
+    SLICES_REFUSED_ENDPOINTS = /* @__PURE__ */ new Set();
+    SLICES_REFUSED_CONNECTIONS = /* @__PURE__ */ new WeakSet();
     HISTORY_FETCH_CONCURRENCY = 4;
     HISTORY_BULK_TRANSACTIONS = 256;
     HISTORY_BULK_ADDRESSES = 256;
@@ -55805,6 +55944,9 @@ function withBoundedOwnReads(connection) {
       const value = Reflect.get(target, property);
       if (typeof value !== "function") return value;
       if (BOUNDED_OWN_METHODS.has(property)) return (...args) => boundedOwnRead(() => value.apply(target, args));
+      if (property === "_rpcRequest") {
+        return (...args) => args[0] === P03_POOL_SLICES_METHOD ? boundedOwnRead(() => value.apply(target, args)) : value.apply(target, args);
+      }
       return value.bind(target);
     }
   });
@@ -55855,7 +55997,7 @@ async function readPages(history, pool2, needed, first, { wakeSlot } = {}) {
   return { records: records.slice(0, needed), imports, initialization, syncedSlot };
 }
 async function readCompactPoolSnapshot({ connection, programId, pool: pool2 }) {
-  return readFinalizedPool(withBoundedOwnReads(connection), new import_web397.PublicKey(programId), new import_web397.PublicKey(pool2));
+  return readFinalizedPool(withBoundedOwnReads(connection), new import_web397.PublicKey(programId), new import_web397.PublicKey(pool2), { treeSlices: true });
 }
 function pageShapeValid(result, pool2, from) {
   return Boolean(result) && typeof result === "object" && result.pool === pool2 && result.fromOrdinal === from && isIndex(result.total) && isIndex(result.syncedSlot) && Array.isArray(result.records) && result.records.length === Math.max(0, Math.min(result.total, from + P03_COMPACT_PAGE) - from) && Boolean(result.initialization) && isSignature(result.initialization.signature) && isIndex(result.initialization.slot);
@@ -56156,7 +56298,7 @@ async function readCompactP03HistoryNow({
       markPhase("compact-pool-preread-failed");
     }
   }
-  snapshot ??= await readFinalizedPool(own, program, poolKey);
+  snapshot ??= await readFinalizedPool(own, program, poolKey, { treeSlices: true });
   markPhase(knownSnapshot !== void 0 ? "compact-pool-reused" : "compact-pool");
   if (snapshot.terminal) throw refuse3("p03_compact_history_pool_terminal");
   if (snapshot.currentIndex % SUBTREE_LEAVES3 !== 0n) throw refuse3("p03_compact_history_snapshot_invalid");
@@ -56637,7 +56779,7 @@ var init_compact = __esm({
     IMPORT_MAX_VALUES = 3;
     LIST_ATTEMPTS = 6;
     OWN_READ_TIMEOUT_MS = HISTORY_RPC_REQUEST_TIMEOUT_MS;
-    BOUNDED_OWN_METHODS = /* @__PURE__ */ new Set(["getAccountInfo", "getAccountInfoAndContext", "getMultipleAccountsInfo"]);
+    BOUNDED_OWN_METHODS = /* @__PURE__ */ new Set(["getAccountInfo", "getAccountInfoAndContext", "getMultipleAccountsInfo", "getMultipleAccountsInfoAndContext"]);
   }
 });
 
@@ -64067,6 +64209,8 @@ var init_errorCodes = __esm({
       "p03_float_seller_unanswered_paid_retry_same_request",
       "p03_float_seller_kept_payment",
       "p03_float_receipt_pruned",
+      "p03_float_request_expired_nothing_paid",
+      "request_pruned",
       // Our facilitator settle reasons the self-broadcast leg reads (floatPay.mjs BROADCAST_*), and its own quote-closing note.
       "invalid_exact_svm_transaction_simulation_failed",
       "p03_pocket_exact_lease_unreadable_retry",
@@ -92516,6 +92660,25 @@ var init_pay = __esm({
   }
 });
 
+// wallet/src/pay/floatWords.mjs
+function floatRefundWhy(error) {
+  const why = error?.broadcastRefusal;
+  if (why === "request_pruned") return "The wallet dropped this request 1 hour after it was made, so nothing was sent to the seller.";
+  if (why === "seller_quote_closing") return "The seller's quote was about to close, so the wallet sent no transfer to the seller.";
+  if (typeof why === "string" && why) return `Shinjuku's facilitator refused to send the transfer to the seller (${why}).`;
+  return "Seller did not take it.";
+}
+function floatExpiredWhy(error) {
+  return error?.broadcastRefusal === "request_pruned" ? "the wallet drops a request 1 hour after it was made, and this one was older" : "the seller's quote had too little time left to pay it safely (a payment needs about 2.5 minutes of it)";
+}
+var FLOAT_AMBIGUOUS_NOTE;
+var init_floatWords = __esm({
+  "wallet/src/pay/floatWords.mjs"() {
+    "use strict";
+    FLOAT_AMBIGUOUS_NOTE = "An earlier send of this payment got no answer, from the seller or from Shinjuku's facilitator; if that send landed, the seller holds the payment and no refund comes.";
+  }
+});
+
 // wallet/src/pay/floatPay.mjs
 import { createHash as createHash21, createHmac as createHmac8, randomBytes as randomBytes11 } from "node:crypto";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
@@ -92592,9 +92755,8 @@ function refundArrived(snapshot, refundTo) {
 function returnArrivedFloatRefundBudgets(store, snapshot) {
   for (const name of store.listWal()) {
     if (!name.startsWith(FLOAT_PAYMENT_WAL_PREFIX)) continue;
-    let record = store.readWal(name);
+    const record = store.readWal(name);
     if (record?.schema !== FLOAT_PAYMENT_SCHEMA) continue;
-    record = pruneFloatRecord(store, name, record);
     if (record.state !== "refund_pending" || typeof record.innerRequestId !== "string") continue;
     if (refundArrived(snapshot, record.refundTo)) releaseRefundedReservation({ store, requestId: record.innerRequestId });
   }
@@ -92607,6 +92769,12 @@ function finishedAtMs(record) {
 }
 function pruneFloatRecord(store, walName2, record, now = Date.now()) {
   const at = finishedAtMs(record);
+  if (at === void 0 && record.requestPruned !== true && Number.isFinite(record.createdAtMs) && now >= record.createdAtMs + FLOAT_KEEP_OPEN_REQUEST_MS) {
+    const { bodyBase64: _body2, headers: _headers2, ...request2 } = record.request ?? {};
+    const open3 = { ...record, request: request2, requestPruned: true, prunedAtMs: now };
+    store.writeWal(walName2, open3);
+    return open3;
+  }
   if (record.pruned === true || !Number.isFinite(at) || now < at + FLOAT_KEEP_BYTES_MS) return record;
   const { bodyBase64: _body, headers: _headers, ...request } = record.request ?? {};
   const { resultBase64, sellerHeaders: _sellerHeaders, sellerReason: _reason, ...rest } = record;
@@ -92620,6 +92788,18 @@ function pruneFloatRecord(store, walName2, record, now = Date.now()) {
   store.writeWal(walName2, pruned);
   return pruned;
 }
+function pruneFloatRecords(store, now = Date.now()) {
+  for (const name of store.listWal()) {
+    if (!name.startsWith(FLOAT_PAYMENT_WAL_PREFIX)) continue;
+    let record;
+    try {
+      record = store.readWal(name);
+    } catch {
+      continue;
+    }
+    if (record?.schema === FLOAT_PAYMENT_SCHEMA) pruneFloatRecord(store, name, record, now);
+  }
+}
 function finishedPruned(record) {
   const amounts = { floatId: record.floatId, paidAtomic: record.paidAtomic, priceAtomic: record.priceAtomic, feeAtomic: record.feeAtomic };
   if (record.state === "receipt") {
@@ -92632,7 +92812,12 @@ function finishedPruned(record) {
       ...isSolanaSignature(record.broadcastSignature) ? { transaction: record.broadcastSignature } : { landedSignatureUnknown: true }
     });
   }
-  fail18("p03_float_refund_pending", { ...amounts, refundEtaSeconds: FLOAT_REFUND_ETA_SECONDS, ambiguous: record.ambiguous === true });
+  fail18("p03_float_refund_pending", {
+    ...amounts,
+    refundEtaSeconds: FLOAT_REFUND_ETA_SECONDS,
+    ambiguous: record.ambiguous === true,
+    ...record.broadcastRefusal ? { broadcastRefusal: record.broadcastRefusal } : {}
+  });
 }
 function floatRefundsInFlightAtomic(store, snapshot) {
   const refreshedAtMs = Date.parse(snapshot?.refreshedAt ?? "");
@@ -93023,7 +93208,9 @@ async function payViaFloat({
     if (record.schema !== FLOAT_PAYMENT_SCHEMA) fail18("p03_float_record_invalid");
     if (record.fingerprint !== fingerprint) fail18("p03_float_request_id_conflict");
     record = pruneFloatRecord(store, walName2, record);
-    if (record.pruned !== true && JSON.stringify(record.request) !== JSON.stringify(requestData)) fail18("p03_float_request_data_mismatch");
+    if (record.pruned !== true && record.requestPruned !== true && JSON.stringify(record.request) !== JSON.stringify(requestData)) {
+      fail18("p03_float_request_data_mismatch");
+    }
     if (record.pruned === true) finishedPruned(record);
     if (record.state === "receipt") return paidResult(record, true);
   } else {
@@ -93066,6 +93253,15 @@ async function payViaFloat({
     store.writeWal(walName2, record);
     mark("float-quoted");
   }
+  if (record.xPayment === void 0 && innerUnsent() && (record.requestPruned === true || record.selfBroadcast && Date.now() + SELF_BROADCAST_LEG1_LEFT_MS > record.selfBroadcast.expiresAtMs)) {
+    store.removeWal(walName2);
+    if (record.requestPruned === true) fail18("p03_float_request_expired_nothing_paid", {
+      priceAtomic: record.priceAtomic,
+      feeAtomic: record.feeAtomic,
+      broadcastRefusal: "request_pruned"
+    });
+    quoteTooShort(record);
+  }
   if (record.xPayment === void 0) {
     let regenerated = false;
     const finishingUntil = Date.now() + FINISHING_LIMIT_MS;
@@ -93093,7 +93289,12 @@ async function payViaFloat({
             ...withoutCallerBody(deps),
             fetchImpl: floatFetch(fetchImpl, seen),
             settlePriorBeforeQuote: true,
-            acceptFrontedReceipt: front
+            acceptFrontedReceipt: front,
+            // An anchor wait (up to one epoch + 60 s) can use up the seller's quote: the gate above runs again
+            // before the fresh leg-1 402, while nothing of leg 1 exists (review 2026-10-16).
+            ...record.selfBroadcast ? { afterAnchorWait: () => {
+              if (Date.now() + SELF_BROADCAST_LEG1_LEFT_MS > record.selfBroadcast.expiresAtMs) quoteTooShort(record);
+            } } : {}
           }
         });
       } catch (error) {
@@ -93135,6 +93336,25 @@ async function payViaFloat({
   if (hash8(record.xPayment) !== record.headerSha256) fail18("p03_float_record_invalid");
   if (record.selfBroadcast) return selfBroadcastLeg({ store, walName: walName2, record, fetchImpl, sleep: sleep5, mark });
   const lostAnswer = record.state === "submitted";
+  if (record.requestPruned === true) {
+    record = {
+      ...record,
+      state: "refund_pending",
+      broadcastRefusal: "request_pruned",
+      refundPendingAtMs: record.refundPendingAtMs ?? Date.now(),
+      ...lostAnswer ? { ambiguous: true } : {}
+    };
+    store.writeWal(walName2, record);
+    fail18("p03_float_refund_pending", {
+      floatId: record.floatId,
+      paidAtomic: record.paidAtomic,
+      priceAtomic: record.priceAtomic,
+      feeAtomic: record.feeAtomic,
+      refundEtaSeconds: FLOAT_REFUND_ETA_SECONDS,
+      ambiguous: record.ambiguous === true,
+      broadcastRefusal: "request_pruned"
+    });
+  }
   record = { ...record, state: record.state === "refund_pending" ? "refund_pending" : "submitted", submittedAtMs: record.submittedAtMs ?? Date.now() };
   store.writeWal(walName2, record);
   mark("seller-sent");
@@ -93227,20 +93447,28 @@ async function selfBroadcastLeg({ store, walName: walName2, record, fetchImpl, s
     if (record.state === "seller_kept") keptUnknown();
     const settleUrl = new URL("/api/x402/settle", new URL(record.payUrlPrefix).origin).href;
     const until = Date.now() + BROADCAST_LIMIT_MS;
-    let unsigned = record.broadcastAtMs === void 0 || record.broadcastUnsigned === true;
+    let maybeSigned = record.broadcastMaybeSigned ?? record.broadcastAtMs !== void 0;
+    if (record.broadcastInFlight === true) maybeSigned = true;
     for (let attempt = 0; ; attempt += 1) {
-      if (Date.now() > record.selfBroadcast.expiresAtMs - BROADCAST_QUOTE_MARGIN_MS) {
+      const landBy = (record.floatPaidAtMs ?? record.createdAtMs ?? Date.now()) + TRANSFER_LANDING_WINDOW_MS;
+      if (Date.now() > record.selfBroadcast.expiresAtMs - BROADCAST_QUOTE_MARGIN_MS || landBy > record.selfBroadcast.expiresAtMs - PROOF_DELIVERY_MS) {
         record = {
           ...record,
           state: "refund_pending",
           broadcastRefusal: "seller_quote_closing",
           refundPendingAtMs: record.refundPendingAtMs ?? Date.now(),
-          ...unsigned ? {} : { ambiguous: true }
+          ...maybeSigned ? { ambiguous: true } : {}
         };
         store.writeWal(walName2, record);
         refundPending();
       }
-      record = { ...record, state: "broadcasting", broadcastAtMs: record.broadcastAtMs ?? Date.now(), broadcastUnsigned: false };
+      record = {
+        ...record,
+        state: "broadcasting",
+        broadcastAtMs: record.broadcastAtMs ?? Date.now(),
+        broadcastInFlight: true,
+        broadcastMaybeSigned: maybeSigned
+      };
       store.writeWal(walName2, record);
       if (attempt === 0) mark("float-broadcast-sent");
       let answer;
@@ -93268,14 +93496,21 @@ async function selfBroadcastLeg({ store, walName: walName2, record, fetchImpl, s
         store.writeWal(walName2, record);
         keptUnknown();
       }
-      if (BROADCAST_DEAD.has(reason) || BROADCAST_DEAD_STANDARD.test(reason)) {
-        record = { ...record, state: "refund_pending", broadcastRefusal: plainText(reason), refundPendingAtMs: record.refundPendingAtMs ?? Date.now() };
+      const refused = BROADCAST_REFUSED.has(reason) || BROADCAST_REFUSED_STANDARD.test(reason);
+      if (BROADCAST_DEAD.has(reason) || refused) {
+        record = {
+          ...record,
+          state: "refund_pending",
+          broadcastRefusal: plainText(reason),
+          refundPendingAtMs: record.refundPendingAtMs ?? Date.now(),
+          broadcastInFlight: false,
+          ...refused && maybeSigned ? { ambiguous: true } : {}
+        };
         store.writeWal(walName2, record);
         refundPending();
       }
-      if (BROADCAST_UNSIGNED.has(reason)) unsigned = true;
-      else if (!BROADCAST_NO_LOOKUP.has(reason)) unsigned = false;
-      record = { ...record, broadcastUnsigned: unsigned };
+      if (!BROADCAST_UNSIGNED.has(reason) && !BROADCAST_NO_LOOKUP.has(reason)) maybeSigned = true;
+      record = { ...record, broadcastInFlight: false, broadcastMaybeSigned: maybeSigned };
       store.writeWal(walName2, record);
       if (Date.now() >= until) fail18("p03_float_broadcast_pending_retry_same_request", { floatId: record.floatId });
       await sleep5(FINISHING_POLL_MS);
@@ -93289,6 +93524,11 @@ async function selfBroadcastLeg({ store, walName: walName2, record, fetchImpl, s
     signature: record.broadcastSignature
   })).toString("base64");
   const landed = { floatId: record.floatId, transaction: record.broadcastSignature, paidAtomic: record.paidAtomic };
+  if (record.requestPruned === true) {
+    record = { ...record, state: "seller_kept", sellerKeptAtMs: record.sellerKeptAtMs ?? Date.now() };
+    store.writeWal(walName2, record);
+    fail18("p03_float_seller_kept_payment", { ...landed, priceAtomic: record.priceAtomic, feeAtomic: record.feeAtomic });
+  }
   for (let attempt = 0; ; attempt += 1) {
     if (record.state !== "seller_kept") {
       record = { ...record, state: "submitted", submittedAtMs: record.submittedAtMs ?? Date.now() };
@@ -93355,6 +93595,13 @@ async function selfBroadcastLeg({ store, walName: walName2, record, fetchImpl, s
     });
   }
 }
+function quoteTooShort(record) {
+  fail18("p03_float_request_expired_nothing_paid", {
+    priceAtomic: record.priceAtomic,
+    feeAtomic: record.feeAtomic,
+    broadcastRefusal: "seller_quote_closing"
+  });
+}
 function withoutCallerBody(deps) {
   const {
     freshRequestBody: _fresh,
@@ -93372,7 +93619,7 @@ function keptSellerHeaders(headers) {
   let bytes2 = 0;
   for (const [name, value] of headers) {
     if (kept.length >= SELLER_HEADERS_MAX_COUNT) break;
-    if (SELLER_HEADERS_DROPPED.has(name) || SELLER_HEADERS_LINKING.test(name)) continue;
+    if (!SELLER_HEADERS_KEPT.has(String(name).toLowerCase())) continue;
     const size = Buffer.byteLength(name) + Buffer.byteLength(value);
     if (bytes2 + size > SELLER_HEADERS_MAX_BYTES) continue;
     bytes2 += size;
@@ -93396,7 +93643,7 @@ function paidResult(record, replayed) {
     float: { floatId: record.floatId }
   };
 }
-var import_web3109, FLOAT_PAYMENT_SCHEMA, REGENERATE_CODES, FLOAT_PAYMENT_WAL_PREFIX, FLOAT_CONFIG_SCHEMA, FLOAT_PAY_PATH, MAX_BODY_BYTES, FLOAT_REFUND_ETA_SECONDS, REFUND_SETTLED_AFTER_MS, FINISHING_POLL_MS, FINISHING_LIMIT_MS, SELLER_TIMEOUT_MS, CONFIG_TIMEOUT_MS, CONFIG_CACHE_MS, DECIMAL3, POSITIVE, PENDING_CODES, FLOAT_FRONT_HEADER, hash8, fail18, floatPaymentWalName, FLOAT_KEEP_BYTES_MS, configCache, configReads, poolDomains, poolDomainReads, poolDomainWarmFailedAt, WARM_RETRY_MS, payerGenerator, etaEntry, loadPayerGenerator, plainText, BROADCAST_DEAD, BROADCAST_DEAD_STANDARD, BROADCAST_UNSIGNED, BROADCAST_NO_LOOKUP, BROADCAST_LANDED, BROADCAST_LIMIT_MS, BROADCAST_QUOTE_MARGIN_MS, SELF_BROADCAST_RESEND_MS, SELLER_HEADERS_MAX_COUNT, SELLER_HEADERS_MAX_BYTES, SELLER_HEADERS_DROPPED, SELLER_HEADERS_LINKING;
+var import_web3109, FLOAT_PAYMENT_SCHEMA, REGENERATE_CODES, FLOAT_PAYMENT_WAL_PREFIX, FLOAT_CONFIG_SCHEMA, FLOAT_PAY_PATH, MAX_BODY_BYTES, FLOAT_REFUND_ETA_SECONDS, REFUND_SETTLED_AFTER_MS, FINISHING_POLL_MS, FINISHING_LIMIT_MS, SELLER_TIMEOUT_MS, CONFIG_TIMEOUT_MS, CONFIG_CACHE_MS, DECIMAL3, POSITIVE, PENDING_CODES, FLOAT_FRONT_HEADER, hash8, fail18, floatPaymentWalName, FLOAT_KEEP_BYTES_MS, FLOAT_KEEP_OPEN_REQUEST_MS, configCache, configReads, poolDomains, poolDomainReads, poolDomainWarmFailedAt, WARM_RETRY_MS, payerGenerator, etaEntry, loadPayerGenerator, plainText, BROADCAST_REFUSED, BROADCAST_REFUSED_STANDARD, BROADCAST_DEAD, TRANSFER_LANDING_WINDOW_MS, PROOF_DELIVERY_MS, SELF_BROADCAST_LEG1_LEFT_MS, BROADCAST_UNSIGNED, BROADCAST_NO_LOOKUP, BROADCAST_LANDED, BROADCAST_LIMIT_MS, BROADCAST_QUOTE_MARGIN_MS, SELF_BROADCAST_RESEND_MS, SELLER_HEADERS_MAX_COUNT, SELLER_HEADERS_MAX_BYTES, SELLER_HEADERS_KEPT;
 var init_floatPay = __esm({
   "wallet/src/pay/floatPay.mjs"() {
     "use strict";
@@ -93413,6 +93660,7 @@ var init_floatPay = __esm({
     init_store();
     init_proxy();
     init_payResource();
+    init_floatWords();
     FLOAT_PAYMENT_SCHEMA = "carbon-shielded-wallet/float-payment/v1";
     REGENERATE_CODES = /* @__PURE__ */ new Set(["float_payment_in_flight", "float_quote_open"]);
     FLOAT_PAYMENT_WAL_PREFIX = "float-";
@@ -93436,6 +93684,7 @@ var init_floatPay = __esm({
     };
     floatPaymentWalName = (requestKey) => `${FLOAT_PAYMENT_WAL_PREFIX}${requestKey}`;
     FLOAT_KEEP_BYTES_MS = 6e5;
+    FLOAT_KEEP_OPEN_REQUEST_MS = 36e5;
     configCache = /* @__PURE__ */ new Map();
     configReads = /* @__PURE__ */ new Map();
     poolDomains = /* @__PURE__ */ new Map();
@@ -93447,7 +93696,7 @@ var init_floatPay = __esm({
       new URL("__bundled_source__/wallet/src/pay/floatPay.mjs", import.meta.url).href
     )), "utf8")).payerKeys.generator;
     plainText = (value) => value.replace(/[^ -~]+/g, " ").trim().slice(0, 300);
-    BROADCAST_DEAD = /* @__PURE__ */ new Set([
+    BROADCAST_REFUSED = /* @__PURE__ */ new Set([
       "unsupported_scheme",
       "pocket_payment_network_unsupported",
       "pocket_payment_asset_not_pool_mint",
@@ -93460,12 +93709,14 @@ var init_floatPay = __esm({
       "pocket_authority_is_facilitator_signer",
       "pocket_bound_to_other_payee",
       "pocket_payment_count_exceeded",
-      "pocket_credit_exceeded",
-      "settlement_expired",
-      "transaction_failed",
-      "settlement_reverted"
+      "pocket_credit_exceeded"
     ]);
-    BROADCAST_DEAD_STANDARD = /^invalid_exact_svm_(?!.*simulation)[a-z_]+$/;
+    BROADCAST_REFUSED_STANDARD = /^invalid_exact_svm_(?!.*simulation)[a-z_]+$/;
+    BROADCAST_DEAD = /* @__PURE__ */ new Set(["settlement_expired", "transaction_failed", "settlement_reverted"]);
+    TRANSFER_LANDING_WINDOW_MS = 12e4;
+    PROOF_DELIVERY_MS = 1e4;
+    SELF_BROADCAST_LEG1_LEFT_MS = TRANSFER_LANDING_WINDOW_MS + PROOF_DELIVERY_MS + 15e3;
+    if (SELF_BROADCAST_MIN_LEFT_MS < SELF_BROADCAST_LEG1_LEFT_MS) throw new Error("self-broadcast offer minimum below the leg-1 minimum");
     BROADCAST_UNSIGNED = /* @__PURE__ */ new Set([
       "transaction_simulation_failed",
       "invalid_exact_svm_transaction_simulation_failed",
@@ -93479,27 +93730,7 @@ var init_floatPay = __esm({
     SELF_BROADCAST_RESEND_MS = [1e3, 2e3, 4e3, 8e3];
     SELLER_HEADERS_MAX_COUNT = 32;
     SELLER_HEADERS_MAX_BYTES = 8 * 1024;
-    SELLER_HEADERS_DROPPED = /* @__PURE__ */ new Set([
-      "set-cookie",
-      "set-cookie2",
-      "payment-response",
-      "x-payment-response",
-      "connection",
-      "keep-alive",
-      "proxy-authenticate",
-      "proxy-authorization",
-      "proxy-connection",
-      "te",
-      "trailer",
-      "transfer-encoding",
-      "upgrade",
-      "content-length",
-      "content-encoding",
-      "cf-ray",
-      "traceparent",
-      "tracestate"
-    ]);
-    SELLER_HEADERS_LINKING = /(^|-)(request|trace|correlation)-id$|^x-balance-|^x-pod-(?!route$)|^x-amzn?-/;
+    SELLER_HEADERS_KEPT = /* @__PURE__ */ new Set(["content-type", "content-language", "cache-control", "retry-after", "x-pod-route"]);
   }
 });
 
@@ -94544,6 +94775,7 @@ async function payResourceOnce({
             { connection, pool: store.state.pool }
           ))) {
             mark("anchor-wait-done");
+            deps.afterAnchorWait?.();
             continue;
           }
           throw error;
@@ -100762,6 +100994,15 @@ function errorBody(error) {
       message: `nothing was paid: usePod's price plus the Shinjuku fee${total ? ` (${total} atomic USDC)` : ""} is above this server's max payment per request. Lower max_tokens, or restart infer serve with --max-payment of at least ${total ?? "price + fee"}`
     } } };
   }
+  if (code === "p03_float_request_expired_nothing_paid") {
+    const why = floatExpiredWhy({ broadcastRefusal: error?.broadcastRefusal ?? error?.cause?.broadcastRefusal });
+    return { status: 503, body: { error: {
+      type: OPENAI_TYPE.api,
+      param: null,
+      code,
+      message: `nothing was paid: ${why}. Send the same request again: it reads a fresh quote from usePod and pays once`
+    } } };
+  }
   if (code === "p03_float_request_data_mismatch" || code === "p03_float_request_id_conflict") {
     return { status: 400, body: { error: {
       type: OPENAI_TYPE.request,
@@ -100782,6 +101023,7 @@ function errorBody(error) {
 }
 function moneyMayHaveMoved(error, code) {
   if (!code) return true;
+  if (/_nothing_paid$/.test(code)) return false;
   if (/_retry_same_request$/.test(code) || /_refund_pending$/.test(code)) return true;
   for (const one of [error, error?.cause]) {
     if (code.startsWith("p03_float_") && (one?.floatId ?? one?.details?.floatId) !== void 0) return true;
@@ -101026,6 +101268,7 @@ var INFERENCE_SERVE_HOST, INFERENCE_SERVE_PORT, BODY_LIMIT_BYTES, IDEMPOTENCY_KE
 var init_serve = __esm({
   "wallet/src/inference/serve.mjs"() {
     "use strict";
+    init_floatWords();
     INFERENCE_SERVE_HOST = "127.0.0.1";
     INFERENCE_SERVE_PORT = 11402;
     BODY_LIMIT_BYTES = 1024 * 1024;
@@ -128639,13 +128882,19 @@ function floatRefusal(error) {
     case "p03_float_answer_invalid_refund_pending":
       return [
         code,
-        `Seller did not take it; refund of ${error?.paidAtomic ?? "the amount paid"} atomic on the way (up to ${Math.ceil((error?.refundEtaSeconds ?? FLOAT_REFUND_ETA_SECONDS) / 60)} min). Nothing more to do.` + (typeof error?.sellerReason === "string" ? ` The seller answered HTTP ${error.httpStatus}: ${JSON.stringify(error.sellerReason)}.` : "") + (error?.ambiguous === true ? " (An earlier call with this request_id got no answer from the seller; if that call reached it, the seller holds the payment and no refund comes.)" : ""),
+        `${floatRefundWhy(error)} Refund of ${error?.paidAtomic ?? "the amount paid"} atomic on the way (up to ${Math.ceil((error?.refundEtaSeconds ?? FLOAT_REFUND_ETA_SECONDS) / 60)} min). Nothing more to do.` + (typeof error?.sellerReason === "string" ? ` The seller answered HTTP ${error.httpStatus}: ${JSON.stringify(error.sellerReason)}.` : "") + (error?.ambiguous === true ? ` (${FLOAT_AMBIGUOUS_NOTE})` : ""),
         "Nothing more to do: the refund comes back to balanceAtomic by itself. Do not call x402_pay again with this request_id. To try this seller again, use a NEW request_id"
       ];
+    case "p03_float_request_expired_nothing_paid":
+      return [
+        code,
+        `${floatExpiredWhy(error)}; nothing was paid`,
+        "Nothing was paid. Call x402_pay again: it reads a fresh quote from the seller and pays once"
+      ];
     case "p03_float_receipt_pruned":
       return [
         code,
-        `this request_id was paid and answered more than 10 minutes ago${typeof error?.transaction === "string" ? ` (${error.transaction})` : ""}; the wallet no longer keeps its answer (it never keeps prompts or answers longer), and nothing was paid again`,
+        `this request_id was paid and answered more than 10 minutes ago${typeof error?.transaction === "string" ? ` (${error.transaction})` : ""}; the wallet keeps an answer 10 minutes after the call, then only its hash, and nothing was paid again`,
         "To ask again, call with a NEW request_id (it pays again)"
       ];
     case "p03_float_broadcast_pending_retry_same_request":
@@ -128930,6 +129179,10 @@ async function refreshWallet({ session, store, history: walked, share }) {
   });
   writeBalanceSnapshot(store, snapshot);
   returnArrivedFloatRefundBudgets(store, snapshot);
+  try {
+    pruneFloatRecords(store);
+  } catch {
+  }
   prepareFinalizedP03RecoveryFold(history).catch(() => {
   });
 }
@@ -137588,10 +137841,10 @@ async function offerFundNow(deps, path) {
   const io = deps.io;
   for (let attempt = 0; attempt < 3; attempt += 1) {
     const answer = String(await deps.ask("Fund and shield now? Amount in USDC (Enter to skip): ")).trim();
-    if (!answer) break;
+    if (!answer || /^(n|no|skip)$/i.test(answer)) break;
     const atomic3 = usdcToAtomic(answer);
     if (!atomic3 || BigInt(atomic3) % 1000000n !== 0n) {
-      io.err("Type a whole number of USDC, like 2 (a relayed deposit takes whole USDC only), or press Enter to skip.\n");
+      io.err("Type a whole number of USDC, like 2 (a relayed deposit takes whole USDC only), or press Enter (or n) to skip.\n");
       continue;
     }
     const argv = path.fund.map((word, index) => path.fund[index - 1] === "--amount" ? atomic3 : word);
@@ -137727,11 +137980,14 @@ async function runSetupCommand(values, deps) {
     return setupBehindTor(setupArgvOf(values), deps);
   }
   const missing = missingPieces(home, old);
+  const introduced = values.has("--yes") && inProxiedRun(deps.env);
   io.out([
-    "Shinjuku Shielded: a self-custody wallet that pays x402 URLs privately from a shielded USDC balance.",
-    "Setup makes the wallet on this machine (your keys never leave it), downloads and checks the proof tools, and writes config.json.",
-    "An agent host then starts it with one command: npx -y shinjuku-shielded mcp",
-    "",
+    ...introduced ? [] : [
+      "Shinjuku Shielded: a self-custody wallet that pays x402 URLs privately from a shielded USDC balance.",
+      "Setup makes the wallet on this machine (your keys never leave it), downloads and checks the proof tools, and writes config.json.",
+      "An agent host then starts it with one command: npx -y shinjuku-shielded mcp",
+      ""
+    ],
     old ? `Status: ${missing.includes("pool-retired") ? `set up before for a retired pool: ${retiredPoolText(old.pool).split("; run ")[0]}. This run moves config.json to the new pool and makes its wallet` : missing.length ? `set up before; missing now: ${missing.join(", ")}` : "set up; every piece is checked again"} (home ${home}).` : `Home: ${home}`,
     ""
   ].join("\n"));
@@ -139484,6 +139740,7 @@ async function refreshSnapshot(args, values, deps) {
   const walStates = captureWalStates(store);
   const { result, history } = await deps.runRecoverCommand(args.filter((token) => token !== "--refresh"));
   assertAuthenticatedFinalizedP03History(history);
+  let saved;
   const save2 = () => {
     const snapshot = snapshotFromRecovery({
       state: store.state,
@@ -139495,16 +139752,32 @@ async function refreshSnapshot(args, values, deps) {
       now: deps.now()
     });
     writeBalanceSnapshot(store, snapshot);
-    returnArrivedFloatRefundBudgets(store, snapshot);
+    saved = snapshot;
   };
-  return { store, result, save: save2 };
+  const prune = async () => {
+    let release;
+    try {
+      release = await (deps.acquireLease ?? acquireWalletProcessLease)(walletLockPath(deps.walletPath(values.get("--pool"))));
+    } catch {
+      return;
+    }
+    try {
+      const fresh = openPoolWallet(values, deps);
+      if (saved) returnArrivedFloatRefundBudgets(fresh, saved);
+      pruneFloatRecords(fresh);
+    } catch {
+    } finally {
+      await release();
+    }
+  };
+  return { store, result, save: save2, prune };
 }
 function warnUnsavedSync(result, io) {
   if (result?.memoSync?.cache !== "unwritable") return;
   io.err("warning: the recovery cache (recovery-cache.json beside wallet.json) was not saved; the next recover or balance --refresh reads every memo again\n");
 }
 async function runRecoverAndSave(args, values, deps, io) {
-  const { result, save: save2 } = await refreshSnapshot(args, values, deps);
+  const { result, save: save2, prune } = await refreshSnapshot(args, values, deps);
   io.out(`${JSON.stringify(recoverSummary(result), null, 2)}
 `);
   warnUnsavedSync(result, io);
@@ -139519,6 +139792,7 @@ async function runRecoverAndSave(args, values, deps, io) {
     io.err(`warning: the balance walk was not saved (${describeCliError(error, { fallback: "balance_snapshot_unwritable" })}); balance will ask for --refresh
 `);
   }
+  await prune();
 }
 var RELAYED_DEPOSIT_UNIT = Object.freeze({
   DFCCPHdw7pH9vKk9FEN9z6cy9M1UKjF168j7HfLwxYk3: "1000000",
@@ -139703,6 +139977,7 @@ async function runBalance(args, values, deps, io) {
     const refreshed = await refreshSnapshot(args, values, deps);
     warnUnsavedSync(refreshed.result, io);
     refreshed.save();
+    await refreshed.prune();
     store = refreshed.store;
     earlierDeposits = await (deps.adoptOneTime ?? adoptOneTimeForBalance)({ store, values, deps, io });
   } else {
@@ -140197,7 +140472,10 @@ function privacyCashFailureHint(reason) {
 function floatFailureHint(reason) {
   const config = "GET <facilitator>/api/x402/float/config";
   if (/p03_float_refund_pending/.test(reason) && !/answer_invalid/.test(reason)) {
-    return "Seller did not take it; refund of the amount paid (price + fee) on the way (up to about 7 min). Nothing more to do. The refund lands in your shielded balance by itself. Only if an earlier run of this request ended with no answer from the seller, that run may have paid the seller; then no refund comes and the seller holds the payment";
+    return "the payment did not reach the seller (the lines above say why); refund of the amount paid (price + fee) on the way (up to about 7 min). Nothing more to do: the refund lands in your shielded balance by itself";
+  }
+  if (/p03_float_request_expired_nothing_paid/.test(reason)) {
+    return "nothing was paid: rerun the same command; it reads a fresh quote from the seller and pays once";
   }
   if (/p03_float_answer_invalid_refund_pending/.test(reason)) {
     return "Shinjuku was paid, but its answer held no valid payment for this seller, so nothing went to the seller. Refund of the amount paid (price + fee) on the way (up to about 7 min). Nothing more to do";
@@ -140243,7 +140521,7 @@ function floatFailureHint(reason) {
     return "the transfer to the seller landed (transaction above), but the seller did not answer (or answered with a server error). Rerun the exact same command: it sends the same proof of payment again and never pays twice";
   }
   if (/p03_float_receipt_pruned/.test(reason)) {
-    return "this request id was paid and answered more than 10 minutes ago; the wallet no longer keeps its answer (it never keeps prompts or answers longer), and nothing was paid again. To ask again, run the command with a new request id (it pays again)";
+    return "this request id was paid and answered more than 10 minutes ago; the wallet keeps an answer 10 minutes after the call, then only its hash, and nothing was paid again. To ask again, run the command with a new request id (it pays again)";
   }
   if (/p03_float_seller_kept_payment/.test(reason)) {
     return "the transfer to the seller landed (its transaction is above when the wallet knows it), but the seller did not serve the request. The seller holds the payment, so no refund comes from Shinjuku. Rerun the exact same command once to resend the same proof; if it is refused again, do not pay this seller";
@@ -140520,9 +140798,15 @@ next: fund that address, then rerun the same command; it continues where it stop
 ` : "";
     const landedTx = error?.transaction ?? error?.cause?.transaction;
     const landedLine = /^p03_float_seller_(kept_payment|unanswered_paid)/.test(reason) && typeof landedTx === "string" ? `transfer to the seller landed: ${landedTx}
+` : "";
+    const floatError = { broadcastRefusal: error?.broadcastRefusal ?? error?.cause?.broadcastRefusal };
+    const whyLine = /^p03_float_refund_pending/.test(reason) ? `why: ${floatRefundWhy(floatError)}
+` : /^p03_float_request_expired_nothing_paid/.test(reason) ? `why: ${floatExpiredWhy(floatError)}
+` : "";
+    const ambiguousLine = /^p03_float_refund_pending/.test(reason) && (error?.ambiguous ?? error?.cause?.ambiguous) === true ? `note: ${FLOAT_AMBIGUOUS_NOTE}
 ` : "";
     io.err(`${CLI2} ${command.name} failed: ${reason}
-${sellerLine}${landedLine}${blockingLine}${hint ? `hint: ${hint}
+${sellerLine}${landedLine}${whyLine}${ambiguousLine}${blockingLine}${hint ? `hint: ${hint}
 ` : ""}Help: ${CLI2} help ${command.name}
 `);
     return 1;