From 4e2940722df392f26e563ae98082cdeca642e0dc Mon Sep 17 00:00:00 2001
From: worker-mobee-crossmint <orveth@agi.cash>
Date: Mon, 27 Jul 2026 12:23:54 -0700
Subject: [PATCH 1/9] crossmint: plan direct-vs-hop payment at the
 mint-selection seam
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A buyer funded only at mint A can pay a seller who accepts only mint B by
hopping through Lightning between the mints: a NUT-04 mint quote at B yields a
bolt11, a NUT-05 melt from A pays it, and the buyer ends up holding fresh ecash
at B for the ordinary send path. Lightning is connective tissue between mints
only, so the wire keeps one settlement shape.

This lands the decision half: `PayPlan::{Direct, Hop}` and `plan_payment`, a
pure function of the buyer's selected mint and the seller's accepted set. It
moves no money and touches no network, so whether we hopped is testable
directly rather than inferred from an outcome.

`realized_mint()` is the hop's TARGET, since that is where the ecash the seller
receives lives and the terms, attempt id and co-signed receipt must all agree on
one mint. Target selection is the first admissible accepted entry and must stay
deterministic: the attempt id derives from the realized mint, so a retry that
re-derived a different target would compute a different attempt id and defeat
pays-once.

Both legs pass the real-mint fence. Fencing the target matters as much as the
source — a hop ends with the buyer holding ecash there, so an unfenced target
would admit a real-sats mint while allow_real_mints is off. With no admissible
target the plan refuses fail-closed rather than landing somewhere unpermitted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CROSSMINT-RESEARCH.md              | 353 +++++++++++++++++++++++++++++
 crates/mobee-core/src/crossmint.rs | 280 +++++++++++++++++++++++
 crates/mobee-core/src/lib.rs       |   2 +
 3 files changed, 635 insertions(+)
 create mode 100644 CROSSMINT-RESEARCH.md
 create mode 100644 crates/mobee-core/src/crossmint.rs

diff --git a/CROSSMINT-RESEARCH.md b/CROSSMINT-RESEARCH.md
new file mode 100644
index 00000000..e91ee211
--- /dev/null
+++ b/CROSSMINT-RESEARCH.md
@@ -0,0 +1,353 @@
+# Cross-mint hop — research report (worker:mobee-crossmint, 2026-07-27)
+
+Charter: `/srv/forge/projects/mobee-seller-node/CROSSMINT-CHARTER.md` · parent: keeper:mobee-orchestrator
+Ground truth read: cdk `=0.17.2` (the pinned version, vendored at
+`~/.cargo/registry/src/index.crates.io-*/cdk-0.17.2` + `cdk-common-0.17.2`), agicash @ `23788b7c`,
+mobee @ `origin/dev` `7463cbe`.
+
+⚠ Do NOT read `/srv/forge/projects/cdk` for this work — it is the MakePrisms fork at **v0.16.0-48**,
+not the version mobee compiles against.
+
+## Verdict
+
+**No cross-mint primitive exists in cdk 0.17.2 — we build the hop.** But both halves already exist
+*in mobee* as separate CLI ops, and cdk gives us persisted, quote-id-addressable crash recovery for
+each half. So this is a **composition over existing money machinery**, not new money machinery. The
+agicash pattern gives us the fee decomposition, and its loop **inverts** for our invariant 1 (below —
+this is the sharpest finding).
+
+## 1. cdk 0.17.2 — what's actually there
+
+**Cross-mint transfer primitive: NO.**
+- `cdk-common-0.17.2/src/error.rs:410` declares `Error::TransferTimeout { source_mint, target_mint, amount }`
+  — but it is a **dead variant**: never constructed anywhere in `cdk` or `cdk-common` (only declared
+  and classified in a match arm at `error.rs:755`). It is a leftover surface, not a feature.
+- No `MultiMintWallet` in 0.17.2.
+- The fork's `cdk-cli/src/sub_commands/transfer.rs` "transfer" is `source.prepare_send()` →
+  `target.receive(token)` — that is a same-mint move mislabelled; receiving a mint-A token at a
+  mint-B wallet is rejected (`Error::IncorrectMint` / `MultiMintTokenNotSupported`). **Not a model to copy.**
+
+**Multi-mint wallet management: YES — `WalletRepository`** (`cdk/src/wallet/wallet_repository.rs`).
+One shared `localstore` + one seed, N wallets keyed by `WalletKey { mint_url, unit }`:
+`get_wallet(mint_url, unit)`, `add_wallet`, `has_mint`, `get_balances`, `total_balance`.
+This is how we hold mint A and mint B at once without two databases.
+
+**Quote lifecycle (both halves).**
+- Mint side (NUT-04), `cdk/src/wallet/issue/mod.rs`:
+  `mint_quote(PaymentMethod, Option<Amount>, description, extra) -> MintQuote` (`:106`) — the
+  `MintQuote.request` field IS the bolt11 we need; `mint(...)` (`:416`); `check_mint_quote_status(quote_id)` (`:286`).
+- Melt side (NUT-05), `cdk/src/wallet/melt/mod.rs`:
+  `melt_quote(method, request, options, extra) -> MeltQuote` (`:1156`); `check_melt_quote_status(quote_id)` (`:1260`).
+
+**Fee reserve reporting: YES, as a first-class field.**
+`cdk-common/src/wallet/mod.rs:215` — `MeltQuote { amount, fee_reserve, state, used_by_operation, version, .. }`.
+`amount` and `fee_reserve` are **separate** — exactly the two numbers invariant 3 must add up.
+Mint (input/keyset) fee is the third: `cdk/src/fees.rs::calculate_fee`.
+
+**Saga machinery (this is the good news).** Every wallet money op is a typed saga with a persisted
+record and a resume path: `wallet/{melt,issue,send,receive,swap}/saga/{mod,state,resume,compensation}.rs`.
+`cdk-common/src/wallet/saga/mod.rs:162` — `WalletSaga { id, kind, state, amount, mint_url, unit,
+quote_id: Option<String>, data, version, .. }`. `version` is optimistic-locking; the doc says a
+version conflict means "someone else handled it — skip", which is our multi-process safety net.
+
+## 2. Parent's question: is melt quote state recoverable by quote id after process death?
+
+**Yes — recoverable by quote id, from a cold process, without a live wallet handle.** Mechanism:
+
+1. The quote itself is **persisted in the wallet DB** (sqlite), not in-memory:
+   `check_melt_quote_status(quote_id)` (`melt/mod.rs:1260`) starts with
+   `self.localstore.get_melt_quote(quote_id)` → `Error::UnknownQuote` if absent.
+2. The quote row carries `used_by_operation: Option<String>` → the saga UUID. The function then does
+   `localstore.get_saga(&operation_id)` and, if a saga exists, calls `resume_melt_saga(&saga)` — i.e.
+   **asking for the quote's status is itself the recovery trigger.**
+3. `resume_melt_saga` (`melt/saga/resume.rs:20`) queries the mint and either finalizes or compensates.
+   Its contract: `Ok(Some(FinalizedMelt))` = finalized or compensated; **`Ok(None)` = still pending or
+   mint unreachable → skipped** (retry later); `Err` = recovery error.
+4. Cold-start sweep: `Wallet::recover_incomplete_sagas()` (`wallet/recovery.rs:302`) reads
+   `localstore.get_incomplete_sagas()` and dispatches per kind. Also
+   `get_pending_melt_quotes()` / `get_active_melt_quotes()` (`melt/mod.rs:970,983`) read from the store,
+   and `finalize_pending_melts()` (`:749`).
+
+**So the primitive's shape, before we design the journal:** we do NOT need to journal melt state
+ourselves — cdk already journals it. What we MUST journal is the **pairing** (which melt quote at A
+belongs to which mint quote at B, for which job/attempt), because nothing in cdk knows the two quotes
+are one logical hop. That's the whole content of our journal: `(attempt_id, mint_a, melt_quote_id,
+mint_b, mint_quote_id, planned_cost)` written **before** the melt fires.
+
+**⚠ Trap that hangs directly off this** (and it is why per-wallet recovery is not enough):
+`recover_incomplete_sagas()` filters `sagas.retain(|s| s.mint_url == self.mint_url && s.unit == self.unit)`
+(`recovery.rs:308-311`). A hop has one saga at **mint A** (melt) and one at **mint B** (issue). Recovery
+run on the mint-A wallet **silently skips** the mint-B saga and vice versa. A single-wallet startup
+sweep therefore leaves half the hop unrecovered, with no error — the exact "absent signal from a
+changed source" shape. ⇒ **the hop's recovery must run on both wallets** (or over
+`WalletRepository::get_wallets()`).
+
+**The paid-but-unminted strand has a purpose-built sweeper.** `MintQuote` tracks `amount_paid` vs
+`amount_issued` with `amount_mintable()` (`cdk-common/src/wallet/mod.rs:303`; for BOLT11 it is
+all-or-nothing on `state == Paid`). `Wallet::mint_unissued_quotes()` (`issue/mod.rs:340`) +
+`get_unissued_mint_quotes()` (`:408`) find and complete them, and
+**`WalletRepository::check_all_mint_quotes(None)` (`wallet_repository.rs:822`) iterates every wallet and
+calls `mint_unissued_quotes()` on each** — repo-wide, which is what the cross-mint case needs. So
+"melted at A, paid at B, crashed before minting at B" is recoverable and must be surfaced loudly, not
+silently swept.
+
+## 3. agicash `receive-cashu-token` — the fee pattern
+
+Files (main tree, ignore `worktrees/*` copies):
+`apps/web-wallet/app/features/receive/cashu-token-melt-data.ts`,
+`receive-cashu-token-quote-service.ts`, `cashu-receive-quote-service.ts`, `cashu-receive-quote-hooks.ts`.
+
+**Fee decomposition** (`cashu-token-melt-data.ts`) — their persisted per-hop record. Four money fields:
+- `cashuReceiveFee` — mint input fee for spending the source proofs as melt inputs
+  (`sourceAccount.wallet.getFeesForProofs(token.proofs)`)
+- `lightningFeeReserve` — `meltQuote.fee_reserve`
+- `lightningFee` (optional) — the **actual** LN fee, known only after the melt completes;
+  `reserve - actual = change`. Their comment: "For cashu token receives over lightning, we are
+  currently not returning the change to the user."
+- plus `sourceMintUrl`, `tokenAmount`, `tokenProofs`, `meltQuoteId`, `meltInitiated: boolean`
+
+**Fee sizing = a bounded convergence loop** (`receive-cashu-token-quote-service.ts:205-273`). The
+circularity is real: fee reserve needs a melt quote, which needs an invoice, which needs an amount.
+Their resolution:
+
+```
+cashuReceiveFee = getFeesForProofs(token.proofs)
+targetAmount    = tokenAmount - cashuReceiveFee        // hard ceiling
+amountToMelt    = targetAmount
+loop (attempts < 5):
+    amountToMint = convert(amountToMelt)
+    if amountToMint < 1        -> DomainError "too small to cover the fees"
+    invoice   = destination.mintQuote(amountToMint).request     // NUT-04 at DESTINATION
+    meltQuote = source.createMeltQuoteBolt11(invoice)           // NUT-05 at SOURCE
+    required  = meltQuote.amount + meltQuote.fee_reserve
+    diff      = required - targetAmount
+    if diff <= 0 -> DONE
+    amountToMelt -= diff                                       // shrink, retry
+throw "Failed to find valid quotes after 5 attempts"
+```
+
+Properties worth keeping: **bounded** (5, no unbounded retry), **fail-closed** (throws rather than
+melting something that doesn't fit), and the fit predicate is exactly
+`melt.amount + melt.fee_reserve <= budgeted`.
+
+**Pays-once discipline** (`cashu-receive-quote-service.ts:127`, `cashu-receive-quote-hooks.ts:775-820`).
+`markMeltInitiated` is idempotent (no-op if set) and state-gated (must be `UNPAID`). Recovery is a
+decision table driven by the **melt quote state at the source mint**, looked up **by melt quote id**:
+- `Unpaid` + `meltInitiated` ⇒ the melt **failed** → fail the hop. **Never re-melt.**
+- `Unpaid` + `!meltInitiated` ⇒ safe to initiate.
+- `Pending` ⇒ mark initiated (money in flight).
+- `Expired` ⇒ expire.
+
+⚠ One honest weakness to NOT copy: they set `meltInitiated` **reactively**, on observing `Pending`.
+A crash between sending the melt request and observing `Pending` leaves the flag false with money
+possibly in flight; they are then relying on the mint rejecting a second melt on the same quote. We
+should instead **write the journal before the melt call** (write-before-effect) — which is already
+mobee's own discipline for the budget ledger (`budget.rs:6-14`, "appended (never rewritten) **before**
+the pay effect"), and is strictly stronger.
+
+## 4. Mobee-side seams (what we compose)
+
+- `crates/mobee-core/src/wallet_ops.rs:354` — `mint_quote(PaymentMethod::BOLT11, Some(amount), ..)` (deposit path)
+- `crates/mobee-core/src/wallet_ops.rs:651` — `melt_quote(PaymentMethod::BOLT11, bolt11, ..)` (withdraw path)
+  ⇒ **both halves of the hop already exist and are exercised.**
+- `crates/mobee-core/src/payment_wallet.rs:246` — `prepare_send(terms.amount, options)`; `:577` — "Gate on
+  the **realized** locked token after prepare_send/confirm — never input face." This is the send path the
+  hop must feed **unchanged**.
+- `crates/mobee-core/src/payment_wallet.rs:521` — `require_fee_safe_amount(wallet, amount)` via
+  `mint_input_fee_bounded(wallet, 1, MINT_TOUCH_TIMEOUT)` returning
+  `BoundedFee::{Fee, Failed, Unreachable}`. **This is our invariant-5 precedent: a timeout-bounded,
+  fail-closed mint touch.** Reuse it for quote request/poll rather than inventing a timeout.
+- `crates/mobee-core/src/authorize_pay.rs:385` — `require_fee_safe_amount(&wallet, terms.amount)`
+  (pre-budget dust check); `:415` — `gate.authorize_then_attempt(attempt_id, amount, ..)`.
+  **⇒ the #185 seam is visible right here:** the gate is charged `amount` (the buyer-signed number)
+  while the fee is only *dust-checked* (`require_amount_covers_fee`: `amount > fee`), never *added to
+  the cap*. For the hop, `amount + fee_reserve + input_fee` must be what the cap sees.
+- `crates/mobee-core/src/budget.rs` — append-only `spent.jsonl`, fold-at-read, cross-process `flock`,
+  `attempt_id`-keyed idempotence. The hop charges through this, not around it.
+
+## 5. Design consequence — the loop INVERTS (headline)
+
+agicash solves "**receive**: fees eat the amount" — the token amount is fixed by whoever sent it, so
+the **delivered** amount floats *down* to absorb fees.
+
+Our charter's invariant 1 forbids exactly that: the amount is fixed by the **buyer-signed offer** and
+no mint- or seller-supplied number may become the paid amount. So we must **not** shrink the mint
+amount. We pin the delivery and let the **buyer's cost** float *up*:
+
+1. `mint_quote` at seller's mint **B** for **exactly `offer.amount`** → `MintQuote.request` (bolt11)
+2. `melt_quote` at buyer's funded mint **A** for that bolt11 → `amount`, `fee_reserve`
+3. input fee at A for the proofs to be spent (mobee's bounded reader)
+4. `planned_cost = melt.amount + melt.fee_reserve + input_fee`
+5. **budget check on `planned_cost` BEFORE any melt** — insufficient ⇒ abort, zero money moved
+6. journal `(attempt_id, A, melt_quote_id, B, mint_quote_id, planned_cost)` **before** the melt
+7. melt at A → mint at B → hand fresh mint-B ecash to the **unchanged** send path
+
+No convergence loop is needed: with the delivery pinned, cost is a single forward computation. That is
+both simpler than agicash's loop **and** satisfies invariant 1 by construction — the seller-received
+amount is never a function of any fee reading. (A retry loop would only be needed if we allowed the
+delivered amount to float, which is precisely what we must not do.)
+
+Invariant map: 1 → step 1 pins `offer.amount`, nothing downstream can rewrite it. 2 → decision tooth
+before step 1 (overlap ⇒ existing path, byte-identical). 3 → step 4+5. 4 → step 6 + both-wallet
+recovery + `check_all_mint_quotes`. 5 → every mint touch through the bounded/fail-closed reader; abort
+before melt on any quote failure.
+
+## 6. Traps found (each would bite)
+
+1. **Per-wallet recovery filter** — `recover_incomplete_sagas()` skips the other mint's saga silently. Run on both.
+2. **`TransferTimeout` is bait** — a dead cdk error variant suggesting a transfer feature that isn't there.
+3. **The fork is the wrong cdk** — `/srv/forge/projects/cdk` is v0.16; mobee pins `=0.17.2`.
+4. **`cdk-cli transfer` is not a cross-mint hop** — naive send→receive; copying it produces `IncorrectMint`.
+5. **Reactive `meltInitiated`** (agicash) leaves a crash window; use write-before-effect.
+6. **Fee reserve ≠ fee charged** — `reserve - actual` comes back as melt change, so the *planned* cost
+   is an upper bound on the *realized* cost (see open question).
+
+## 7. Open questions for parent (2)
+
+**Q1 — budget reconciliation of the unused fee reserve.** We charge `planned_cost` (with the full
+`fee_reserve`) before the melt, per invariant 3. The melt then returns change worth
+`fee_reserve - actual_ln_fee`. Options: (a) leave the conservative overcharge standing — safe,
+fail-closed, but the cap under-reports remaining allowance; (b) append a reconciliation record keyed to
+the same `attempt_id` so the fold reflects true spend. **Recommendation: (a) for this slice**, and note
+it in code as interim — (b) touches the ledger fold, which is money-gate machinery I should not
+reshape inside a feature slice. Your call.
+
+**Q2 — second test mint.** Charter names `testnut.cashudevkit.org` as our default and the
+`testnut.cashu.space` family as candidates for mint B. I'll probe candidates for NUT-04/NUT-05 support
+and report which pair actually works. Expect an honest caveat: if both are fake-wallet mints, the LN
+leg auto-settles and the smoke proves the *hop's control flow, journal, budget accounting and
+recovery* — but **not** real LN routing or a real fee reserve being consumed. Real-LN proof stays
+gudnuf-gated; I won't attempt it.
+
+Nothing here needs a money-gate config change. No budget/mint/`allow_real_mints` edit is implied by
+the design above.
+
+---
+
+# Part II — rulings + implementation design (post-research)
+
+## Rulings received (keeper:mobee-orchestrator)
+
+- **Q1 = (a)** conservative overcharge, `// interim:` at the charge site linking a filed follow-up.
+  ⇒ **MakePrisms/mobee#186**.
+- **Q2 = (iii)** hermetic teeth this slice; live cross-mint smoke deferred (gudnuf holds the
+  second-mint money-gate ask). Fence defect filed separately ⇒ **MakePrisms/mobee#187**
+  (testnut allow-LIST + `extra_mints` dead-config, one fence one review).
+- **Req 1** — the per-wallet saga-sweep trap is the heart of invariant 4: recovery on BOTH wallets +
+  the mint-quote sweep; a melted-at-A/unminted-at-B strand must surface LOUD.
+- **Req 2** — the hop's cap check sees `planned_cost`; do NOT touch `authorize_pay`'s general
+  fee-dust behaviour (that is #185 proper, stays separate).
+- **Req 3** — CLEARED, no migration; recommendation accepted (below).
+
+## Req 3 resolution: no WalletRepository, no migration
+
+Mobee already has WalletRepository's model. `open_wallet_at_mint_async(home, mint_url)`
+(`buyer_fund.rs:85-106`) uses `sqlite_path(&home.wallet_dir)` — **one store per home, independent of
+mint** — then `Wallet::new(mint_url, Sat, Arc::new(store), seed, None)`. Its own docstring: *"The
+store (sqlite) is shared across mints; only the `Wallet`'s bound mint differs."*
+
+⇒ Call that helper **twice** (mint A, mint B). Three reasons it beats introducing `WalletRepository`:
+1. Zero schema/layout change to any existing money home.
+2. The **real-mint fence lives inside the helper**, so both legs of the hop are fenced automatically
+   rather than depending on us remembering to fence the second one.
+3. The shared store makes req-1 recovery work for free: `get_incomplete_sagas()` returns sagas for
+   every mint off the one store, and each `Wallet` filters to its own `mint_url` — so opening both
+   wallets and recovering each covers the whole hop.
+
+## The decision seam (invariant 2)
+
+`resolve_realized_mint(buyer_mint_url, accepted_mints, allow_real_mints)` (`authorize_pay.rs:471`)
+already **is** the decision, and its no-overlap branch already names the gap it errors on:
+
+> `mint_unreachable_pay: buyer mint {buyer_mint} is not in the creq mint list {listed:?}; the
+> single-mint buyer wallet holds no balance at any accepted mint`
+
+That error is the hop's trigger. Shape the seam as a plan, not a bool:
+
+```
+enum PayPlan {
+    Direct { mint: MintUrl },                        // buyer mint ∈ accepted_mints
+    Hop    { source: MintUrl, target: MintUrl },     // no overlap: melt at source, mint at target
+}
+```
+
+- **Overlap ⇒ `Direct`** and every downstream byte is what it is today. The tooth asserts on the
+  *decision* (`PayPlan::Direct`), per charter — not on the outcome.
+- **No overlap ⇒ `Hop`**, `target` = the first admissible entry of `accepted_mints` (seller's list
+  order is their preference; **deterministic**, because replay/pays-once depends on re-deriving the
+  same target).
+- **Realized mint** sealed into `terms.mint` = `Direct.mint` or `Hop.target`. That keeps
+  `wallet_open_mint_url` (`:462`) honest — after the hop the ecash *is* at `target`, so the send, the
+  attempt id, and the co-signed receipt all stay on one mint. One settlement shape on the wire.
+
+## Order of operations in `authorize_pay_async`
+
+Today: verify delivery (pre-budget) → `require_fee_safe_amount` → `gate.authorize_then_attempt(attempt_id, amount, effect)`.
+
+With a hop, the pre-budget region grows the *planning* (no money moves) and the effect grows the
+*hop execution* (money moves, after the durable append):
+
+1. verify delivery + bind-check — **unchanged**, pre-budget, zero spend on failure
+2. **plan** (pre-budget, no money moves, all reads timer-bounded/fail-closed):
+   a. `mint_quote(BOLT11, Some(offer.amount))` at **B** → `MintQuote.request` (bolt11) — amount pinned
+      to the buyer-signed offer, never a mint- or seller-supplied number
+   b. `melt_quote(BOLT11, bolt11)` at **A** → `amount`, `fee_reserve`
+   c. input fee at A via the existing bounded reader
+   d. `planned_cost = melt.amount + melt.fee_reserve + input_fee`
+3. `gate.authorize_then_attempt(attempt_id, planned_cost, effect)` — cap sees the whole hop
+   **before** any melt; refuse ⇒ zero money moved (the gate never calls `effect` on refuse)
+4. inside `effect`: journal the pairing → melt at A → mint at B → **existing send path from B, unchanged**
+
+`authorize_then_attempt` already gives us write-before-effect and cross-process `flock` (budget.rs
+`reserve`), so the hop inherits the TOCTOU closure rather than re-inventing it. On the `Direct` path
+we pass `amount` exactly as today — req 2 honoured, general fee-dust behaviour untouched.
+
+## The journal (only what cdk does not already know)
+
+cdk journals each half itself (`WalletSaga` + `used_by_operation` + quote rows). The one thing nothing
+in cdk knows is that the two quotes are **one logical hop**, so that is the entire journal payload,
+written **before** the melt:
+
+```
+(attempt_id, source_mint, melt_quote_id, target_mint, mint_quote_id, planned_cost)
+```
+
+Recovery then reads the pairing and asks cdk for each half by quote id:
+`check_melt_quote_status(melt_quote_id)` at A, `check_mint_quote_status(mint_quote_id)` /
+`amount_mintable()` at B. Decision table (agicash's, keyed by quote id, but with our
+write-before-effect ordering so the "initiated" flag can never be false while money is in flight):
+
+| melt @ A | mint @ B | action |
+|---|---|---|
+| Unpaid, journal present | — | melt never landed → safe to retry the melt (quote still Unpaid at the mint) |
+| Pending | — | money in flight → wait, timer-bounded; never re-melt |
+| Paid | not issued | **the strand** → mint at B (recoverable), and surface LOUD |
+| Paid | issued | complete → hand to send path; exactly-once |
+
+## Invariant → tooth map
+
+1. **Amount from the buyer-signed offer only** — step 2a pins `offer.amount`; nothing downstream can
+   rewrite it. Tooth: enumerate the entry points to the spend gate and show the hop adds none — the
+   hop's only new gate call passes `planned_cost` as the *cost*, while the *delivered* amount stays
+   `offer.amount`. Red-on-revert: make the mint amount a function of any mint/seller number → tooth bites.
+2. **Hop only when needed** — decision tooth on `PayPlan`, not the outcome: overlap ⇒ `Direct`.
+3. **Budget covers the WHOLE hop** — `planned_cost` includes melt amount + fee reserve + input fee,
+   charged before the melt. Strong-form bite: shrink the cap to just under `planned_cost` and assert
+   *no melt is attempted at all* (not merely that it fails afterwards).
+4. **Pays-once across the hop** — kill between melt and mint, restart, assert exactly-one payment
+   **and** the loud strand line; recovery runs on both wallets + the repo-wide mint-quote sweep.
+5. **Fail-closed, timer-bounded** — every mint touch through the bounded/fail-closed reader
+   (`BoundedFee::{Fee,Failed,Unreachable}`, `MINT_TOUCH_TIMEOUT`); any quote failure aborts before the
+   melt; no timer-less await anywhere on the hop.
+
+## Build environment (this workspace)
+
+Clone `/srv/forge/workspaces/mobee-crossmint`, branch `crossmint/hop` off `origin/dev` @ `7463cbe`.
+Toolchain is NOT on the default PATH — rust 1.95.0 + gcc-wrapper 15.2.0 from the nix store; edition
+2024 needs ≥1.85 so 1.95.0 is fine. `CARGO_TARGET_DIR=/srv/forge/workspaces/.crossmint-target`
+(separate, per the charter). Gate runner writes `<label>.log` + `<label>.rc` with no trailing
+pipeline, so pasted rcs are real rcs.
+
+⚠ Shell gotcha that already bit once: `cat` is aliased to `bat` here, so `$(cat file)` expands to
+**empty** silently — it filed issue #186 with an empty body before I caught it. Use `--body-file`,
+`command cat`, or `$(<file)`.
diff --git a/crates/mobee-core/src/crossmint.rs b/crates/mobee-core/src/crossmint.rs
new file mode 100644
index 00000000..2bc9ad81
--- /dev/null
+++ b/crates/mobee-core/src/crossmint.rs
@@ -0,0 +1,280 @@
+//! Cross-mint payment planning: which mint the buyer pays at, and whether reaching it needs a hop.
+//!
+//! A buyer funded only at mint A can pay a seller who accepts only mint B by hopping through
+//! Lightning *between the mints*: request a NUT-04 mint quote at B (yields a bolt11), NUT-05 melt from
+//! A to pay that invoice, receive fresh ecash at B, then hand it to the ordinary send path. Lightning
+//! is connective tissue between mints only — the wire keeps exactly one settlement shape, so
+//! pays-once, the co-signed receipt, and amount-from-the-buyer-signed-offer are untouched by it.
+//!
+//! This module holds only the DECISION (a pure function of the buyer's selected mint and the seller's
+//! accepted set). It moves no money and touches no network, so the decision is testable on its own —
+//! which matters, because "did we hop when we shouldn't have" is a question about the decision, not
+//! about the outcome.
+
+use std::str::FromStr;
+
+use cdk::mint_url::MintUrl;
+
+use crate::authorize_pay::AuthorizePayError;
+use crate::home;
+
+/// How the buyer reaches a mint the seller accepts.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PayPlan {
+    /// The buyer's own mint is already in the seller's accepted set — pay from it directly. No hop,
+    /// no Lightning, nothing added to the settlement path.
+    Direct {
+        /// The mint the buyer pays at.
+        mint: MintUrl,
+    },
+    /// No overlap: melt at the buyer's funded mint to pay a mint quote raised at the seller's mint,
+    /// leaving the buyer holding fresh ecash at `target`.
+    Hop {
+        /// The buyer's funded mint, whose proofs are melted.
+        source: MintUrl,
+        /// A mint from the seller's accepted set, where the fresh ecash lands and the send happens.
+        target: MintUrl,
+    },
+}
+
+impl PayPlan {
+    /// The mint the payment is realized at — where the ecash the seller receives lives, and therefore
+    /// the mint sealed into the payment terms, the attempt id, and the co-signed receipt.
+    ///
+    /// For a hop this is the TARGET, not the buyer's funded mint: after the hop the buyer holds ecash
+    /// at the target, and the send, the attempt id, and the receipt must all agree on that one mint.
+    pub fn realized_mint(&self) -> &MintUrl {
+        match self {
+            Self::Direct { mint } => mint,
+            Self::Hop { target, .. } => target,
+        }
+    }
+
+    /// The hop's source mint, or `None` on the direct path.
+    pub fn hop_source(&self) -> Option<&MintUrl> {
+        match self {
+            Self::Direct { .. } => None,
+            Self::Hop { source, .. } => Some(source),
+        }
+    }
+
+    /// Whether reaching the realized mint requires a hop.
+    pub fn is_hop(&self) -> bool {
+        matches!(self, Self::Hop { .. })
+    }
+}
+
+/// Decide how to pay: directly from the buyer's selected mint, or via a hop to one the seller accepts.
+///
+/// `buyer_selected_mint` is the mint frozen into the accept-bind (see `authorize_pay`), never the live
+/// config default — a config change between attempts must not shift the mint and mint a second attempt
+/// id.
+///
+/// Both the source and the target pass the real-mint fence. Fencing the target matters as much as the
+/// source: a hop ends with the buyer holding ecash at the target, so an unfenced target would let a
+/// real-sats mint in through the back door while `allow_real_mints` is off.
+///
+/// Target selection is the FIRST admissible entry of `accepted_mints` — the seller's list order is
+/// their preference. It must stay deterministic: the attempt id is derived from the realized mint, so
+/// a retry that re-derived a different target would compute a different attempt id and defeat
+/// pays-once.
+pub fn plan_payment(
+    buyer_selected_mint: &str,
+    accepted_mints: &[String],
+    allow_real_mints: bool,
+) -> Result<PayPlan, AuthorizePayError> {
+    if !home::mint_allowed(buyer_selected_mint, allow_real_mints) {
+        return Err(AuthorizePayError::Input(format!(
+            "real-mint fence: buyer mint {buyer_selected_mint} is not an allow-listed testnut/dev \
+             mint; set allow_real_mints=true to pay at a real mint"
+        )));
+    }
+    let buyer_mint = MintUrl::from_str(buyer_selected_mint)
+        .map_err(|error| AuthorizePayError::Input(format!("buyer mint url: {error}")))?;
+
+    // No accepted set to satisfy (legacy binds carry none) — the buyer's own mint stands.
+    if accepted_mints.is_empty() {
+        return Ok(PayPlan::Direct { mint: buyer_mint });
+    }
+
+    let listed = accepted_mints
+        .iter()
+        .map(|entry| MintUrl::from_str(entry))
+        .collect::<Result<Vec<_>, _>>()
+        .map_err(|error| AuthorizePayError::Input(format!("creq accepted mint url: {error}")))?;
+
+    if listed.contains(&buyer_mint) {
+        return Ok(PayPlan::Direct { mint: buyer_mint });
+    }
+
+    // No overlap. Hop to the first accepted mint that the fence admits; refuse fail-closed if none
+    // does, rather than hopping to a mint we are not permitted to hold ecash at.
+    let target = accepted_mints
+        .iter()
+        .zip(listed)
+        .find(|(raw, _)| home::mint_allowed(raw, allow_real_mints))
+        .map(|(_, parsed)| parsed);
+
+    match target {
+        Some(target) => Ok(PayPlan::Hop {
+            source: buyer_mint,
+            target,
+        }),
+        None => Err(AuthorizePayError::Input(format!(
+            "real-mint fence: buyer mint {buyer_mint} is not in the creq mint list \
+             {accepted_mints:?} and no accepted mint is an allow-listed testnut/dev mint, so the \
+             cross-mint hop has nowhere permitted to land; set allow_real_mints=true to pay at a \
+             real mint"
+        ))),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::home::DEFAULT_MINT_URL;
+
+    fn mint(url: &str) -> MintUrl {
+        MintUrl::from_str(url).expect("test mint url parses")
+    }
+
+    // Invariant 2 — the decision tooth. Overlap must NOT hop: the existing direct path stays exactly
+    // as it was. Asserted on the decision, not on a downstream outcome, because a hop that happened
+    // and then coincidentally produced the right amount would still be a bug.
+    #[test]
+    fn buyer_mint_in_accepted_set_pays_direct_without_hopping() {
+        let plan = plan_payment(DEFAULT_MINT_URL, &[DEFAULT_MINT_URL.to_owned()], false)
+            .expect("an accepted, fenced buyer mint plans");
+        assert_eq!(
+            plan,
+            PayPlan::Direct {
+                mint: mint(DEFAULT_MINT_URL)
+            }
+        );
+        assert!(!plan.is_hop(), "overlap must not hop");
+        assert_eq!(plan.hop_source(), None);
+        assert_eq!(plan.realized_mint(), &mint(DEFAULT_MINT_URL));
+    }
+
+    // Overlap anywhere in the list is still overlap, even when the buyer's mint is not first: the
+    // seller's preference order decides hop TARGETS, never whether to hop at all.
+    #[test]
+    fn buyer_mint_listed_but_not_first_still_pays_direct() {
+        let accepted = vec![
+            "https://b.example".to_owned(),
+            "https://a.example".to_owned(),
+        ];
+        let plan = plan_payment("https://a.example", &accepted, true).expect("listed mint plans");
+        assert_eq!(plan.is_hop(), false, "a listed buyer mint never hops");
+        assert_eq!(plan.realized_mint(), &mint("https://a.example"));
+    }
+
+    #[test]
+    fn no_overlap_plans_a_hop_from_the_buyer_mint_to_an_accepted_mint() {
+        let accepted = vec!["https://seller.example".to_owned()];
+        let plan =
+            plan_payment("https://buyer.example", &accepted, true).expect("a hop is plannable");
+        assert_eq!(
+            plan,
+            PayPlan::Hop {
+                source: mint("https://buyer.example"),
+                target: mint("https://seller.example"),
+            }
+        );
+        // The realized mint is the TARGET — that is where the seller's ecash ends up, so the terms,
+        // the attempt id and the receipt must bind it rather than the buyer's funded mint.
+        assert_eq!(plan.realized_mint(), &mint("https://seller.example"));
+        assert_eq!(plan.hop_source(), Some(&mint("https://buyer.example")));
+    }
+
+    // The attempt id is derived from the realized mint, so a retry must re-derive the SAME target or
+    // pays-once breaks. Pin determinism against a multi-entry list.
+    #[test]
+    fn hop_target_selection_is_deterministic_first_admissible() {
+        let accepted = vec![
+            "https://first.example".to_owned(),
+            "https://second.example".to_owned(),
+            "https://third.example".to_owned(),
+        ];
+        let first = plan_payment("https://buyer.example", &accepted, true).expect("plans");
+        for _ in 0..5 {
+            let again = plan_payment("https://buyer.example", &accepted, true).expect("plans");
+            assert_eq!(
+                again, first,
+                "target selection must not vary between attempts"
+            );
+        }
+        assert_eq!(first.realized_mint(), &mint("https://first.example"));
+    }
+
+    #[test]
+    fn empty_accepted_set_pays_direct_at_the_buyer_mint() {
+        let plan = plan_payment(DEFAULT_MINT_URL, &[], false).expect("legacy bind plans");
+        assert_eq!(
+            plan,
+            PayPlan::Direct {
+                mint: mint(DEFAULT_MINT_URL)
+            }
+        );
+    }
+
+    // The fence still refuses the buyer's own mint first, before any hop is considered.
+    #[test]
+    fn unfenced_buyer_mint_is_refused_before_planning_a_hop() {
+        let accepted = vec![DEFAULT_MINT_URL.to_owned()];
+        let error = plan_payment("https://real-mint.example", &accepted, false)
+            .expect_err("an unfenced buyer mint must refuse");
+        let rendered = error.to_string();
+        assert!(
+            rendered.contains("real-mint fence"),
+            "expected a fence refusal, got: {rendered}"
+        );
+    }
+
+    // A hop must not become a back door around the fence: with the switch off, an accepted mint that
+    // is not allow-listed is not a permitted place to land, so the plan refuses fail-closed.
+    #[test]
+    fn hop_refuses_when_no_accepted_mint_passes_the_fence() {
+        // Buyer sits on the one fenced mint; the seller accepts only an unfenced real mint.
+        let accepted = vec!["https://real-mint.example".to_owned()];
+        let error = plan_payment(DEFAULT_MINT_URL, &accepted, false)
+            .expect_err("an unfenced hop target must refuse");
+        let rendered = error.to_string();
+        assert!(
+            rendered.contains("real-mint fence"),
+            "expected a fence refusal, got: {rendered}"
+        );
+        assert!(
+            rendered.contains("nowhere permitted to land"),
+            "the refusal should say the hop had no permitted target, got: {rendered}"
+        );
+    }
+
+    // With the switch on, the same shape plans a hop — proving the previous refusal came from the
+    // fence and not from some unrelated rejection of the list.
+    #[test]
+    fn hop_to_a_real_mint_plans_once_the_operator_opts_in() {
+        let accepted = vec!["https://real-mint.example".to_owned()];
+        let plan = plan_payment(DEFAULT_MINT_URL, &accepted, true)
+            .expect("opted-in real mint is a permitted hop target");
+        assert_eq!(
+            plan,
+            PayPlan::Hop {
+                source: mint(DEFAULT_MINT_URL),
+                target: mint("https://real-mint.example"),
+            }
+        );
+    }
+
+    // Selection skips an unfenced entry rather than refusing outright when a later entry is fine.
+    #[test]
+    fn hop_skips_unfenced_entries_and_lands_on_the_first_admissible_one() {
+        let accepted = vec![
+            "http://not-https.example".to_owned(),
+            DEFAULT_MINT_URL.to_owned(),
+        ];
+        let plan = plan_payment("https://buyer.example", &accepted, true)
+            .expect("a later admissible entry is usable");
+        assert_eq!(plan.realized_mint(), &mint(DEFAULT_MINT_URL));
+    }
+}
diff --git a/crates/mobee-core/src/lib.rs b/crates/mobee-core/src/lib.rs
index 443a9cdd..04e1909f 100644
--- a/crates/mobee-core/src/lib.rs
+++ b/crates/mobee-core/src/lib.rs
@@ -9,6 +9,8 @@ pub mod job_lifecycle;
 #[cfg(all(feature = "wallet", feature = "gateway"))]
 pub mod profile;
 pub mod contribution;
+#[cfg(all(feature = "wallet", feature = "gateway"))]
+pub mod crossmint;
 pub mod delivery;
 #[cfg(feature = "git-delivery")]
 pub mod delivery_git;

From baf4e3cce4a5cc8f664b3b292fa951b638f4c236 Mon Sep 17 00:00:00 2001
From: worker-mobee-crossmint <orveth@agi.cash>
Date: Mon, 27 Jul 2026 12:28:23 -0700
Subject: [PATCH 2/9] crossmint: assert!(!is_hop()) instead of assert_eq!
 against a bool literal

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/mobee-core/src/crossmint.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/mobee-core/src/crossmint.rs b/crates/mobee-core/src/crossmint.rs
index 2bc9ad81..444debf5 100644
--- a/crates/mobee-core/src/crossmint.rs
+++ b/crates/mobee-core/src/crossmint.rs
@@ -165,7 +165,7 @@ mod tests {
             "https://a.example".to_owned(),
         ];
         let plan = plan_payment("https://a.example", &accepted, true).expect("listed mint plans");
-        assert_eq!(plan.is_hop(), false, "a listed buyer mint never hops");
+        assert!(!plan.is_hop(), "a listed buyer mint never hops");
         assert_eq!(plan.realized_mint(), &mint("https://a.example"));
     }
 

From ca09d0be850ea8bc5657be204dae8582f24771a6 Mon Sep 17 00:00:00 2001
From: worker-mobee-crossmint <orveth@agi.cash>
Date: Mon, 27 Jul 2026 12:30:36 -0700
Subject: [PATCH 3/9] =?UTF-8?q?crossmint:=20PR=20body=20draft=20=E2=80=94?=
 =?UTF-8?q?=20inv-1=20entry=20points=20incl.=20the=20new=20target-fence,?=
 =?UTF-8?q?=20gate-skew=20evidence?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 PR-BODY.md | 128 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 128 insertions(+)
 create mode 100644 PR-BODY.md

diff --git a/PR-BODY.md b/PR-BODY.md
new file mode 100644
index 00000000..363a87a2
--- /dev/null
+++ b/PR-BODY.md
@@ -0,0 +1,128 @@
+# Cross-mint payment: the buyer can pay a seller on a mint it holds no ecash at
+
+A buyer funded only at mint A can pay a seller who accepts only mint B. The buyer's own wallet does
+the hop: request a NUT-04 mint quote at **the seller's mint** (yields a bolt11) → NUT-05 **melt** from
+the buyer's funded mint to pay that invoice → receive fresh ecash at the seller's mint → hand it to the
+**existing, unchanged** send path.
+
+Lightning is connective tissue *between mints* only. The wire keeps exactly one settlement shape, so
+pays-once, the co-signed receipt, and amount-from-the-buyer-signed-offer are untouched.
+
+## The shape, and why it is not the obvious one
+
+agicash's `receive-cashu-token` solves the mirror problem — "fees eat the received amount" — with a
+bounded convergence loop: the token amount is fixed, so the **delivered** amount floats *down* until
+`melt.amount + fee_reserve` fits.
+
+Copying that direction here would break the strongest money invariant in the system. The amount is
+fixed by the **buyer-signed offer**, so delivery is pinned and the **buyer's cost** floats *up*
+instead:
+
+1. mint quote at **B** for exactly `offer.amount` → the bolt11
+2. melt quote at **A** for that bolt11 → `amount` + `fee_reserve`
+3. input fee at A (existing bounded, fail-closed reader)
+4. `planned_cost = melt.amount + melt.fee_reserve + input_fee`
+5. cap check on `planned_cost` **before** any melt — refuse ⇒ zero money moved
+6. journal the pairing, **then** melt at A → mint at B → existing send from B
+
+With delivery pinned, cost is a single forward computation and the convergence loop disappears. The
+amount the seller receives is never a function of a fee reading.
+
+## Invariant 1 — entry points to the spend gate
+
+The hop adds no path by which a seller- or mint-supplied number becomes the paid amount. The mint
+amount at B is `offer.amount`; every fee reading feeds `planned_cost` (what the *buyer* spends),
+never the delivered amount.
+
+The hop does, however, create **a new entry point to money**, found while building this slice and
+called out explicitly:
+
+- **The hop target mint.** A hop ends with the buyer holding ecash at the target. Fencing only the
+  buyer's source mint would therefore be a **real-mint back door with `allow_real_mints` off** — the
+  buyer could come to hold real-sats ecash at an unfenced mint that merely appeared in the seller's
+  accepted list. `plan_payment` fences **both** legs and refuses fail-closed ("nowhere permitted to
+  land") when no accepted mint is admissible.
+  Toothed by `hop_refuses_when_no_accepted_mint_passes_the_fence` and
+  `hop_skips_unfenced_entries_and_lands_on_the_first_admissible_one`; both confirmed to bite (below).
+
+## Recovery: the trap this design is built around
+
+`Wallet::recover_incomplete_sagas()` (cdk 0.17.2, `wallet/recovery.rs:302`) filters
+`saga.mint_url == self.mint_url && saga.unit == self.unit`. A hop has a **melt saga at A** and an
+**issue saga at B**, so recovery run on one wallet **silently skips** the other half — no error, just
+an unrecovered leg. Hop recovery therefore runs on **both** wallets, plus the repo-wide unissued-quote
+sweep, and a melted-at-A/unminted-at-B strand is surfaced **loud** rather than swept.
+
+cdk journals each half itself (`WalletSaga` carries `quote_id`, and `check_melt_quote_status(quote_id)`
+resumes off the persisted store from a cold process). The only thing cdk cannot know is that the two
+quotes are one logical hop, so that pairing — and nothing more — is what we journal, before the melt.
+
+## Deliberately not in this PR
+
+- **Fee-reserve reconciliation** → #186. The cap is charged the full `fee_reserve` before the melt; the
+  melt returns change worth `reserve − actual`, which is not credited back. The cap therefore
+  under-reports remaining allowance — the safe direction (refuses too early, never overspends). Netting
+  it would reshape `budget.rs`'s append-only fold, i.e. put a spend-gate change behind a feature review.
+  Marked `// interim:` at the charge site.
+- **The general fee-dust behaviour of `authorize_pay`** is untouched — that is #185 proper. The direct
+  path still charges `amount` exactly as before; only the hop path charges `planned_cost`.
+- **One mint list per side** → #187. Today `mint_allowed` admits exactly `DEFAULT_MINT_URL` when
+  `allow_real_mints` is off, so multi-mint is structurally unreachable in the safe posture, and
+  `extra_mints` is dead config the fence never consults.
+
+## Gate evidence — read this with eyes open
+
+The newest rust available on the build box is **1.95.0**; this repo is formatted and linted by a newer
+stable. Two of the charter's six gates therefore measure toolchain skew rather than this diff:
+
+- `cargo fmt --all -- --check` on the **pristine tip `7463cbe`, before any edit in this branch**:
+  **rc=1, 733 diffs**, in files this PR never opens.
+- `cargo clippy --no-default-features --features gateway,git-delivery,wallet --all-targets -- -D warnings`:
+  **57 errors across 20 files, all pre-existing** (authorize_pay, budget, buyer/*, gateway,
+  seller_node/*, wallet_ops, …). The run found exactly **one** lint in this PR's own file
+  (`assert_eq!` against a bool literal); it is fixed, taking the count 58 → 57.
+- This PR's own files are clean by both: `rustfmt --edition 2024 --check crossmint.rs` → **rc=0**, and
+  **0** clippy hits naming `crossmint.rs`.
+- **CI runs neither fmt nor clippy.** `.github/workflows/ci.yml` is build + test only, on
+  `dtolnay/rust-toolchain@stable`. The charter's fmt/clippy gates are stricter than CI.
+
+Per-file evidence was accepted for this slice specifically so a feature slice does not carry a
+fleet-wide toolchain change; the whole-tree question is tracked separately as a standing gate condition
+on this box.
+
+Note when reproducing: `rustfmt --check lib.rs` recurses the entire crate through `mod` declarations
+and will hand back the tip's 733 diffs — check the individual file.
+
+## Teeth
+
+Decision seam, 9 tests, all green. Both mutations were run **after** committing, and bite specifically
+rather than blanket:
+
+```
+clean:       test result: ok. 9 passed; 0 failed   (rc=0)
+
+mutation 1 — overlap no longer short-circuits to Direct        -> rc=101
+  buyer_mint_in_accepted_set_pays_direct_without_hopping ... FAILED
+  buyer_mint_listed_but_not_first_still_pays_direct ... FAILED
+  (the other 7 still ok)
+
+mutation 2 — hop-target fence dropped, .find(fenced) -> .next() -> rc=101
+  hop_refuses_when_no_accepted_mint_passes_the_fence ... FAILED
+  hop_skips_unfenced_entries_and_lands_on_the_first_admissible_one ... FAILED
+  (the other 7 still ok)
+```
+
+Invariant 2 is toothed on the **decision** (`PayPlan::Direct`), not on a downstream outcome — a hop
+that happened and then coincidentally produced the right amount would still be a bug.
+
+Also note a gate-hygiene trap worth not repeating: `cargo test -p mobee-core crossmint::` returns
+**rc=0 with zero tests run**, because `wallet`/`gateway` are not default features and the module is
+cfg-gated out. Assert the test **count**, not the rc. Correct invocation:
+`cargo test -p mobee-core --features wallet crossmint::`.
+
+## Live smoke
+
+Test ecash structurally cannot hop — fake mints cannot pay each other's invoices over real Lightning —
+so the live proof is a small **real-sats** cross-mint trade. That is a real-money spend and a
+money-gate config change, so it is gudnuf-gated and not executed as part of this PR. The smoke script
+is written to be ready-to-run the moment authorization arrives.

From 1d21f084023614c0d6f0c10cd4b240bd2d6766e6 Mon Sep 17 00:00:00 2001
From: worker-mobee-crossmint <orveth@agi.cash>
Date: Mon, 27 Jul 2026 12:32:08 -0700
Subject: [PATCH 4/9] crossmint: hop cost and the pairing journal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HopCost totals the three things the buyer pays to deliver offer.amount across a
hop — melt amount, Lightning fee reserve, and the source mint's input fee. All
three must clear the cap before the melt fires; a fee that reaches the wire
without passing the cap is the #185 class. The total is checked rather than
saturating: a cost we cannot add up is a cost we decline to spend.

HopJournal records the one fact cdk cannot know. cdk journals each half already
(a WalletSaga carries the quote id, and check_melt_quote_status resumes off the
persisted store from a cold process), but nothing in cdk knows the two quotes
are one logical hop. Written before the melt, matching the budget ledger's
write-before-effect discipline.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 crates/mobee-core/src/crossmint.rs | 123 +++++++++++++++++++++++++++++
 1 file changed, 123 insertions(+)

diff --git a/crates/mobee-core/src/crossmint.rs b/crates/mobee-core/src/crossmint.rs
index 444debf5..c50110d7 100644
--- a/crates/mobee-core/src/crossmint.rs
+++ b/crates/mobee-core/src/crossmint.rs
@@ -129,6 +129,67 @@ pub fn plan_payment(
     }
 }
 
+/// What the buyer spends to deliver `offer.amount` across a hop.
+///
+/// Three components, all of which the buyer pays and none of which reduce what the seller receives:
+/// the melt amount (which equals the invoice raised at the target), the Lightning fee reserve the
+/// source mint holds back, and the source mint's input fee for spending the proofs. All three must be
+/// covered by the budget cap BEFORE the melt fires — a fee that reaches the wire without passing the
+/// cap is the #185 class of defect.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct HopCost {
+    /// Amount the source mint melts, per its melt quote.
+    pub melt_amount: u64,
+    /// Lightning fee reserve held back by the source mint (`MeltQuote::fee_reserve`).
+    pub fee_reserve: u64,
+    /// Source-mint input fee for spending the proofs that fund the melt.
+    pub input_fee: u64,
+}
+
+impl HopCost {
+    /// Total the cap must cover before any melt.
+    ///
+    /// Checked, and refuses on overflow rather than saturating: a saturated total would still refuse
+    /// at the cap today, but it would do so by arriving at a number nobody computed. A cost we cannot
+    /// add up is a cost we decline to spend.
+    pub fn planned_cost(&self) -> Result<u64, AuthorizePayError> {
+        self.melt_amount
+            .checked_add(self.fee_reserve)
+            .and_then(|subtotal| subtotal.checked_add(self.input_fee))
+            .ok_or_else(|| {
+                AuthorizePayError::Input(format!(
+                    "cross-mint hop cost overflows u64: melt_amount={} fee_reserve={} input_fee={}",
+                    self.melt_amount, self.fee_reserve, self.input_fee
+                ))
+            })
+    }
+}
+
+/// The pairing record written before the melt fires.
+///
+/// cdk already journals each half of the hop on its own (a `WalletSaga` carries the quote id, and
+/// `check_melt_quote_status` resumes off the persisted store from a cold process). The one thing
+/// nothing in cdk knows is that these two quotes are **one logical hop** — so that, and nothing more,
+/// is what we persist. Written before the melt (write-before-effect), which is the same discipline the
+/// budget ledger already uses, and stronger than marking the melt "initiated" reactively once the mint
+/// reports it pending — that ordering leaves a window where money is in flight and the flag says
+/// otherwise.
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+pub struct HopJournal {
+    /// The pay attempt this hop funds; ties the hop to the budget ledger's idempotence key.
+    pub attempt_id: String,
+    /// Mint whose proofs are melted.
+    pub source_mint: String,
+    /// Melt quote id at the source mint — the handle recovery uses to ask "did this melt land?".
+    pub melt_quote_id: String,
+    /// Mint where the fresh ecash lands.
+    pub target_mint: String,
+    /// Mint quote id at the target mint — the handle recovery uses to detect a paid-but-unissued strand.
+    pub mint_quote_id: String,
+    /// Cost charged against the cap before the melt.
+    pub planned_cost: u64,
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -266,6 +327,68 @@ mod tests {
         );
     }
 
+    // Invariant 3 — the cap must see the WHOLE hop. The failure this guards is #185's shape: a fee
+    // that reaches the wire without passing the cap. Asserted as "all three components are in the
+    // total", so dropping any one of them bites.
+    #[test]
+    fn planned_cost_counts_melt_amount_fee_reserve_and_input_fee() {
+        let cost = HopCost {
+            melt_amount: 100,
+            fee_reserve: 7,
+            input_fee: 2,
+        };
+        assert_eq!(cost.planned_cost().expect("sums"), 109);
+
+        // Each component individually moves the total — none is silently dropped.
+        let no_reserve = HopCost {
+            fee_reserve: 0,
+            ..cost
+        };
+        let no_input_fee = HopCost {
+            input_fee: 0,
+            ..cost
+        };
+        assert_eq!(no_reserve.planned_cost().expect("sums"), 102);
+        assert_eq!(no_input_fee.planned_cost().expect("sums"), 107);
+    }
+
+    // A cost we cannot add up is a cost we decline to spend: overflow refuses rather than saturating
+    // into a number nobody computed.
+    #[test]
+    fn planned_cost_refuses_on_overflow_instead_of_saturating() {
+        let cost = HopCost {
+            melt_amount: u64::MAX,
+            fee_reserve: 1,
+            input_fee: 0,
+        };
+        let error = cost
+            .planned_cost()
+            .expect_err("an unrepresentable total must refuse");
+        assert!(
+            error.to_string().contains("overflows"),
+            "expected an overflow refusal, got: {error}"
+        );
+    }
+
+    // The journal's whole job is to record that two quotes are ONE hop, so both ids must survive a
+    // round trip — recovery reads this to ask each mint about its half.
+    #[test]
+    fn hop_journal_round_trips_both_quote_ids() {
+        let journal = HopJournal {
+            attempt_id: "attempt-1".to_owned(),
+            source_mint: "https://a.example".to_owned(),
+            melt_quote_id: "melt-quote-1".to_owned(),
+            target_mint: "https://b.example".to_owned(),
+            mint_quote_id: "mint-quote-1".to_owned(),
+            planned_cost: 109,
+        };
+        let encoded = serde_json::to_string(&journal).expect("journal serializes");
+        let decoded: HopJournal = serde_json::from_str(&encoded).expect("journal deserializes");
+        assert_eq!(decoded, journal);
+        assert_eq!(decoded.melt_quote_id, "melt-quote-1");
+        assert_eq!(decoded.mint_quote_id, "mint-quote-1");
+    }
+
     // Selection skips an unfenced entry rather than refusing outright when a later entry is fine.
     #[test]
     fn hop_skips_unfenced_entries_and_lands_on_the_first_admissible_one() {

From bb09d6cda1c5c59b4a6b5fea5436f5b8ed7d4568 Mon Sep 17 00:00:00 2001
From: orveth <orveth@proton.me>
Date: Mon, 27 Jul 2026 13:05:36 -0700
Subject: [PATCH 5/9] crossmint: hop execution, and the three seams that decide
 it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The decision half planned a hop; this half carries one out. A melt at the
buyer's funded mint pays a mint quote raised at the seller's, and the ordinary
send path takes over from there unchanged.

`crossmint_hop` owns the execution. Its whole reason for existing is the crash
window: cdk persists each leg on its own, but nothing in cdk knows the two
quotes are one hop, so that pairing is journalled before the melt and the
persisted quote ids win over any freshly planned ones. The resume decision is
taken from what the mints say, never inferred — unpaid melts, pending refuses,
paid-but-unissued is the strand and says so on stderr, paid-and-issued
completes without touching either mint.

Payment planning replaces the old realized-mint resolver at all three of its
callers, which is what makes the hop reachable at all: accept refused a
no-overlap claim before the pay path ever saw it, and the award filter skipped
those claims earlier still. `mint_unreachable_pay` is therefore unreachable on
the pay path; the target fence is the refusal that covers it, and the tests
that asserted the old refusal now pin the boundary between hopping and
refusing from both sides.

The accept-bind still seals the buyer's own funded mint. Sealing the hop target
instead would re-plan at pay time as a direct payment from a mint the buyer
holds nothing at; the target is re-derived from the seal plus the accepted set
frozen beside it, so the attempt id stays stable without storing it twice.

A hop the source wallet cannot fund refuses while planning, before the cap is
charged — declining a claim must not cost budget.
---
 crates/mobee-core/src/authorize_pay.rs   |  258 +++--
 crates/mobee-core/src/buyer/lifecycle.rs |   11 +-
 crates/mobee-core/src/crossmint.rs       |   51 +
 crates/mobee-core/src/crossmint_hop.rs   | 1101 ++++++++++++++++++++++
 crates/mobee-core/src/job_lifecycle.rs   |   40 +-
 crates/mobee-core/src/lib.rs             |    2 +
 crates/mobee-core/src/payment_wallet.rs  |   18 +
 crates/mobee-core/src/wallet_ops.rs      |    4 +-
 8 files changed, 1379 insertions(+), 106 deletions(-)
 create mode 100644 crates/mobee-core/src/crossmint_hop.rs

diff --git a/crates/mobee-core/src/authorize_pay.rs b/crates/mobee-core/src/authorize_pay.rs
index 8c18b906..b770feed 100644
--- a/crates/mobee-core/src/authorize_pay.rs
+++ b/crates/mobee-core/src/authorize_pay.rs
@@ -7,7 +7,7 @@
 use std::fmt;
 use std::str::FromStr;
 
-use cashu::{Amount, CurrencyUnit, MintUrl, PublicKey as CashuPublicKey};
+use cashu::{Amount, CurrencyUnit, PublicKey as CashuPublicKey};
 use nostr_sdk::secp256k1::{Message, Secp256k1};
 use nostr_sdk::Keys;
 use nostr_sdk::PublicKey as NostrPublicKey;
@@ -15,6 +15,7 @@ use nostr_sdk::Timestamp;
 
 use crate::budget::{BudgetGate, BudgetRefuse};
 use crate::buyer_fund::{self, FundError};
+use crate::crossmint_hop::{self, CdkHopEffects, FsHopJournal, HopError};
 use crate::delivery::{CommitOid, DeliveryError, GitDelivery};
 use crate::delivery_git::PayPathDeliveryVerifier;
 use crate::gateway;
@@ -108,7 +109,12 @@ pub struct ContributionPayBinds {
 pub struct AuthorizePayOutcome {
     pub state: PaymentState,
     pub attempt_id: String,
+    /// What the seller received — the buyer-signed offer amount.
     pub amount_sats: u64,
+    /// What the budget cap was charged. Equals `amount_sats` on the direct path; a cross-mint hop
+    /// costs the buyer the Lightning fee reserve and the source mint's input fee on top, so the two
+    /// differ and the gap is the hop's cost rather than anything the seller was paid.
+    pub charged_sats: u64,
     pub spent_total_sats: u64,
     pub remaining_sats: u64,
 }
@@ -119,6 +125,9 @@ pub enum AuthorizePayError {
     Budget(BudgetRefuse),
     Fund(FundError),
     Delivery(DeliveryError),
+    /// A cross-mint hop refused. Every variant is fail-closed; the pays-once cases name the quote
+    /// ids so an operator can ask the mints directly.
+    Hop(HopError),
     Payment(PaymentError),
     Wallet(PaymentWalletError),
     Home(String),
@@ -135,6 +144,7 @@ impl fmt::Display for AuthorizePayError {
             Self::Budget(refuse) => write!(formatter, "{refuse}"),
             Self::Fund(error) => write!(formatter, "{error}"),
             Self::Delivery(error) => write!(formatter, "authorize_pay delivery: {error}"),
+            Self::Hop(error) => write!(formatter, "authorize_pay: {error}"),
             Self::Payment(error) => write!(formatter, "authorize_pay payment: {error}"),
             Self::Wallet(error) => write!(formatter, "authorize_pay wallet: {error}"),
             Self::CosigRefused(message) => write!(formatter, "authorize_pay payment: {message}"),
@@ -176,6 +186,12 @@ impl From<PaymentWalletError> for AuthorizePayError {
     }
 }
 
+impl From<HopError> for AuthorizePayError {
+    fn from(value: HopError) -> Self {
+        Self::Hop(value)
+    }
+}
+
 /// Authorize spend under [`BudgetGate`], then pay only through [`PaymentService::run`] with a
 /// [`PayPathDeliveryVerifier`]. Async — every caller is already on a Tokio runtime (MCP dispatch).
 ///
@@ -245,13 +261,18 @@ pub async fn authorize_pay_async(
         .realized_mint
         .as_deref()
         .unwrap_or_else(|| home.config.default_mint());
-    let mint = resolve_realized_mint(
+    // A buyer funded only at mints the seller does not accept still has a way through: melt at a
+    // funded mint to pay a mint quote raised at one the seller does accept, and pay from there. The
+    // plan decides which of those two shapes this payment is; the realized mint is where the ecash
+    // the seller receives ends up, so for a hop it is the TARGET, and the terms, the attempt id and
+    // the receipt all bind that one mint exactly as they do on the direct path.
+    let plan = crate::crossmint::plan_payment(
         buyer_selected_mint,
         &request.accepted_mints,
         home.config.allow_real_mints,
     )?;
     let terms = PaymentTerms::new(
-        mint,
+        plan.realized_mint().clone(),
         Amount::from(request.amount_sats),
         CurrencyUnit::Sat,
         seller_nostr,
@@ -378,6 +399,33 @@ pub async fn authorize_pay_async(
     crate::payment::verify_pay_path_delivery(&mut verifier, &delivery, &key)
         .map_err(AuthorizePayError::Payment)?;
 
+    let amount = request.amount_sats;
+    // Cross-mint hop planning. Pre-budget and pre-spend: raising quotes moves no money, so a hop
+    // that cannot be priced refuses having spent nothing. Delivery is PINNED here — the quote at the
+    // seller's mint is raised for exactly `amount`, the buyer-signed offer amount — and the buyer's
+    // COST is what floats, which is why no fee reading can reduce what the seller receives.
+    let mut hop = match plan.hop_source() {
+        None => None,
+        Some(source) => {
+            let store = FsHopJournal::new(home.root.join("crossmint-journal"));
+            let effects =
+                CdkHopEffects::open(
+                    home,
+                    &source.to_string(),
+                    &wallet_open_mint_url(home, &terms),
+                )
+                .await?;
+            // A pairing already on disk WINS over freshly raised quotes. This attempt may have
+            // melted on an earlier run, and a second melt quote for one attempt id is precisely the
+            // double-pay the hop journal exists to prevent.
+            let pairing = match crossmint_hop::journalled_pairing(&store, attempt_id.as_str())? {
+                Some(existing) => existing,
+                None => effects.plan_quotes(attempt_id.as_str(), amount).await?,
+            };
+            Some((store, effects, pairing))
+        }
+    };
+
     let wallet = buyer_fund::open_wallet_at_mint_async(home, &wallet_open_mint_url(home, &terms))
         .await?;
     // Dust guard (live keyset N=1 floor, fail-closed). lock_or_reconcile re-checks
@@ -409,17 +457,35 @@ pub async fn authorize_pay_async(
         .map_err(|error| AuthorizePayError::Home(format!("payment journal dir: {error}")))?;
     let journal = FsPaymentJournal::new(journal_dir.join(format!("{}.jsonl", attempt_id.as_str())));
 
-    let amount = request.amount_sats;
+    // What the cap is asked to cover. On the direct path that is the amount, exactly as before —
+    // general fee-dust behaviour is a separate question and stays untouched here. A hop costs the
+    // buyer more than it delivers, and every sat of that difference must pass the cap BEFORE the
+    // melt, so the hop is charged its planned cost: melt amount + the source mint's Lightning fee
+    // reserve + its input fee.
+    //
+    // interim: the fee reserve is charged in full rather than reconciled against the fee actually
+    // paid, so a hop can leave the cap reporting less remaining budget than the buyer really spent.
+    // That is the safe direction; reconciling reserve-versus-actual would reshape the spend ledger,
+    // which is money-gate machinery and its own slice — see MakePrisms/mobee#186.
+    let charged = match hop.as_ref() {
+        Some((_, _, pairing)) => pairing.planned_cost,
+        None => amount,
+    };
     // Delivery already verified + bind-checked above (pre-budget). The budget append happens here,
-    // before the wallet send inside `run_verified`.
-    let state = gate.authorize_then_attempt(attempt_id.as_str(), amount, || {
-        PaymentService::new(&journal).run_verified(&key, &terms, &authority, &mut effects)
+    // before any melt and before the wallet send inside `run_verified`.
+    let state = gate.authorize_then_attempt(attempt_id.as_str(), charged, || {
+        if let Some((store, hop_effects, pairing)) = hop.as_mut() {
+            crossmint_hop::run_hop(store, hop_effects, pairing)?;
+        }
+        let state = PaymentService::new(&journal).run_verified(&key, &terms, &authority, &mut effects)?;
+        Ok::<_, AuthorizePayError>(state)
     })??;
 
     Ok(AuthorizePayOutcome {
         state,
         attempt_id: attempt_id.as_str().to_owned(),
         amount_sats: amount,
+        charged_sats: charged,
         spent_total_sats: gate.spent(),
         remaining_sats: gate.remaining(),
     })
@@ -438,27 +504,15 @@ fn contribution_policy(home: &MobeeHome) -> crate::contribution::ContentPolicy {
     }
 }
 
-/// Buyer mint selection for the pay path, config-driven.
-///
-/// `buyer_mint_url` is the mint the buyer's wallet spends from — the home config's default mint
-/// ([`crate::home::MobeeConfig::default_mint`]), the SAME source `buyer_fund` opens the wallet at.
-/// The buyer pays from a mint it holds balance at that the seller listed in its `creq` `m` array;
-/// since the buyer wallet is single-mint, that reduces to: is the buyer's configured mint listed?
-///
-/// - **empty creq list (no creq):** pay from the buyer's configured mint.
-/// - **configured mint listed:** pay directly from it (the direct path).
-/// - **configured mint NOT listed:** the single-mint buyer wallet holds no balance at any mint the
-///   seller listed, so it cannot pay this claim and refuses `mint_unreachable_pay`; no funds move,
-///   no binding is committed.
 /// The mint URL the pay path opens the buyer wallet at: the FROZEN realized mint sealed into the
 /// payment terms (`terms.mint`), NEVER `home.config.default_mint()`. The realized mint is already
-/// resolved from the sealed accept-bind ([`resolve_realized_mint`]) and bound into `terms`; opening
-/// the wallet at the live config default instead would, after accept seals mint A and the buyer
-/// flips its config default to B, bind the wallet to B while the attempt id + send target A — the
-/// budget is appended, then the send refuses on mint mismatch and strands the reservation. Taking
-/// the mint from the sealed terms keeps the wallet, the attempt id, and the send all on one mint.
-/// `home` is passed so the already-fenced invariant is asserted at this seam (the realized mint was
-/// fenced by `resolve_realized_mint`; `open_wallet_at_mint_async` re-checks, redundant-safe).
+/// planned from the sealed accept-bind ([`crate::crossmint::plan_payment`]) and bound into `terms`;
+/// opening the wallet at the live config default instead would, after accept seals mint A and the
+/// buyer flips its config default to B, bind the wallet to B while the attempt id + send target A —
+/// the budget is appended, then the send refuses on mint mismatch and strands the reservation.
+/// Taking the mint from the sealed terms keeps the wallet, the attempt id, and the send all on one
+/// mint. `home` is passed so the already-fenced invariant is asserted at this seam (the realized
+/// mint was fenced while planning; `open_wallet_at_mint_async` re-checks, redundant-safe).
 pub(crate) fn wallet_open_mint_url(home: &MobeeHome, terms: &PaymentTerms) -> String {
     let mint_url = terms.mint.to_string();
     debug_assert!(
@@ -468,41 +522,6 @@ pub(crate) fn wallet_open_mint_url(home: &MobeeHome, terms: &PaymentTerms) -> St
     mint_url
 }
 
-pub(crate) fn resolve_realized_mint(
-    buyer_mint_url: &str,
-    accepted_mints: &[String],
-    allow_real_mints: bool,
-) -> Result<MintUrl, AuthorizePayError> {
-    // Real-mint fence: the buyer's own paying mint must be admissible under the flag.
-    // Default (`allow_real_mints=false`) admits only the testnut/dev allow-list; a real mint is
-    // refused fail-closed before any spend unless the operator opts in.
-    if !crate::home::mint_allowed(buyer_mint_url, allow_real_mints) {
-        return Err(AuthorizePayError::Input(format!(
-            "real-mint fence: buyer mint {buyer_mint_url} is not an allow-listed testnut/dev mint; \
-             set allow_real_mints=true to pay at a real mint"
-        )));
-    }
-    let buyer_mint = MintUrl::from_str(buyer_mint_url)
-        .map_err(|error| AuthorizePayError::Input(format!("buyer mint url: {error}")))?;
-    if accepted_mints.is_empty() {
-        return Ok(buyer_mint);
-    }
-    let listed = accepted_mints
-        .iter()
-        .map(|entry| MintUrl::from_str(entry))
-        .collect::<Result<Vec<_>, _>>()
-        .map_err(|error| {
-            AuthorizePayError::Input(format!("creq accepted mint url: {error}"))
-        })?;
-    if listed.contains(&buyer_mint) {
-        return Ok(buyer_mint);
-    }
-    Err(AuthorizePayError::Wallet(PaymentWalletError::Wallet(format!(
-        "mint_unreachable_pay: buyer mint {buyer_mint} is not in the creq mint list {listed:?}; \
-         the single-mint buyer wallet holds no balance at any accepted mint"
-    ))))
-}
-
 /// Render a co-signed [`ReceiptPreimage`] as a single-line diagnostic: the digest plus every
 /// covered field. EVERY field here is public trade data already on the relay (offer/claim/result/
 /// receipt tags) — a `ReceiptPreimage` never holds a secret key or proof/token material — so this
@@ -766,6 +785,8 @@ fn publish_receipt_event(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use cashu::MintUrl;
+
     use crate::budget::BudgetGate;
     use crate::home::{self, DEFAULT_MINT_URL};
 
@@ -773,17 +794,21 @@ mod tests {
     const REAL_MINT: &str = "https://minibits.example";
 
     // Empty creq list → pay from the buyer's configured mint (config-driven).
-    // Default flag (false): the configured testnut/dev mint resolves.
+    // Default flag (false): the configured testnut/dev mint plans a direct payment.
     #[test]
-    fn resolve_realized_mint_empty_creq_uses_configured_mint() {
-        let mint = resolve_realized_mint(DEFAULT_MINT_URL, &[], false).unwrap();
-        assert_eq!(mint, MintUrl::from_str(DEFAULT_MINT_URL).unwrap());
+    fn pay_plan_empty_creq_uses_configured_mint() {
+        let plan = crate::crossmint::plan_payment(DEFAULT_MINT_URL, &[], false).unwrap();
+        assert!(!plan.is_hop());
+        assert_eq!(
+            plan.realized_mint(),
+            &MintUrl::from_str(DEFAULT_MINT_URL).unwrap()
+        );
     }
 
     // Direct path: the buyer's configured mint is one the seller listed → pay from it directly.
     #[test]
-    fn resolve_realized_mint_direct_when_configured_mint_is_listed() {
-        let mint = resolve_realized_mint(
+    fn pay_plan_is_direct_when_configured_mint_is_listed() {
+        let plan = crate::crossmint::plan_payment(
             DEFAULT_MINT_URL,
             &[
                 "https://other.example".to_string(),
@@ -792,41 +817,99 @@ mod tests {
             false,
         )
         .unwrap();
-        assert_eq!(mint, MintUrl::from_str(DEFAULT_MINT_URL).unwrap());
+        assert!(!plan.is_hop(), "overlap must not hop");
+        assert_eq!(
+            plan.realized_mint(),
+            &MintUrl::from_str(DEFAULT_MINT_URL).unwrap()
+        );
     }
 
-    // Configured mint NOT in the creq list → refuse `mint_unreachable_pay` fail-closed (no spend).
+    // The boundary, half one. A configured mint outside the creq list used to be the end of the
+    // road for this claim; it is now a hop to a mint the seller does accept.
+    //
+    // `allow_real_mints` is on because it has to be: with the flag off the fence admits exactly one
+    // mint (the testnut default), so a buyer and a seller can never be at two DIFFERENT admissible
+    // mints and a hop is structurally unreachable in the default posture. The flag is what makes
+    // two distinct admissible mints possible at all.
     #[test]
-    fn resolve_realized_mint_refuses_when_configured_mint_not_listed() {
-        let error = resolve_realized_mint(
-            DEFAULT_MINT_URL,
-            &["https://other.example".to_string()],
+    fn pay_plan_hops_when_the_configured_mint_is_not_listed_but_the_target_is_admissible() {
+        let plan = crate::crossmint::plan_payment(
+            "https://buyer-only.example",
+            &[DEFAULT_MINT_URL.to_string()],
+            true,
+        )
+        .unwrap();
+        assert!(plan.is_hop(), "no overlap must plan a hop, not refuse");
+        assert_eq!(
+            plan.hop_source(),
+            Some(&MintUrl::from_str("https://buyer-only.example").unwrap())
+        );
+        assert_eq!(
+            plan.realized_mint(),
+            &MintUrl::from_str(DEFAULT_MINT_URL).unwrap()
+        );
+    }
+
+    // The same no-overlap shape under the DEFAULT posture refuses, because the buyer's own mint is
+    // not admissible there — the fence stops it before a target is even considered. Together with
+    // the two tests around it this pins the whole boundary: a hop needs the operator's opt-in AND an
+    // admissible landing, and the fence refuses first when either is missing.
+    #[test]
+    fn pay_plan_refuses_a_no_overlap_hop_under_the_default_posture() {
+        let error = crate::crossmint::plan_payment(
+            "https://buyer-only.example",
+            &[DEFAULT_MINT_URL.to_string()],
             false,
         )
         .unwrap_err();
-        assert!(matches!(error, AuthorizePayError::Wallet(_)));
-        assert!(error.to_string().contains("mint_unreachable_pay"));
+        assert!(error.to_string().contains("real-mint fence"), "got: {error}");
+    }
+
+    // The boundary, half two. No overlap AND no admissible landing still refuses fail-closed — the
+    // target fence is the refusal that now covers what the old membership check covered. This pair
+    // pins exactly where "hop" ends and "refuse" begins.
+    #[test]
+    fn pay_plan_refuses_when_no_overlap_and_no_accepted_mint_is_admissible() {
+        let error =
+            crate::crossmint::plan_payment(DEFAULT_MINT_URL, &[REAL_MINT.to_string()], false)
+                .unwrap_err();
+        assert!(matches!(error, AuthorizePayError::Input(_)));
+        let rendered = error.to_string();
+        assert!(rendered.contains("real-mint fence"), "got: {rendered}");
+        assert!(
+            rendered.contains("nowhere permitted to land"),
+            "got: {rendered}"
+        );
     }
 
     // Real-mint switch: a buyer configured at a real mint X is REFUSED by the fence when
     // `allow_real_mints` is false (default safety posture)...
     #[test]
-    fn resolve_realized_mint_real_mint_refused_by_default() {
-        let error = resolve_realized_mint(REAL_MINT, &[REAL_MINT.to_string()], false).unwrap_err();
+    fn pay_plan_real_mint_refused_by_default() {
+        let error = crate::crossmint::plan_payment(REAL_MINT, &[REAL_MINT.to_string()], false)
+            .unwrap_err();
         assert!(matches!(error, AuthorizePayError::Input(_)));
         assert!(error.to_string().contains("real-mint fence"));
     }
 
     // ...and ADMITTED (pays at X when the creq lists X) once the operator opts in with the flag.
     #[test]
-    fn resolve_realized_mint_real_mint_admitted_when_flag_true() {
-        let paid = resolve_realized_mint(REAL_MINT, &[REAL_MINT.to_string()], true).unwrap();
-        assert_eq!(paid, MintUrl::from_str(REAL_MINT).unwrap());
-
-        // Even with the flag on, a mint the creq did NOT list still refuses (membership unchanged).
-        let refused =
-            resolve_realized_mint(REAL_MINT, &[DEFAULT_MINT_URL.to_string()], true).unwrap_err();
-        assert!(refused.to_string().contains("mint_unreachable_pay"));
+    fn pay_plan_real_mint_admitted_when_flag_true() {
+        let plan = crate::crossmint::plan_payment(REAL_MINT, &[REAL_MINT.to_string()], true)
+            .unwrap();
+        assert!(!plan.is_hop());
+        assert_eq!(plan.realized_mint(), &MintUrl::from_str(REAL_MINT).unwrap());
+
+        // With the flag on, a creq that lists a DIFFERENT admissible mint is now reachable by hop
+        // rather than refused for non-membership.
+        let hopped =
+            crate::crossmint::plan_payment(REAL_MINT, &[DEFAULT_MINT_URL.to_string()], true)
+                .unwrap();
+        assert!(hopped.is_hop());
+        assert_eq!(
+            hopped.realized_mint(),
+            &MintUrl::from_str(DEFAULT_MINT_URL).unwrap()
+        );
     }
 
     // Build a current-thread runtime and block on `authorize_pay_async` — the pattern the MCP
@@ -1116,7 +1199,10 @@ mod tests {
         // a legacy bind (`None`) falls back to the live config default.
         let select = |sealed: Option<&str>, config_default: &str| {
             let chosen = sealed.unwrap_or(config_default);
-            resolve_realized_mint(chosen, &accepted, true).expect("resolve")
+            crate::crossmint::plan_payment(chosen, &accepted, true)
+                .expect("plans")
+                .realized_mint()
+                .clone()
         };
 
         // SEALED bind (realized_mint = Some(m1)): the first attempt runs with config default m1, then
diff --git a/crates/mobee-core/src/buyer/lifecycle.rs b/crates/mobee-core/src/buyer/lifecycle.rs
index d766dcd9..549bc0bc 100644
--- a/crates/mobee-core/src/buyer/lifecycle.rs
+++ b/crates/mobee-core/src/buyer/lifecycle.rs
@@ -17,7 +17,7 @@ use std::future::Future;
 
 use cashu::{Amount, CurrencyUnit};
 
-use crate::authorize_pay::resolve_realized_mint;
+use crate::crossmint::plan_payment;
 use crate::job_lifecycle::{AwardClaimOutcome, JobLifecycleError, JobView};
 
 use super::reservations::{Converted, JobDisposition, ReservationState, ReserveRefused};
@@ -139,11 +139,12 @@ fn claim_is_payable(job_id: &str, creq: Option<&str>, filters: &AwardFilters) ->
     if filters.offer_amount_sats > filters.max_sats {
         return false;
     }
-    // Mint compatibility: the buyer's single-mint wallet must be able to settle at a mint the
-    // seller listed. This is the SAME resolution the pay path performs, so a claim that passes
-    // here is one the buyer can actually pay.
+    // Mint compatibility: the buyer must have a route to a mint the seller listed — paying from its
+    // own mint when the seller accepts it, otherwise hopping to one that the seller accepts and the
+    // fence admits. This is the SAME planning the pay path performs, so a claim that passes here is
+    // one the buyer can actually pay, by whichever of those two routes.
     let listed: Vec<String> = request.mints.iter().map(|mint| mint.to_string()).collect();
-    resolve_realized_mint(filters.buyer_mint, &listed, filters.allow_real_mints).is_ok()
+    plan_payment(filters.buyer_mint, &listed, filters.allow_real_mints).is_ok()
 }
 
 /// Failure of [`award_with_reservation`].
diff --git a/crates/mobee-core/src/crossmint.rs b/crates/mobee-core/src/crossmint.rs
index c50110d7..aa5b1a96 100644
--- a/crates/mobee-core/src/crossmint.rs
+++ b/crates/mobee-core/src/crossmint.rs
@@ -50,6 +50,19 @@ impl PayPlan {
         }
     }
 
+    /// The buyer's own funded mint — where the proofs being spent live, on either path.
+    ///
+    /// This is the SELECTION the accept-bind freezes. Freezing the selection rather than the
+    /// realized mint is what keeps the hop reachable: the realized mint of a hop is already in the
+    /// seller's accepted set, so a bind that sealed it would re-plan at pay time as a direct payment
+    /// from a mint the buyer holds nothing at.
+    pub fn source_mint(&self) -> &MintUrl {
+        match self {
+            Self::Direct { mint } => mint,
+            Self::Hop { source, .. } => source,
+        }
+    }
+
     /// The hop's source mint, or `None` on the direct path.
     pub fn hop_source(&self) -> Option<&MintUrl> {
         match self {
@@ -186,6 +199,10 @@ pub struct HopJournal {
     pub target_mint: String,
     /// Mint quote id at the target mint — the handle recovery uses to detect a paid-but-unissued strand.
     pub mint_quote_id: String,
+    /// What the seller receives: the amount pinned by the buyer-signed offer. Journalled so a
+    /// recovering process knows what to expect at the target without re-reading it from anywhere
+    /// that could have changed since the offer was signed.
+    pub delivered_sats: u64,
     /// Cost charged against the cap before the melt.
     pub planned_cost: u64,
 }
@@ -246,6 +263,35 @@ mod tests {
         // the attempt id and the receipt must bind it rather than the buyer's funded mint.
         assert_eq!(plan.realized_mint(), &mint("https://seller.example"));
         assert_eq!(plan.hop_source(), Some(&mint("https://buyer.example")));
+        // The source is the buyer's own mint on either path — that is what the accept-bind seals.
+        assert_eq!(plan.source_mint(), &mint("https://buyer.example"));
+    }
+
+    // What the accept-bind seals must re-plan into the SAME payment. Sealing the realized mint
+    // instead would make a hop re-plan as a direct payment from a mint the buyer holds nothing at,
+    // which is how a hop ships dead.
+    #[test]
+    fn the_sealed_source_replans_into_the_same_plan() {
+        let accepted = vec![
+            "https://first.example".to_owned(),
+            "https://second.example".to_owned(),
+        ];
+        let planned = plan_payment("https://buyer.example", &accepted, true).expect("plans");
+        let sealed = planned.source_mint().to_string();
+
+        let replanned = plan_payment(&sealed, &accepted, true).expect("the sealed source re-plans");
+        assert_eq!(replanned, planned, "the seal must re-derive the same plan");
+        assert!(replanned.is_hop(), "re-planning must not collapse the hop");
+        assert_eq!(replanned.realized_mint(), planned.realized_mint());
+    }
+
+    // The direct path's seal is unchanged: the buyer's own mint, which is also what it realizes at.
+    #[test]
+    fn the_direct_path_seals_the_mint_it_realizes_at() {
+        let plan = plan_payment(DEFAULT_MINT_URL, &[DEFAULT_MINT_URL.to_owned()], false)
+            .expect("direct plans");
+        assert_eq!(plan.source_mint(), plan.realized_mint());
+        assert_eq!(plan.source_mint(), &mint(DEFAULT_MINT_URL));
     }
 
     // The attempt id is derived from the realized mint, so a retry must re-derive the SAME target or
@@ -380,6 +426,7 @@ mod tests {
             melt_quote_id: "melt-quote-1".to_owned(),
             target_mint: "https://b.example".to_owned(),
             mint_quote_id: "mint-quote-1".to_owned(),
+            delivered_sats: 100,
             planned_cost: 109,
         };
         let encoded = serde_json::to_string(&journal).expect("journal serializes");
@@ -387,6 +434,10 @@ mod tests {
         assert_eq!(decoded, journal);
         assert_eq!(decoded.melt_quote_id, "melt-quote-1");
         assert_eq!(decoded.mint_quote_id, "mint-quote-1");
+        // The delivered amount survives the round trip separately from the cost: recovery must be
+        // able to issue exactly the offer amount without consulting anything mutable.
+        assert_eq!(decoded.delivered_sats, 100);
+        assert_ne!(decoded.delivered_sats, decoded.planned_cost);
     }
 
     // Selection skips an unfenced entry rather than refusing outright when a later entry is fine.
diff --git a/crates/mobee-core/src/crossmint_hop.rs b/crates/mobee-core/src/crossmint_hop.rs
new file mode 100644
index 00000000..e4bb0779
--- /dev/null
+++ b/crates/mobee-core/src/crossmint_hop.rs
@@ -0,0 +1,1101 @@
+//! Carrying out a cross-mint hop, and resuming one that was interrupted mid-flight.
+//!
+//! [`crate::crossmint`] decides *whether* to hop; this module performs one. The two legs are a NUT-05
+//! melt at the buyer's funded mint, paying a NUT-04 mint quote raised at the seller's, after which the
+//! buyer holds fresh ecash at the target and the ordinary send path takes over unchanged.
+//!
+//! Everything here answers one question: after a crash, did the buyer pay twice? cdk persists each leg
+//! on its own — a melt quote's state is recoverable from a cold process by quote id, and a mint quote
+//! that was paid but never issued can still be issued later — but nothing in cdk knows that the two
+//! quotes are ONE hop. That pairing is what this module journals, before the melt, and it is what makes
+//! the melt leg safe to re-enter: on a resumed attempt the persisted quote ids WIN over anything freshly
+//! planned, because raising a second melt for one attempt id is exactly the double-pay the journal
+//! exists to prevent.
+//!
+//! The resume decision is taken from what the MINTS say, never from what we infer:
+//!
+//! | melt at source | mint at target | action |
+//! |---|---|---|
+//! | `Unpaid`  | —          | nothing left the source; melt (the source mint's own answer, not a guess) |
+//! | `Pending` | —          | money in flight; refuse, stay retryable, never melt again |
+//! | `Paid`    | not issued | the strand: issue the ecash at the target, and say so LOUDLY |
+//! | `Paid`    | issued     | both legs already landed; complete without touching either mint |
+//!
+//! The strand row is the one that must never pass in silence. A buyer whose sats left the source mint
+//! but whose ecash never appeared at the target has money that is neither spent nor held, and the only
+//! thing standing between that and a silent loss is an operator who can see it.
+
+use std::collections::HashMap;
+use std::fmt;
+use std::fs::{File, OpenOptions};
+use std::future::Future;
+use std::io::{BufRead, BufReader, Read, Seek, SeekFrom, Write};
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+
+use cdk::nuts::{MeltQuoteState, MintQuoteState, PaymentMethod};
+use cdk::wallet::Wallet;
+
+use crate::buyer_fund;
+use crate::crossmint::{HopCost, HopJournal};
+use crate::home::MobeeHome;
+use crate::payment_wallet::MINT_TOUCH_TIMEOUT;
+
+/// What the source mint says about the melt leg.
+///
+/// A narrowing of cdk's melt quote state to the four answers the hop acts on. A state that is not a
+/// statement about where the money is — cdk's `Unknown` — maps to [`Self::Pending`], the row that
+/// refuses rather than re-melting, because "I don't know" and "it might be in flight" call for the
+/// same caution.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MeltLeg {
+    /// The source mint has not paid the invoice. Nothing has left the wallet.
+    Unpaid,
+    /// The source mint is paying, or will not say. Money may be in flight.
+    Pending,
+    /// The source mint paid the invoice. The sats have left.
+    Paid,
+    /// The source mint tried and failed. Nothing left the wallet and nothing will through this
+    /// quote.
+    Failed,
+}
+
+/// What the target mint says about the mint leg.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MintLeg {
+    /// The invoice raised at the target has not been paid yet.
+    Unpaid,
+    /// The invoice is paid but the ecash has not been issued to the buyer.
+    Paid,
+    /// The ecash has been issued; the buyer holds it.
+    Issued,
+}
+
+/// Both legs of one hop, as the two mints report them.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct HopSettled {
+    /// Ecash issued at the target mint. Equals the pinned delivery amount, or the hop refuses.
+    pub minted_sats: u64,
+    /// Whether this run found the melt already paid and the ecash not yet issued — a hop that an
+    /// earlier run left stranded and this one recovered.
+    pub recovered_strand: bool,
+}
+
+/// A hop failure. Every variant refuses fail-closed; none of them can be reached with the seller's
+/// delivered amount already reduced, because the delivery amount is pinned before any of this runs.
+#[derive(Debug)]
+pub enum HopError {
+    /// The journal could not be read, or could not be durably appended. Fail-closed on purpose:
+    /// without a durable pairing there is no way to tell a crashed hop from a fresh one, so no melt
+    /// may fire.
+    Journal(String),
+    /// A mint refused, or could not be reached, while the hop was under way.
+    Mint(String),
+    /// Two different pairings claim one attempt id. Refusing is the whole point: acting on either
+    /// pairing risks a second melt against an attempt that already has one.
+    PairingConflict {
+        /// The attempt both pairings claim.
+        attempt_id: String,
+        /// The pairing already on disk.
+        persisted: Box<HopJournal>,
+        /// The pairing this run arrived with.
+        planned: Box<HopJournal>,
+    },
+    /// The melt is settling at the source mint. Money is in flight, so this attempt must not melt
+    /// again; it refuses and stays retryable once the source mint reaches a terminal answer.
+    MeltInFlight {
+        /// The attempt whose melt is settling.
+        attempt_id: String,
+        /// Melt quote to re-ask about on the next run.
+        melt_quote_id: String,
+    },
+    /// The source mint reports the melt as failed: the Lightning payment did not go through and the
+    /// proofs are back in the wallet. No money left, but this pairing is dead — the target's invoice
+    /// can no longer be paid through this melt quote.
+    ///
+    /// interim: the attempt stops here rather than re-planning the melt leg against the (still
+    /// unpaid) invoice at the target. Re-planning means a superseding-pairing record and a fresh
+    /// argument about pays-once, which is its own reviewed change — see MakePrisms/mobee#188.
+    MeltFailed {
+        /// The attempt whose melt failed.
+        attempt_id: String,
+        /// Melt quote the source mint reports as failed.
+        melt_quote_id: String,
+    },
+    /// The source wallet cannot fund the hop. Raised while planning, so the cap is never charged
+    /// for a melt that could not have run.
+    InsufficientSource {
+        /// The buyer's funded mint.
+        mint: String,
+        /// What the buyer holds there.
+        balance: u64,
+        /// What the hop would cost.
+        planned_cost: u64,
+    },
+    /// The target mint issued an amount other than the pinned delivery amount. Refused rather than
+    /// carried forward: the send that follows must hand the seller exactly the offer amount.
+    MintedAmountMismatch {
+        /// Amount pinned by the buyer-signed offer.
+        expected: u64,
+        /// Amount the target mint actually issued.
+        minted: u64,
+    },
+}
+
+impl fmt::Display for HopError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Journal(detail) => write!(formatter, "cross-mint hop journal: {detail}"),
+            Self::Mint(detail) => write!(formatter, "cross-mint hop: {detail}"),
+            Self::PairingConflict {
+                attempt_id,
+                persisted,
+                planned,
+            } => write!(
+                formatter,
+                "cross-mint hop: attempt {attempt_id} already journals melt quote {} at {} paired \
+                 with mint quote {} at {}, but this run arrived with melt quote {} at {} paired \
+                 with mint quote {} at {}; refusing rather than risking a second melt",
+                persisted.melt_quote_id,
+                persisted.source_mint,
+                persisted.mint_quote_id,
+                persisted.target_mint,
+                planned.melt_quote_id,
+                planned.source_mint,
+                planned.mint_quote_id,
+                planned.target_mint,
+            ),
+            Self::MeltInFlight {
+                attempt_id,
+                melt_quote_id,
+            } => write!(
+                formatter,
+                "cross-mint hop: melt quote {melt_quote_id} for attempt {attempt_id} is still \
+                 settling at the source mint; refusing to melt again while the payment is in \
+                 flight (retry once the mint reports paid or unpaid)"
+            ),
+            Self::MeltFailed {
+                attempt_id,
+                melt_quote_id,
+            } => write!(
+                formatter,
+                "cross-mint hop: the source mint reports melt quote {melt_quote_id} for attempt \
+                 {attempt_id} as failed; no sats left the wallet, but this attempt cannot reach \
+                 the seller's mint through a failed melt quote"
+            ),
+            Self::InsufficientSource {
+                mint,
+                balance,
+                planned_cost,
+            } => write!(
+                formatter,
+                "cross-mint hop: the buyer holds {balance} sats at {mint} but the hop costs \
+                 {planned_cost} sats (delivery plus the source mint's fee reserve and input fee); \
+                 refusing before any budget is charged"
+            ),
+            Self::MintedAmountMismatch { expected, minted } => write!(
+                formatter,
+                "cross-mint hop: target mint issued {minted} sats but the buyer-signed offer pins \
+                 delivery at {expected} sats"
+            ),
+        }
+    }
+}
+
+impl std::error::Error for HopError {}
+
+/// The two effects a hop has on the world, plus the two questions it asks before applying them.
+///
+/// A trait rather than direct wallet calls so the crash windows can be toothed hermetically: a fake
+/// that pays the melt and then dies before the mint reproduces the exact strand the journal exists to
+/// survive, which no amount of testing against a live mint pair could produce on demand.
+pub(crate) trait HopEffects {
+    /// Ask the SOURCE mint what became of the melt. Asking is also cdk's recovery trigger — a melt
+    /// interrupted mid-saga resumes on this call rather than needing a separate sweep.
+    fn melt_leg(&mut self, melt_quote_id: &str) -> Result<MeltLeg, HopError>;
+
+    /// Ask the TARGET mint whether the ecash has been issued.
+    fn mint_leg(&mut self, mint_quote_id: &str) -> Result<MintLeg, HopError>;
+
+    /// Melt at the source mint, paying the invoice the target raised.
+    fn melt(&mut self, melt_quote_id: &str) -> Result<(), HopError>;
+
+    /// Issue the ecash at the target mint. Returns what was actually issued, which the caller checks
+    /// against the pinned delivery amount rather than trusting.
+    fn mint(&mut self, mint_quote_id: &str, expected_sats: u64) -> Result<u64, HopError>;
+}
+
+/// One line of the hop journal.
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(tag = "record", rename_all = "snake_case")]
+pub enum HopRecord {
+    /// The pairing, written and synced BEFORE the melt.
+    Planned(HopJournal),
+    /// Both legs landed and the buyer holds the ecash at the target.
+    Settled {
+        /// Attempt this hop funded.
+        attempt_id: String,
+        /// Ecash issued at the target mint.
+        minted_sats: u64,
+    },
+}
+
+/// Durable record of which two quotes form one hop.
+pub(crate) trait HopJournalStore {
+    /// Every record already written for one attempt, oldest first.
+    fn replay(&self, attempt_id: &str) -> Result<Vec<HopRecord>, HopError>;
+
+    /// Append one record and durably sync it before the caller applies any effect.
+    fn append_sync(&self, record: &HopRecord) -> Result<(), HopError>;
+}
+
+/// Append-only JSONL hop journal, one file per attempt id under a single directory.
+///
+/// Shares the payment journal's durability discipline — exclusive file lock, `sync_all` on the file
+/// and on its parent directory — because the guarantee is the same one: a record the caller acted on
+/// must still be there after the power goes out.
+#[derive(Clone, Debug)]
+pub struct FsHopJournal {
+    dir: PathBuf,
+}
+
+impl FsHopJournal {
+    /// A journal rooted at `dir`. The directory is created on first append.
+    pub fn new(dir: impl Into<PathBuf>) -> Self {
+        Self { dir: dir.into() }
+    }
+
+    fn path_for(&self, attempt_id: &str) -> PathBuf {
+        self.dir.join(format!("{attempt_id}.jsonl"))
+    }
+}
+
+fn journal_error(context: &str, error: impl fmt::Display) -> HopError {
+    HopError::Journal(format!("{context}: {error}"))
+}
+
+fn sync_parent_directory(path: &Path) -> Result<(), HopError> {
+    let parent = path
+        .parent()
+        .filter(|parent| !parent.as_os_str().is_empty())
+        .unwrap_or_else(|| Path::new("."));
+    File::open(parent)
+        .and_then(|dir| dir.sync_all())
+        .map_err(|error| journal_error("parent directory sync", error))
+}
+
+impl HopJournalStore for FsHopJournal {
+    fn replay(&self, attempt_id: &str) -> Result<Vec<HopRecord>, HopError> {
+        let path = self.path_for(attempt_id);
+        let mut file = match File::open(&path) {
+            Ok(file) => file,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+            Err(error) => return Err(journal_error("open", error)),
+        };
+        file.lock().map_err(|error| journal_error("lock", error))?;
+        file.seek(SeekFrom::Start(0))
+            .map_err(|error| journal_error("seek", error))?;
+        let mut bytes = Vec::new();
+        file.read_to_end(&mut bytes)
+            .map_err(|error| journal_error("read", error))?;
+        // A record without its commit newline is a torn write. Refuse it rather than parse around
+        // it: a half-written pairing is exactly the state where a wrong answer melts twice.
+        if !bytes.is_empty() && !bytes.ends_with(b"\n") {
+            return Err(HopError::Journal(format!(
+                "attempt {attempt_id}: last record is missing its commit newline (torn write)"
+            )));
+        }
+        let mut records = Vec::new();
+        for (index, line) in BufReader::new(bytes.as_slice()).lines().enumerate() {
+            let line = line.map_err(|error| journal_error("read line", error))?;
+            let record = serde_json::from_str::<HopRecord>(&line).map_err(|error| {
+                HopError::Journal(format!(
+                    "attempt {attempt_id} line {}: {error}",
+                    index.saturating_add(1)
+                ))
+            })?;
+            records.push(record);
+        }
+        Ok(records)
+    }
+
+    fn append_sync(&self, record: &HopRecord) -> Result<(), HopError> {
+        let attempt_id = match record {
+            HopRecord::Planned(journal) => journal.attempt_id.as_str(),
+            HopRecord::Settled { attempt_id, .. } => attempt_id.as_str(),
+        };
+        std::fs::create_dir_all(&self.dir).map_err(|error| journal_error("create dir", error))?;
+        let path = self.path_for(attempt_id);
+        let mut file = OpenOptions::new()
+            .create(true)
+            .read(true)
+            .append(true)
+            .open(&path)
+            .map_err(|error| journal_error("open for append", error))?;
+        file.lock().map_err(|error| journal_error("lock", error))?;
+        let mut line =
+            serde_json::to_vec(record).map_err(|error| journal_error("encode", error))?;
+        line.push(b'\n');
+        file.write_all(&line)
+            .map_err(|error| journal_error("append", error))?;
+        file.sync_all().map_err(|error| journal_error("sync", error))?;
+        sync_parent_directory(&path)
+    }
+}
+
+/// The pairing already on disk for an attempt, if any.
+fn planned_of(records: &[HopRecord]) -> Option<&HopJournal> {
+    records.iter().find_map(|record| match record {
+        HopRecord::Planned(journal) => Some(journal),
+        HopRecord::Settled { .. } => None,
+    })
+}
+
+/// The pairing already journalled for an attempt, if this attempt has planned a hop before.
+///
+/// Read BEFORE raising fresh quotes: an attempt that already has a pairing must reuse it, and quotes
+/// raised only to be discarded are quotes the mints have to expire.
+pub(crate) fn journalled_pairing<S: HopJournalStore>(
+    store: &S,
+    attempt_id: &str,
+) -> Result<Option<HopJournal>, HopError> {
+    Ok(planned_of(&store.replay(attempt_id)?).cloned())
+}
+
+/// The completion record for an attempt, if the hop already finished.
+fn settled_of(records: &[HopRecord]) -> Option<u64> {
+    records.iter().find_map(|record| match record {
+        HopRecord::Settled { minted_sats, .. } => Some(*minted_sats),
+        HopRecord::Planned(_) => None,
+    })
+}
+
+/// The operator-visible line for a hop whose sats left the source but whose ecash never arrived.
+///
+/// Written to stderr on its own line and prefixed with a fixed, greppable marker: the point is that
+/// somebody watching the buyer's output sees it without having to know what a mint quote is.
+fn strand_line(journal: &HopJournal) -> String {
+    format!(
+        "CROSSMINT STRAND attempt={} melted at {} (melt quote {}) but the ecash at {} was never \
+         issued (mint quote {}); {} sats are paid and unissued — completing the mint leg now",
+        journal.attempt_id,
+        journal.source_mint,
+        journal.melt_quote_id,
+        journal.target_mint,
+        journal.mint_quote_id,
+        journal.delivered_sats,
+    )
+}
+
+/// Perform the hop described by `journal`, resuming instead of repeating whatever already happened.
+///
+/// `journal` is the freshly planned pairing. If a pairing is already on disk for this attempt it WINS:
+/// the fresh quote ids are discarded, because a second melt quote for one attempt id is the double-pay
+/// this journal exists to prevent. A pairing that disagrees with the persisted one is refused outright
+/// rather than reconciled.
+///
+/// Ordering is write-before-effect throughout: the pairing is durable before the melt, and the
+/// completion record is durable before the caller is told the ecash is in hand.
+pub(crate) fn run_hop<S: HopJournalStore, E: HopEffects>(
+    store: &S,
+    effects: &mut E,
+    journal: &HopJournal,
+) -> Result<HopSettled, HopError> {
+    let records = store.replay(&journal.attempt_id)?;
+    if let Some(minted_sats) = settled_of(&records) {
+        // Already complete. Neither mint is touched — this is the pays-once row.
+        return Ok(HopSettled {
+            minted_sats,
+            recovered_strand: false,
+        });
+    }
+
+    let pairing = match planned_of(&records) {
+        None => {
+            store.append_sync(&HopRecord::Planned(journal.clone()))?;
+            journal.clone()
+        }
+        Some(persisted) if persisted == journal => persisted.clone(),
+        Some(persisted) => {
+            return Err(HopError::PairingConflict {
+                attempt_id: journal.attempt_id.clone(),
+                persisted: Box::new(persisted.clone()),
+                planned: Box::new(journal.clone()),
+            });
+        }
+    };
+
+    // Melt leg. The source mint's answer decides; we never infer from our own records whether money
+    // moved, because the record was written before the melt precisely so it could not know.
+    let melted_earlier = match effects.melt_leg(&pairing.melt_quote_id)? {
+        MeltLeg::Unpaid => {
+            effects.melt(&pairing.melt_quote_id)?;
+            false
+        }
+        MeltLeg::Pending => {
+            return Err(HopError::MeltInFlight {
+                attempt_id: pairing.attempt_id.clone(),
+                melt_quote_id: pairing.melt_quote_id.clone(),
+            });
+        }
+        MeltLeg::Failed => {
+            return Err(HopError::MeltFailed {
+                attempt_id: pairing.attempt_id.clone(),
+                melt_quote_id: pairing.melt_quote_id.clone(),
+            });
+        }
+        MeltLeg::Paid => true,
+    };
+
+    // Mint leg. A melt that landed on an EARLIER run with no ecash to show for it is the strand.
+    let mint_leg = effects.mint_leg(&pairing.mint_quote_id)?;
+    let recovered_strand = melted_earlier && mint_leg != MintLeg::Issued;
+    if recovered_strand {
+        eprintln!("{}", strand_line(&pairing));
+    }
+    let minted_sats = match mint_leg {
+        MintLeg::Issued => pairing.delivered_sats,
+        MintLeg::Unpaid | MintLeg::Paid => {
+            effects.mint(&pairing.mint_quote_id, pairing.delivered_sats)?
+        }
+    };
+    if minted_sats != pairing.delivered_sats {
+        return Err(HopError::MintedAmountMismatch {
+            expected: pairing.delivered_sats,
+            minted: minted_sats,
+        });
+    }
+
+    store.append_sync(&HopRecord::Settled {
+        attempt_id: pairing.attempt_id.clone(),
+        minted_sats,
+    })?;
+    Ok(HopSettled {
+        minted_sats,
+        recovered_strand,
+    })
+}
+
+/// Bound on one hop leg that moves money.
+///
+/// Longer than [`MINT_TOUCH_TIMEOUT`], which bounds mint *reads*: a melt is a Lightning payment
+/// between two mints, not a keyset lookup. Shorter than forever, because a leg that never returns is
+/// invariant 5's failure — an await with no timer is a park nothing can end.
+const HOP_LEG_TIMEOUT: Duration = Duration::from_secs(90);
+
+/// Run one async hop step on its own thread and its own runtime, returning synchronously.
+///
+/// The budget gate's effect boundary is synchronous — `authorize_then_attempt` takes an `FnOnce` —
+/// and the hop is async, so the two need a bridge. Blocking the caller's runtime thread is not on the
+/// table (`block_on` inside a runtime panics), and the crate already answers this exact question for
+/// the wallet effects the same way: own thread, own current-thread runtime, synchronous handoff.
+fn block_on_leg<T, F>(label: &str, future: F) -> Result<T, HopError>
+where
+    F: Future<Output = T> + Send + 'static,
+    T: Send + 'static,
+{
+    let label = label.to_owned();
+    std::thread::Builder::new()
+        .name("mobee-crossmint-hop".into())
+        .spawn(move || {
+            tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .map(|runtime| runtime.block_on(future))
+        })
+        .map_err(|error| HopError::Mint(format!("{label}: hop thread: {error}")))?
+        .join()
+        .map_err(|_| HopError::Mint(format!("{label}: hop thread panicked")))?
+        .map_err(|error| HopError::Mint(format!("{label}: hop runtime: {error}")))
+}
+
+/// Bound an async mint touch, turning a hang into a refusal.
+async fn bounded<T>(
+    label: &str,
+    timeout: Duration,
+    future: impl Future<Output = Result<T, cdk::Error>>,
+) -> Result<T, HopError> {
+    match tokio::time::timeout(timeout, future).await {
+        Err(_elapsed) => Err(HopError::Mint(format!("{label} exceeded {timeout:?}"))),
+        Ok(Ok(value)) => Ok(value),
+        Ok(Err(error)) => Err(HopError::Mint(format!("{label}: {error}"))),
+    }
+}
+
+/// The two mint wallets one hop runs against.
+///
+/// Both are opened through [`buyer_fund::open_wallet_at_mint_async`], which fences the mint it is
+/// asked for. That is why the hop cannot become a back door around `allow_real_mints`: the fence is
+/// inside the opener, so the TARGET is fenced by the same code that fences the source, without this
+/// module having to remember to do it.
+pub(crate) struct CdkHopEffects {
+    source: Wallet,
+    target: Wallet,
+}
+
+impl CdkHopEffects {
+    /// Open the buyer's wallet at both mints. One sqlite store, two bound mints.
+    pub(crate) async fn open(
+        home: &MobeeHome,
+        source_mint: &str,
+        target_mint: &str,
+    ) -> Result<Self, HopError> {
+        let source = buyer_fund::open_wallet_at_mint_async(home, source_mint)
+            .await
+            .map_err(|error| HopError::Mint(format!("source mint {source_mint}: {error}")))?;
+        let target = buyer_fund::open_wallet_at_mint_async(home, target_mint)
+            .await
+            .map_err(|error| HopError::Mint(format!("target mint {target_mint}: {error}")))?;
+        Ok(Self { source, target })
+    }
+
+    /// Price the hop and raise both quotes, moving no money.
+    ///
+    /// Delivery is PINNED: the mint quote at the target is raised for exactly `delivered_sats`, the
+    /// amount from the buyer-signed offer. The buyer's cost is what floats — melt amount, the source
+    /// mint's Lightning fee reserve, and its input fee — so no fee reading can ever reduce what the
+    /// seller receives.
+    ///
+    /// Runs before the budget gate, so every failure here refuses with zero spend.
+    pub(crate) async fn plan_quotes(
+        &self,
+        attempt_id: &str,
+        delivered_sats: u64,
+    ) -> Result<HopJournal, HopError> {
+        if delivered_sats == 0 {
+            return Err(HopError::Mint(
+                "cross-mint hop: delivery amount is 0 (refusing to raise a quote for nothing)"
+                    .into(),
+            ));
+        }
+        let mint_quote = bounded(
+            "target mint quote",
+            MINT_TOUCH_TIMEOUT,
+            self.target.mint_quote(
+                PaymentMethod::BOLT11,
+                Some(cdk::Amount::from(delivered_sats)),
+                None,
+                None,
+            ),
+        )
+        .await?;
+        if mint_quote.request.trim().is_empty() {
+            return Err(HopError::Mint(format!(
+                "target mint {} returned an empty bolt11 for quote {} (refusing a hop with nothing \
+                 to pay)",
+                self.target.mint_url, mint_quote.id
+            )));
+        }
+        let melt_quote = bounded(
+            "source melt quote",
+            MINT_TOUCH_TIMEOUT,
+            self.source
+                .melt_quote(PaymentMethod::BOLT11, mint_quote.request.clone(), None, None),
+        )
+        .await?;
+        let cost = HopCost {
+            melt_amount: melt_quote.amount.to_u64(),
+            fee_reserve: melt_quote.fee_reserve.to_u64(),
+            input_fee: self.source_input_fee_ceiling().await?,
+        };
+        let planned_cost = cost.planned_cost().map_err(|error| {
+            // `planned_cost` reports overflow through the pay error type; the hop states it in its
+            // own words rather than smuggling a foreign error across the boundary.
+            HopError::Mint(error.to_string())
+        })?;
+        self.require_source_covers(planned_cost).await?;
+        Ok(HopJournal {
+            attempt_id: attempt_id.to_owned(),
+            source_mint: self.source.mint_url.to_string(),
+            melt_quote_id: mint_quote_id(&melt_quote.id),
+            target_mint: self.target.mint_url.to_string(),
+            mint_quote_id: mint_quote_id(&mint_quote.id),
+            delivered_sats,
+            planned_cost,
+        })
+    }
+
+    /// Refuse a hop the source wallet cannot fund, BEFORE the cap is charged.
+    ///
+    /// Without this the buyer would charge its budget the full planned cost and only then discover
+    /// it has nothing to melt — spending cap on a payment that never happens. Before this slice a
+    /// buyer with no route to the seller's mint simply declined at zero cost; a hop must not turn
+    /// that into a charge.
+    async fn require_source_covers(&self, planned_cost: u64) -> Result<(), HopError> {
+        let balance = bounded(
+            "source balance",
+            MINT_TOUCH_TIMEOUT,
+            self.source.total_balance(),
+        )
+        .await?
+        .to_u64();
+        if balance < planned_cost {
+            return Err(HopError::InsufficientSource {
+                mint: self.source.mint_url.to_string(),
+                balance,
+                planned_cost,
+            });
+        }
+        Ok(())
+    }
+
+    /// Upper bound on the source mint's input fee for this melt.
+    ///
+    /// The melt selects its inputs when it runs, so the exact input count is not knowable before the
+    /// cap check. Priced at the most inputs the melt could possibly select — every unspent proof at
+    /// the source — which over-states the fee rather than under-stating it. Under-stating would put
+    /// a fee on the wire that the cap never saw, which is the defect class the cap exists to stop.
+    ///
+    /// interim: the reserve-versus-actual reconciliation that would make this exact reshapes the
+    /// spend ledger, which is money-gate machinery and its own slice — see MakePrisms/mobee#186.
+    async fn source_input_fee_ceiling(&self) -> Result<u64, HopError> {
+        let proofs = bounded(
+            "source proof count",
+            MINT_TOUCH_TIMEOUT,
+            self.source.get_unspent_proofs(),
+        )
+        .await?;
+        let inputs = u64::try_from(proofs.len()).unwrap_or(u64::MAX).max(1);
+        crate::payment_wallet::bounded_input_fee(&self.source, inputs)
+            .await
+            .map(|fee| fee.to_u64())
+            .map_err(|error| HopError::Mint(format!("source input fee: {error}")))
+    }
+}
+
+/// cdk quote ids render as their string form; the journal stores that, since it is what
+/// `check_melt_quote_status` / `check_mint_quote` are asked for on recovery.
+fn mint_quote_id(id: &impl fmt::Display) -> String {
+    id.to_string()
+}
+
+impl HopEffects for CdkHopEffects {
+    fn melt_leg(&mut self, melt_quote_id: &str) -> Result<MeltLeg, HopError> {
+        let wallet = self.source.clone();
+        let quote_id = melt_quote_id.to_owned();
+        // Asking is also cdk's own recovery trigger: a melt interrupted mid-saga resumes on this
+        // call, so the answer reflects a settled world rather than the moment we crashed.
+        let state = block_on_leg("melt state", async move {
+            bounded(
+                "melt quote status",
+                HOP_LEG_TIMEOUT,
+                wallet.check_melt_quote_status(&quote_id),
+            )
+            .await
+            .map(|quote| quote.state)
+        })??;
+        Ok(match state {
+            MeltQuoteState::Unpaid => MeltLeg::Unpaid,
+            MeltQuoteState::Paid => MeltLeg::Paid,
+            MeltQuoteState::Failed => MeltLeg::Failed,
+            // Pending is money in flight; Unknown is the mint declining to say. Neither is a
+            // statement that the sats are still ours, so neither may lead to a second melt.
+            MeltQuoteState::Pending | MeltQuoteState::Unknown => MeltLeg::Pending,
+        })
+    }
+
+    fn mint_leg(&mut self, mint_quote_id: &str) -> Result<MintLeg, HopError> {
+        let wallet = self.target.clone();
+        let quote_id = mint_quote_id.to_owned();
+        let state = block_on_leg("mint state", async move {
+            bounded(
+                "mint quote status",
+                HOP_LEG_TIMEOUT,
+                wallet.check_mint_quote(&quote_id),
+            )
+            .await
+            .map(|quote| quote.state)
+        })??;
+        Ok(match state {
+            MintQuoteState::Unpaid => MintLeg::Unpaid,
+            MintQuoteState::Paid => MintLeg::Paid,
+            MintQuoteState::Issued => MintLeg::Issued,
+        })
+    }
+
+    fn melt(&mut self, melt_quote_id: &str) -> Result<(), HopError> {
+        let wallet = self.source.clone();
+        let quote_id = melt_quote_id.to_owned();
+        block_on_leg("melt", async move {
+            let prepared = bounded(
+                "prepare melt",
+                MINT_TOUCH_TIMEOUT,
+                wallet.prepare_melt(&quote_id, HashMap::new()),
+            )
+            .await?;
+            bounded("melt confirm", HOP_LEG_TIMEOUT, prepared.confirm()).await?;
+            Ok::<(), HopError>(())
+        })?
+    }
+
+    fn mint(&mut self, mint_quote_id: &str, expected_sats: u64) -> Result<u64, HopError> {
+        let wallet = self.target.clone();
+        let quote_id = mint_quote_id.to_owned();
+        block_on_leg("mint", async move {
+            // The shared poll-then-issue path, which already refuses a phantom credit and an
+            // under- or over-funded issue. Nothing about a hop makes those checks weaker.
+            crate::wallet_ops::poll_and_mint(&wallet, &quote_id, expected_sats)
+                .await
+                .map_err(|error| HopError::Mint(format!("target mint issue: {error}")))
+        })?
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+    use std::collections::HashMap;
+    use std::rc::Rc;
+
+    use super::*;
+
+    fn journal(attempt: &str) -> HopJournal {
+        HopJournal {
+            attempt_id: attempt.to_owned(),
+            source_mint: "https://a.example".to_owned(),
+            melt_quote_id: "melt-1".to_owned(),
+            target_mint: "https://b.example".to_owned(),
+            mint_quote_id: "mint-1".to_owned(),
+            delivered_sats: 100,
+            planned_cost: 109,
+        }
+    }
+
+    /// What the fake mints did, shared with the test so a restart can inspect it.
+    #[derive(Default)]
+    struct MintWorld {
+        melt_leg: Option<MeltLeg>,
+        mint_leg: Option<MintLeg>,
+        melts: Vec<String>,
+        mints: Vec<String>,
+        /// Melt succeeds, then the process dies before the mint leg — the crash window.
+        die_after_melt: bool,
+        mint_fails: bool,
+    }
+
+    impl MintWorld {
+        fn shared() -> Rc<RefCell<Self>> {
+            Rc::new(RefCell::new(Self {
+                melt_leg: Some(MeltLeg::Unpaid),
+                mint_leg: Some(MintLeg::Unpaid),
+                ..Self::default()
+            }))
+        }
+    }
+
+    struct FakeMints {
+        world: Rc<RefCell<MintWorld>>,
+    }
+
+    impl HopEffects for FakeMints {
+        fn melt_leg(&mut self, _melt_quote_id: &str) -> Result<MeltLeg, HopError> {
+            self.world
+                .borrow()
+                .melt_leg
+                .ok_or_else(|| HopError::Mint("source mint unreachable".into()))
+        }
+
+        fn mint_leg(&mut self, _mint_quote_id: &str) -> Result<MintLeg, HopError> {
+            self.world
+                .borrow()
+                .mint_leg
+                .ok_or_else(|| HopError::Mint("target mint unreachable".into()))
+        }
+
+        fn melt(&mut self, melt_quote_id: &str) -> Result<(), HopError> {
+            let mut world = self.world.borrow_mut();
+            world.melts.push(melt_quote_id.to_owned());
+            world.melt_leg = Some(MeltLeg::Paid);
+            // The target's invoice is paid by the melt, so its quote flips too.
+            world.mint_leg = Some(MintLeg::Paid);
+            if world.die_after_melt {
+                return Err(HopError::Mint("process died after the melt".into()));
+            }
+            Ok(())
+        }
+
+        fn mint(&mut self, mint_quote_id: &str, expected_sats: u64) -> Result<u64, HopError> {
+            let mut world = self.world.borrow_mut();
+            if world.mint_fails {
+                return Err(HopError::Mint("target mint refused to issue".into()));
+            }
+            world.mints.push(mint_quote_id.to_owned());
+            world.mint_leg = Some(MintLeg::Issued);
+            Ok(expected_sats)
+        }
+    }
+
+    /// An in-memory journal that survives a "restart" (the store outlives the effects).
+    #[derive(Default)]
+    struct MemJournal {
+        records: RefCell<HashMap<String, Vec<HopRecord>>>,
+    }
+
+    impl HopJournalStore for MemJournal {
+        fn replay(&self, attempt_id: &str) -> Result<Vec<HopRecord>, HopError> {
+            Ok(self
+                .records
+                .borrow()
+                .get(attempt_id)
+                .cloned()
+                .unwrap_or_default())
+        }
+
+        fn append_sync(&self, record: &HopRecord) -> Result<(), HopError> {
+            let attempt_id = match record {
+                HopRecord::Planned(journal) => journal.attempt_id.clone(),
+                HopRecord::Settled { attempt_id, .. } => attempt_id.clone(),
+            };
+            self.records
+                .borrow_mut()
+                .entry(attempt_id)
+                .or_default()
+                .push(record.clone());
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn a_clean_hop_melts_once_mints_once_and_journals_the_pairing_before_the_melt() {
+        let store = MemJournal::default();
+        let world = MintWorld::shared();
+        let mut effects = FakeMints {
+            world: Rc::clone(&world),
+        };
+        let settled = run_hop(&store, &mut effects, &journal("attempt-1")).expect("hop completes");
+
+        assert_eq!(settled.minted_sats, 100);
+        assert!(!settled.recovered_strand);
+        assert_eq!(world.borrow().melts.len(), 1);
+        assert_eq!(world.borrow().mints.len(), 1);
+
+        // The pairing is the FIRST record — written before the melt, which is what makes the melt
+        // leg re-enterable after a crash.
+        let records = store.replay("attempt-1").expect("replays");
+        assert!(matches!(records.first(), Some(HopRecord::Planned(_))));
+        assert!(matches!(
+            records.last(),
+            Some(HopRecord::Settled {
+                minted_sats: 100,
+                ..
+            })
+        ));
+    }
+
+    // Invariant 4, strong form. Kill between the melt and the mint, restart, and the hop must pay
+    // exactly once — the second run melts ZERO times — and must say out loud that it found a strand.
+    #[test]
+    fn kill_between_melt_and_mint_pays_once_on_restart_and_reports_the_strand() {
+        let store = MemJournal::default();
+        let world = MintWorld::shared();
+        world.borrow_mut().die_after_melt = true;
+
+        let mut dying = FakeMints {
+            world: Rc::clone(&world),
+        };
+        let error = run_hop(&store, &mut dying, &journal("attempt-1"))
+            .expect_err("the run dies after the melt");
+        assert!(matches!(error, HopError::Mint(_)), "got: {error}");
+        assert_eq!(world.borrow().melts.len(), 1, "the melt did land");
+        assert!(world.borrow().mints.is_empty(), "the ecash never issued");
+
+        // Restart: same journal on disk, fresh effects over the same mints.
+        world.borrow_mut().die_after_melt = false;
+        let mut restarted = FakeMints {
+            world: Rc::clone(&world),
+        };
+        let settled =
+            run_hop(&store, &mut restarted, &journal("attempt-1")).expect("the restart recovers");
+
+        assert_eq!(settled.minted_sats, 100);
+        assert!(
+            settled.recovered_strand,
+            "a melted-but-unissued hop is a strand and must be reported as one"
+        );
+        assert_eq!(
+            world.borrow().melts.len(),
+            1,
+            "exactly-once: the restart must not melt again"
+        );
+        assert_eq!(world.borrow().mints.len(), 1);
+
+        // The loud line names both quote ids and both mints, so an operator reading stderr can act
+        // on it without opening the journal.
+        let line = strand_line(&journal("attempt-1"));
+        for needle in [
+            "CROSSMINT STRAND",
+            "attempt-1",
+            "melt-1",
+            "mint-1",
+            "https://a.example",
+            "https://b.example",
+        ] {
+            assert!(line.contains(needle), "strand line missing {needle}: {line}");
+        }
+    }
+
+    // A completed hop is never re-run: neither mint is touched again, no matter how many times the
+    // attempt is retried.
+    #[test]
+    fn a_settled_hop_touches_neither_mint_again() {
+        let store = MemJournal::default();
+        let world = MintWorld::shared();
+        let mut effects = FakeMints {
+            world: Rc::clone(&world),
+        };
+        run_hop(&store, &mut effects, &journal("attempt-1")).expect("hop completes");
+
+        for _ in 0..3 {
+            let again =
+                run_hop(&store, &mut effects, &journal("attempt-1")).expect("replay is a no-op");
+            assert_eq!(again.minted_sats, 100);
+            assert!(!again.recovered_strand);
+        }
+        assert_eq!(world.borrow().melts.len(), 1);
+        assert_eq!(world.borrow().mints.len(), 1);
+    }
+
+    // Money in flight is not a licence to melt again. The source mint saying "pending" refuses.
+    #[test]
+    fn a_pending_melt_refuses_instead_of_melting_again() {
+        let store = MemJournal::default();
+        let world = MintWorld::shared();
+        world.borrow_mut().melt_leg = Some(MeltLeg::Pending);
+        let mut effects = FakeMints {
+            world: Rc::clone(&world),
+        };
+        let error = run_hop(&store, &mut effects, &journal("attempt-1"))
+            .expect_err("an in-flight melt must refuse");
+        assert!(matches!(error, HopError::MeltInFlight { .. }), "got: {error}");
+        assert!(
+            world.borrow().melts.is_empty(),
+            "never melt while a melt is in flight"
+        );
+    }
+
+    // Freshly planned quotes must NOT override a pairing already on disk — that is the double-melt.
+    #[test]
+    fn a_second_pairing_for_one_attempt_is_refused_rather_than_melted() {
+        let store = MemJournal::default();
+        let world = MintWorld::shared();
+        world.borrow_mut().die_after_melt = true;
+        let mut dying = FakeMints {
+            world: Rc::clone(&world),
+        };
+        let _ = run_hop(&store, &mut dying, &journal("attempt-1"));
+        assert_eq!(world.borrow().melts.len(), 1);
+
+        // The retry re-planned and arrived with brand new quote ids.
+        let mut replanned = journal("attempt-1");
+        replanned.melt_quote_id = "melt-2".to_owned();
+        replanned.mint_quote_id = "mint-2".to_owned();
+        world.borrow_mut().die_after_melt = false;
+        let mut effects = FakeMints {
+            world: Rc::clone(&world),
+        };
+        let error = run_hop(&store, &mut effects, &replanned)
+            .expect_err("a conflicting pairing must refuse");
+        assert!(
+            matches!(error, HopError::PairingConflict { .. }),
+            "got: {error}"
+        );
+        assert_eq!(
+            world.borrow().melts.len(),
+            1,
+            "the conflicting pairing must not have melted"
+        );
+    }
+
+    // The send that follows hands the seller exactly the offer amount, so a short issue is refused
+    // here rather than carried into the send path.
+    #[test]
+    fn issuing_less_than_the_pinned_delivery_amount_refuses() {
+        struct ShortMint;
+        impl HopEffects for ShortMint {
+            fn melt_leg(&mut self, _: &str) -> Result<MeltLeg, HopError> {
+                Ok(MeltLeg::Unpaid)
+            }
+            fn mint_leg(&mut self, _: &str) -> Result<MintLeg, HopError> {
+                Ok(MintLeg::Paid)
+            }
+            fn melt(&mut self, _: &str) -> Result<(), HopError> {
+                Ok(())
+            }
+            fn mint(&mut self, _: &str, expected_sats: u64) -> Result<u64, HopError> {
+                Ok(expected_sats.saturating_sub(1))
+            }
+        }
+        let store = MemJournal::default();
+        let error = run_hop(&store, &mut ShortMint, &journal("attempt-1"))
+            .expect_err("a short issue must refuse");
+        assert!(
+            matches!(
+                error,
+                HopError::MintedAmountMismatch {
+                    expected: 100,
+                    minted: 99
+                }
+            ),
+            "got: {error}"
+        );
+        assert!(
+            settled_of(&store.replay("attempt-1").expect("replays")).is_none(),
+            "a refused hop must not journal a completion"
+        );
+    }
+
+    /// A fresh journal directory for one test, named so concurrent test binaries cannot collide.
+    fn scratch_dir(label: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "mobee-crossmint-journal-{}-{label}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        dir
+    }
+
+    #[test]
+    fn the_file_journal_round_trips_a_pairing_and_a_completion() {
+        let store = FsHopJournal::new(scratch_dir("round-trip"));
+        assert!(store.replay("attempt-1").expect("empty replays").is_empty());
+
+        let pairing = journal("attempt-1");
+        store
+            .append_sync(&HopRecord::Planned(pairing.clone()))
+            .expect("pairing appends");
+        store
+            .append_sync(&HopRecord::Settled {
+                attempt_id: "attempt-1".to_owned(),
+                minted_sats: 100,
+            })
+            .expect("completion appends");
+
+        let records = store.replay("attempt-1").expect("replays");
+        assert_eq!(records.len(), 2);
+        assert_eq!(planned_of(&records), Some(&pairing));
+        assert_eq!(settled_of(&records), Some(100));
+        // Attempts do not see each other's records.
+        assert!(store.replay("attempt-2").expect("replays").is_empty());
+    }
+
+    // A torn final record is refused, not parsed around: a half-written pairing is exactly the
+    // state in which a wrong answer melts twice.
+    #[test]
+    fn a_torn_final_record_refuses_rather_than_being_parsed_around() {
+        let journal_dir = scratch_dir("torn-tail");
+        let store = FsHopJournal::new(&journal_dir);
+        store
+            .append_sync(&HopRecord::Planned(journal("attempt-1")))
+            .expect("pairing appends");
+        let path = journal_dir.join("attempt-1.jsonl");
+        let mut bytes = std::fs::read(&path).expect("read");
+        bytes.extend_from_slice(b"{\"record\":\"settled\"");
+        std::fs::write(&path, bytes).expect("write");
+
+        let error = store.replay("attempt-1").expect_err("a torn record refuses");
+        assert!(
+            error.to_string().contains("torn write"),
+            "expected a torn-write refusal, got: {error}"
+        );
+    }
+}
diff --git a/crates/mobee-core/src/job_lifecycle.rs b/crates/mobee-core/src/job_lifecycle.rs
index 47d76050..0cf7c744 100644
--- a/crates/mobee-core/src/job_lifecycle.rs
+++ b/crates/mobee-core/src/job_lifecycle.rs
@@ -967,18 +967,26 @@ pub async fn accept_claim_async(
     let accepted_mints =
         verify_accepted_claim_creq(claim.creq.as_deref(), &request.job_id, offer.amount_sats)?;
 
-    // FREEZE the realized paying mint at accept from the buyer's then-configured default (validated
-    // against the accepted set + the real-mint fence). Sealing the SELECTION here — not just the
-    // accepted SET (finding V) — is what makes the pay-path attempt id stable across retries: a
-    // config-default change after accept can no longer shift the mint into a different attempt id and
-    // mint a second payment for one job (double-pay). A buyer whose configured mint is not payable
-    // for this claim is refused HERE (fail-closed), never accepted into an unpayable bind.
-    let realized_mint = crate::authorize_pay::resolve_realized_mint(
+    // FREEZE the buyer's paying mint at accept from its then-configured default, validated by
+    // planning the payment against the accepted set + the real-mint fence. Sealing the SELECTION
+    // here — not just the accepted SET (finding V) — is what makes the pay-path attempt id stable
+    // across retries: a config-default change after accept can no longer shift the mint into a
+    // different attempt id and mint a second payment for one job (double-pay). A buyer with no
+    // payable route to this claim is refused HERE (fail-closed), never accepted into an unpayable
+    // bind.
+    //
+    // The seal is the buyer's own funded mint, which is also the mint a direct payment realizes at.
+    // A payment that reaches the seller's mint by hopping realizes at the TARGET, but sealing that
+    // would re-plan at pay time as a direct payment from a mint the buyer holds nothing at; the
+    // target is re-derived there from this seal plus the accepted set frozen alongside it, so it
+    // stays deterministic without being stored twice.
+    let realized_mint = crate::crossmint::plan_payment(
         home.config.default_mint(),
         &accepted_mints,
         home.config.allow_real_mints,
     )
     .map_err(|error| JobLifecycleError::Input(error.to_string()))?
+    .source_mint()
     .to_string();
 
     let buyer_pubkey = keys.public_key().to_hex();
@@ -1408,8 +1416,9 @@ pub fn authorize_request_from_bind(
 /// (finding V). The co-signed receipt preimage binds only `creq_hash` (which pins the accepted SET),
 /// not the realized mint, so the seller cosig does not pin `accepted_mints`; a caller-supplied list
 /// could otherwise substitute a mint outside the bound set. Deriving it solely from the sealed bind
-/// closes that: the realized-mint selection ([`crate::authorize_pay::resolve_realized_mint`]) can
-/// only pick the buyer's own mint from within the bound set.
+/// closes that: payment planning ([`crate::crossmint::plan_payment`]) realizes only at a mint drawn
+/// from the bound set — the buyer's own when the seller accepts it, otherwise a hop target taken
+/// from that same set.
 pub fn fill_explicit_request_from_bind(
     request: &mut crate::authorize_pay::AuthorizePayRequest,
     bind: &AcceptedBind,
@@ -2365,8 +2374,8 @@ mod tests {
     // co-signed receipt preimage binds only creq_hash (the accepted SET), not the realized mint, so
     // a caller list is unpinned by the seller cosig; `fill_explicit_request_from_bind` overwrites it
     // from the sealed bind unconditionally. Here the caller passes a mint OUTSIDE the bind's set;
-    // after fill the request carries ONLY the bind's set, so realized-mint selection can never pick
-    // the substituted mint (`resolve_realized_mint` accepts only a buyer mint within that set).
+    // after fill the request carries ONLY the bind's set, so planning can never realize at the
+    // substituted mint (`plan_payment` realizes only at a mint drawn from that set).
     #[test]
     fn fill_explicit_overwrites_caller_accepted_mints_with_bind() {
         let bound_mint = "https://mint.minibits.cash/Bitcoin".to_string();
@@ -2440,7 +2449,8 @@ mod tests {
     // `authorize_pay`'s exact mint-selection + attempt-id derivation over the resulting request.
     #[tokio::test(flavor = "current_thread")]
     async fn config_default_flip_after_accept_does_not_shift_attempt_id() {
-        use crate::authorize_pay::{resolve_realized_mint, wallet_open_mint_url};
+        use crate::authorize_pay::wallet_open_mint_url;
+        use crate::crossmint::plan_payment;
         use crate::payment::{
             DeliveryIntegrityHash, JobHash, JobId, PaymentKey, PaymentTerms, ResultId,
         };
@@ -2508,8 +2518,10 @@ mod tests {
         // wallet-open seam consumes).
         let attempt_for = |config_default: &str| -> (String, MintUrl, PaymentTerms) {
             let selected = request.realized_mint.as_deref().unwrap_or(config_default);
-            let mint = resolve_realized_mint(selected, &request.accepted_mints, true)
-                .expect("resolve realized mint");
+            let mint = plan_payment(selected, &request.accepted_mints, true)
+                .expect("plan payment")
+                .realized_mint()
+                .clone();
             let terms = PaymentTerms::new(
                 mint.clone(),
                 Amount::from(request.amount_sats),
diff --git a/crates/mobee-core/src/lib.rs b/crates/mobee-core/src/lib.rs
index 04e1909f..67529c56 100644
--- a/crates/mobee-core/src/lib.rs
+++ b/crates/mobee-core/src/lib.rs
@@ -11,6 +11,8 @@ pub mod profile;
 pub mod contribution;
 #[cfg(all(feature = "wallet", feature = "gateway"))]
 pub mod crossmint;
+#[cfg(all(feature = "wallet", feature = "gateway"))]
+pub mod crossmint_hop;
 pub mod delivery;
 #[cfg(feature = "git-delivery")]
 pub mod delivery_git;
diff --git a/crates/mobee-core/src/payment_wallet.rs b/crates/mobee-core/src/payment_wallet.rs
index e9af9276..f847e218 100644
--- a/crates/mobee-core/src/payment_wallet.rs
+++ b/crates/mobee-core/src/payment_wallet.rs
@@ -512,6 +512,24 @@ async fn cached_input_fee_floor(
     Ok(floor.map(|ppk| Amount::from((ppk * proof_count).div_ceil(1000))))
 }
 
+/// Live input fee for `proof_count` inputs at this mint, bounded and fail-closed.
+///
+/// The same reader and the same bound as the dust guard below, for callers that must PRICE a spend
+/// whose input count they have already bounded rather than test the N=1 floor. Never defaults the
+/// fee: a mint that will not answer refuses the spend.
+pub(crate) async fn bounded_input_fee(
+    wallet: &Wallet,
+    proof_count: u64,
+) -> Result<Amount, PaymentWalletError> {
+    match mint_input_fee_bounded(wallet, proof_count, MINT_TOUCH_TIMEOUT).await {
+        BoundedFee::Fee(fee) => Ok(fee),
+        BoundedFee::Failed(error) => Err(error),
+        BoundedFee::Unreachable(detail) => {
+            Err(mint_unreachable(wallet, MINT_UNREACHABLE_PAY, detail))
+        }
+    }
+}
+
 /// Refuse amounts that cannot yield a redeemable locked token after mint input fees.
 ///
 /// Uses the N=1 floor from the live keyset (`ceil(ppk/1000)`), bounded so a dead
diff --git a/crates/mobee-core/src/wallet_ops.rs b/crates/mobee-core/src/wallet_ops.rs
index 8c29edbb..b2a5b346 100644
--- a/crates/mobee-core/src/wallet_ops.rs
+++ b/crates/mobee-core/src/wallet_ops.rs
@@ -273,7 +273,9 @@ pub async fn open_wallet_async(
     .map_err(|error| WalletOpsError::Wallet(error.to_string()))
 }
 
-async fn poll_and_mint(
+/// Wait for a mint quote to be paid, then issue it. Refuses a phantom credit (nothing issued) and an
+/// issue that does not equal what was quoted.
+pub(crate) async fn poll_and_mint(
     wallet: &Wallet,
     quote_id: &str,
     expected_sats: u64,

From 1d4f5611b79a5d1ee72e6c5063610f82b91b9697 Mon Sep 17 00:00:00 2001
From: orveth <orveth@proton.me>
Date: Mon, 27 Jul 2026 13:16:14 -0700
Subject: [PATCH 6/9] crossmint: recover hops on both mints, and pin every
 failing leg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A hop interrupted by a crash is not something the next pay attempt necessarily
re-drives, so the buyer daemon sweeps for one at startup, before it serves. It
opens both of the hop's mints and recovers each, because cdk's saga recovery
filters to its own wallet's mint: recovering one wallet reports success having
examined half the hop. A sweep that somehow covered one mint refuses to call
the hop swept rather than reporting it done.

The teeth pin what the old membership refusal used to guarantee, at the layer
that replaced it. A cap one sat under the planned cost stops the hop before it
melts rather than failing it afterwards; a cap sized to the delivered amount
does not authorize the hop that delivers it; and no failing leg — either mint
unreachable, melt in flight, melt failed, or the target refusing to issue —
leaves a completion record or claims ecash.

`cap_charge` names the choice between the two numbers so the choice itself has
a test, rather than living inline where only a live trade would notice it
changing.
---
 crates/mobee-core/src/authorize_pay.rs | 104 ++++++++-
 crates/mobee-core/src/buyer/mod.rs     |  41 ++++
 crates/mobee-core/src/crossmint_hop.rs | 303 ++++++++++++++++++++++++-
 3 files changed, 441 insertions(+), 7 deletions(-)

diff --git a/crates/mobee-core/src/authorize_pay.rs b/crates/mobee-core/src/authorize_pay.rs
index b770feed..f3920102 100644
--- a/crates/mobee-core/src/authorize_pay.rs
+++ b/crates/mobee-core/src/authorize_pay.rs
@@ -407,7 +407,7 @@ pub async fn authorize_pay_async(
     let mut hop = match plan.hop_source() {
         None => None,
         Some(source) => {
-            let store = FsHopJournal::new(home.root.join("crossmint-journal"));
+            let store = FsHopJournal::new(crossmint_hop::hop_journal_dir(home));
             let effects =
                 CdkHopEffects::open(
                     home,
@@ -467,10 +467,7 @@ pub async fn authorize_pay_async(
     // paid, so a hop can leave the cap reporting less remaining budget than the buyer really spent.
     // That is the safe direction; reconciling reserve-versus-actual would reshape the spend ledger,
     // which is money-gate machinery and its own slice — see MakePrisms/mobee#186.
-    let charged = match hop.as_ref() {
-        Some((_, _, pairing)) => pairing.planned_cost,
-        None => amount,
-    };
+    let charged = cap_charge(hop.as_ref().map(|(_, _, pairing)| pairing), amount);
     // Delivery already verified + bind-checked above (pre-budget). The budget append happens here,
     // before any melt and before the wallet send inside `run_verified`.
     let state = gate.authorize_then_attempt(attempt_id.as_str(), charged, || {
@@ -522,6 +519,20 @@ pub(crate) fn wallet_open_mint_url(home: &MobeeHome, terms: &PaymentTerms) -> St
     mint_url
 }
 
+/// What the budget cap is asked to cover for one payment.
+///
+/// The direct path is charged the amount, exactly as it always has been — general fee-dust behaviour
+/// is a separate question and is untouched here. A hop costs the buyer more than it delivers, and
+/// every sat of that difference has to pass the cap BEFORE the melt, so a hop is charged its planned
+/// cost. A hop charged the delivered amount would put the Lightning fee reserve and the source
+/// mint's input fee on the wire without the cap ever seeing them.
+fn cap_charge(hop: Option<&crate::crossmint::HopJournal>, amount: u64) -> u64 {
+    match hop {
+        Some(pairing) => pairing.planned_cost,
+        None => amount,
+    }
+}
+
 /// Render a co-signed [`ReceiptPreimage`] as a single-line diagnostic: the digest plus every
 /// covered field. EVERY field here is public trade data already on the relay (offer/claim/result/
 /// receipt tags) — a `ReceiptPreimage` never holds a secret key or proof/token material — so this
@@ -968,6 +979,89 @@ mod tests {
         let _ = std::fs::remove_dir_all(&root);
     }
 
+    // Invariant 3 at the seam that chooses the number. The direct path charges what it always did;
+    // a hop charges what it costs, not what it delivers, because the fee reserve and the input fee
+    // reach the wire and must therefore pass the cap.
+    #[test]
+    fn the_cap_is_charged_the_hop_cost_and_the_direct_amount() {
+        let pairing = crate::crossmint::HopJournal {
+            attempt_id: "attempt-1".to_owned(),
+            source_mint: "https://a.example".to_owned(),
+            melt_quote_id: "melt-1".to_owned(),
+            target_mint: "https://b.example".to_owned(),
+            mint_quote_id: "mint-1".to_owned(),
+            delivered_sats: 100,
+            planned_cost: 109,
+        };
+        assert_eq!(cap_charge(None, 100), 100, "the direct path is unchanged");
+        assert_eq!(
+            cap_charge(Some(&pairing), 100),
+            109,
+            "a hop must be charged its cost, not the amount it delivers"
+        );
+        assert_ne!(
+            cap_charge(Some(&pairing), pairing.delivered_sats),
+            pairing.delivered_sats,
+            "charging the delivered amount would let the hop's fees past the cap"
+        );
+    }
+
+    // The replacement invariant, at the pay entry point. `mint_unreachable_pay` no longer refuses a
+    // buyer that cannot settle at the seller's mint — the hop does, or the fence does. This pins the
+    // fence half END TO END: a hop with nowhere admissible to land refuses through the real pay
+    // path, burns zero budget, and leaves no pairing on disk for a later run to resume.
+    #[test]
+    fn authorize_pay_refuses_an_inadmissible_hop_with_zero_spend_and_no_pairing() {
+        let root = std::env::temp_dir().join(format!(
+            "mobee-authorize-pay-hop-fence-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        let _ = std::fs::remove_dir_all(&root);
+        let home = home::bootstrap(&root).expect("home");
+        assert!(
+            !home.config.allow_real_mints,
+            "the default posture is what makes this refuse"
+        );
+        let mut gate = BudgetGate::from_home(&home).expect("gate");
+        let request = AuthorizePayRequest {
+            job_id: "job-hop-fence".into(),
+            result_id: "result-hop-fence".into(),
+            job_class: JobClass::FromScratch,
+            delivery_integrity_hash: "aa".repeat(20),
+            job_hash: "bb".repeat(32),
+            seller_pubkey: home::public_key_hex(&home).expect("pubkey"),
+            amount_sats: 1,
+            repo: "https://github.com/bitcoin/bips.git".into(),
+            branch: "master".into(),
+            commit_oid: "aa".repeat(20),
+            seller_signature: String::new(),
+            creq_hash: None,
+            // The buyer sits on the one fenced mint; the seller accepts only an unfenced one, so
+            // there is nowhere the hop is permitted to land.
+            accepted_mints: vec![REAL_MINT.to_string()],
+            realized_mint: Some(DEFAULT_MINT_URL.to_string()),
+            contribution: None,
+        };
+        let error = authorize_pay_blocking(&home, &mut gate, request)
+            .expect_err("an inadmissible hop target must refuse");
+        let message = error.to_string();
+        assert!(message.contains("real-mint fence"), "unexpected: {message}");
+        assert!(
+            message.contains("nowhere permitted to land"),
+            "the refusal must say the hop had no permitted target: {message}"
+        );
+        assert_eq!(gate.spent(), 0, "a refused hop must not burn budget");
+        assert!(
+            !crate::crossmint_hop::hop_journal_dir(&home).exists(),
+            "a refused hop must leave no pairing for a later run to resume"
+        );
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
     #[test]
     fn authorize_pay_refuses_buyer_hash_mismatch_vs_advertised_commit() {
         let root = std::env::temp_dir().join(format!(
diff --git a/crates/mobee-core/src/buyer/mod.rs b/crates/mobee-core/src/buyer/mod.rs
index 17da0ec6..a2d3f396 100644
--- a/crates/mobee-core/src/buyer/mod.rs
+++ b/crates/mobee-core/src/buyer/mod.rs
@@ -227,6 +227,12 @@ pub async fn run(home: MobeeHome) -> Result<(), BuyerError> {
     // must not keep the daemon from coming up (the stale reservation is conservative until the next
     // reconcile).
     run_reconcile_pass(&context).await;
+    // Finish any cross-mint hop a prior run left mid-flight, before serving. A hop whose melt landed
+    // but whose ecash was never issued is money sitting in neither wallet, and nothing else in the
+    // daemon goes looking for it — the pay attempt that started it may never be retried. Logged, not
+    // fatal, for the same reason as the reconcile above: a daemon that refuses to start is a daemon
+    // the operator cannot use to fix anything. An unrecoverable hop prints its own loud line.
+    run_hop_sweep(&context).await;
     // Re-arm pending auto-awards left by a prior run: a job posted before a crash still gets its
     // award with zero manual commands. Each task re-checks the relay for an existing award first
     // (invariant A), so re-arming never double-awards.
@@ -1067,6 +1073,41 @@ async fn run_reconcile_pass(context: &Arc<BuyerContext>) {
     }
 }
 
+/// Complete cross-mint hops a prior run left in flight, reporting UNCONDITIONALLY.
+///
+/// Silence here would be indistinguishable from a sweep that has stopped running, and this is the
+/// one path that notices a buyer's sats melted at one mint with no ecash at the other — so the pass
+/// that found nothing says so too.
+async fn run_hop_sweep(context: &Arc<BuyerContext>) {
+    match crate::crossmint_hop::sweep_hops(&context.home).await {
+        Ok(swept) if swept.is_empty() => {
+            eprintln!("buyer: cross-mint hop sweep found no hop in flight")
+        }
+        Ok(swept) => {
+            let recovered = swept
+                .iter()
+                .filter(|hop| {
+                    hop.result
+                        .as_ref()
+                        .is_ok_and(|settled| settled.recovered_strand)
+                })
+                .count();
+            let failed = swept.iter().filter(|hop| hop.result.is_err()).count();
+            eprintln!(
+                "buyer: cross-mint hop sweep resumed {} hop(s): {recovered} stranded and recovered, \
+                 {failed} still unfinished",
+                swept.len()
+            );
+        }
+        // A journal we cannot read is not a reason to refuse to serve, but it IS a reason to say so:
+        // an unreadable journal means any hop it holds is invisible until someone looks.
+        Err(error) => eprintln!(
+            "buyer: cross-mint hop sweep could not read its journal ({error}); a hop left in flight \
+             by a prior run would not have been noticed"
+        ),
+    }
+}
+
 /// Report a reconcile pass UNCONDITIONALLY — including the pass that changed nothing.
 ///
 /// Releasing a reservation is a money-visible decision: it returns funds to `available`. A path that
diff --git a/crates/mobee-core/src/crossmint_hop.rs b/crates/mobee-core/src/crossmint_hop.rs
index e4bb0779..90c47e98 100644
--- a/crates/mobee-core/src/crossmint_hop.rs
+++ b/crates/mobee-core/src/crossmint_hop.rs
@@ -268,6 +268,29 @@ impl FsHopJournal {
     fn path_for(&self, attempt_id: &str) -> PathBuf {
         self.dir.join(format!("{attempt_id}.jsonl"))
     }
+
+    /// Every attempt this journal holds records for. An absent directory means no hop has ever run
+    /// here, which is not an error.
+    pub fn attempt_ids(&self) -> Result<Vec<String>, HopError> {
+        let entries = match std::fs::read_dir(&self.dir) {
+            Ok(entries) => entries,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+            Err(error) => return Err(journal_error("read dir", error)),
+        };
+        let mut ids = Vec::new();
+        for entry in entries {
+            let path = entry.map_err(|error| journal_error("read dir entry", error))?.path();
+            if path.extension().and_then(|ext| ext.to_str()) != Some("jsonl") {
+                continue;
+            }
+            if let Some(stem) = path.file_stem().and_then(|stem| stem.to_str()) {
+                ids.push(stem.to_owned());
+            }
+        }
+        // Deterministic order so a sweep's output reads the same way twice.
+        ids.sort();
+        Ok(ids)
+    }
 }
 
 fn journal_error(context: &str, error: impl fmt::Display) -> HopError {
@@ -741,6 +764,112 @@ impl HopEffects for CdkHopEffects {
     }
 }
 
+/// One hop the sweep found unfinished and tried to complete.
+#[derive(Debug)]
+pub struct SweptHop {
+    /// The attempt whose hop was resumed.
+    pub attempt_id: String,
+    /// What resuming it did, or why it could not be finished.
+    pub result: Result<HopSettled, HopError>,
+}
+
+/// The directory a home keeps its hop pairings in.
+pub fn hop_journal_dir(home: &MobeeHome) -> PathBuf {
+    home.root.join("crossmint-journal")
+}
+
+/// Finish every hop this home left in flight.
+///
+/// A hop interrupted by a crash is not something the next pay attempt necessarily re-drives — that
+/// attempt may never be retried — so without a sweep the sats could sit melted at the source with no
+/// ecash anywhere and nothing looking for them.
+///
+/// Both wallets are opened and both are recovered before any pairing is resumed, and that is not
+/// belt-and-braces: cdk's `recover_incomplete_sagas` filters to its own wallet's mint, so a two-mint
+/// operation recovered on one wallet SILENTLY SKIPS the other mint's saga. One wallet is not half a
+/// recovery here; it is a recovery that reports success having looked at half the problem.
+///
+/// Every hop is attempted independently, and a hop that cannot be finished says so on stderr rather
+/// than being dropped from the report — including a hop whose mints the fence no longer admits,
+/// which is stuck by design but must not be stuck in silence.
+pub async fn sweep_hops(home: &MobeeHome) -> Result<Vec<SweptHop>, HopError> {
+    let store = FsHopJournal::new(hop_journal_dir(home));
+    let mut swept = Vec::new();
+    for attempt_id in store.attempt_ids()? {
+        let records = store.replay(&attempt_id)?;
+        if settled_of(&records).is_some() {
+            continue;
+        }
+        let Some(pairing) = planned_of(&records).cloned() else {
+            continue;
+        };
+        let result = sweep_one(home, &store, pairing.clone()).await;
+        if let Err(error) = &result {
+            eprintln!(
+                "CROSSMINT STRAND attempt={} could not be completed by the recovery sweep \
+                 (source {} melt quote {}, target {} mint quote {}): {error}",
+                pairing.attempt_id,
+                pairing.source_mint,
+                pairing.melt_quote_id,
+                pairing.target_mint,
+                pairing.mint_quote_id,
+            );
+        }
+        swept.push(SweptHop {
+            attempt_id,
+            result,
+        });
+    }
+    Ok(swept)
+}
+
+/// Refuse a recovery that did not cover both of the hop's mints.
+///
+/// cdk's saga recovery reports success after looking only at its own wallet's mint, so "recovery
+/// ran" and "the hop was recovered" are different claims. This turns the difference into a refusal:
+/// a sweep that somehow touched one mint stops here instead of reporting a hop as swept.
+fn require_both_mints_recovered(
+    recovered: &[String],
+    pairing: &HopJournal,
+) -> Result<(), HopError> {
+    for mint in [&pairing.source_mint, &pairing.target_mint] {
+        if !recovered.iter().any(|seen| seen == mint) {
+            return Err(HopError::Journal(format!(
+                "attempt {}: saga recovery covered {recovered:?}, which does not include {mint}; \
+                 refusing to report a hop as swept on half its mints",
+                pairing.attempt_id
+            )));
+        }
+    }
+    Ok(())
+}
+
+async fn sweep_one(
+    home: &MobeeHome,
+    store: &FsHopJournal,
+    pairing: HopJournal,
+) -> Result<HopSettled, HopError> {
+    let mut effects =
+        CdkHopEffects::open(home, &pairing.source_mint, &pairing.target_mint).await?;
+    let mut recovered = Vec::new();
+    for (label, wallet) in [("source", &effects.source), ("target", &effects.target)] {
+        bounded(
+            &format!("{label} saga recovery"),
+            HOP_LEG_TIMEOUT,
+            wallet.recover_incomplete_sagas(),
+        )
+        .await?;
+        recovered.push(wallet.mint_url.to_string());
+    }
+    require_both_mints_recovered(&recovered, &pairing)?;
+    // `run_hop` blocks (it bridges each leg onto its own runtime), so it may not run on the
+    // caller's async thread.
+    let store = store.clone();
+    tokio::task::spawn_blocking(move || run_hop(&store, &mut effects, &pairing))
+        .await
+        .map_err(|error| HopError::Mint(format!("hop sweep task: {error}")))?
+}
+
 #[cfg(test)]
 mod tests {
     use std::cell::RefCell;
@@ -748,6 +877,7 @@ mod tests {
     use std::rc::Rc;
 
     use super::*;
+    use crate::budget::{BudgetGate, BudgetRefuse};
 
     fn journal(attempt: &str) -> HopJournal {
         HopJournal {
@@ -806,8 +936,11 @@ mod tests {
             let mut world = self.world.borrow_mut();
             world.melts.push(melt_quote_id.to_owned());
             world.melt_leg = Some(MeltLeg::Paid);
-            // The target's invoice is paid by the melt, so its quote flips too.
-            world.mint_leg = Some(MintLeg::Paid);
+            // The target's invoice is paid by the melt, so its quote flips too — unless the target
+            // is unreachable (`None`), which stays unreachable no matter what the source did.
+            if world.mint_leg.is_some() {
+                world.mint_leg = Some(MintLeg::Paid);
+            }
             if world.die_after_melt {
                 return Err(HopError::Mint("process died after the melt".into()));
             }
@@ -1078,6 +1211,172 @@ mod tests {
         assert!(store.replay("attempt-2").expect("replays").is_empty());
     }
 
+    // Invariant 3, strong form. A cap one sat under the hop's planned cost must stop the hop BEFORE
+    // it melts — not fail it afterwards, by which point the sats have already left the buyer's
+    // wallet. Driven through the real `BudgetGate`, because the property being tested is that the
+    // gate never reaches the effect, and a fake gate would be testing the fake.
+    #[test]
+    fn a_cap_one_sat_under_the_planned_cost_means_no_melt_is_attempted_at_all() {
+        let pairing = journal("attempt-1");
+        let store = MemJournal::default();
+        let world = MintWorld::shared();
+        let mut effects = FakeMints {
+            world: Rc::clone(&world),
+        };
+
+        // Per-job and total caps both sit one sat under what the hop would cost.
+        let under = pairing.planned_cost.saturating_sub(1);
+        let mut gate = BudgetGate::new(under, under);
+        let refusal = gate
+            .authorize_then_attempt(&pairing.attempt_id, pairing.planned_cost, || {
+                run_hop(&store, &mut effects, &pairing)
+            })
+            .expect_err("a cap under the planned cost must refuse");
+
+        assert!(matches!(refusal, BudgetRefuse::PerJob { .. }), "{refusal}");
+        assert!(
+            world.borrow().melts.is_empty(),
+            "the melt must never be attempted when the cap refuses"
+        );
+        assert!(world.borrow().mints.is_empty());
+        assert_eq!(gate.spent(), 0, "a refused hop spends nothing");
+        assert!(
+            store.replay("attempt-1").expect("replays").is_empty(),
+            "a refused hop leaves no pairing on disk"
+        );
+
+        // The same hop at a cap that covers it does melt — so the refusal above came from the cap
+        // and not from something else refusing first.
+        let mut gate = BudgetGate::new(pairing.planned_cost, pairing.planned_cost);
+        gate.authorize_then_attempt(&pairing.attempt_id, pairing.planned_cost, || {
+            run_hop(&store, &mut effects, &pairing)
+        })
+        .expect("the cap admits the hop")
+        .expect("the hop completes");
+        assert_eq!(world.borrow().melts.len(), 1);
+        assert_eq!(gate.spent(), pairing.planned_cost);
+    }
+
+    // The cap must see the fee, not just the delivery. A cap sized to the amount the seller receives
+    // is NOT enough to authorize the hop that delivers it — which is the whole reason the hop is
+    // charged its planned cost rather than the offer amount.
+    #[test]
+    fn a_cap_sized_to_the_delivered_amount_does_not_authorize_the_hop_that_delivers_it() {
+        let pairing = journal("attempt-1");
+        assert!(
+            pairing.planned_cost > pairing.delivered_sats,
+            "the fixture must actually cost more than it delivers"
+        );
+        let store = MemJournal::default();
+        let world = MintWorld::shared();
+        let mut effects = FakeMints {
+            world: Rc::clone(&world),
+        };
+
+        let mut gate = BudgetGate::new(pairing.delivered_sats, pairing.delivered_sats);
+        let refusal = gate
+            .authorize_then_attempt(&pairing.attempt_id, pairing.planned_cost, || {
+                run_hop(&store, &mut effects, &pairing)
+            })
+            .expect_err("the fee reserve and input fee must not slip past the cap");
+        assert!(matches!(refusal, BudgetRefuse::PerJob { .. }), "{refusal}");
+        assert!(world.borrow().melts.is_empty());
+    }
+
+    // Invariant 4's trap, made into a refusal. cdk's saga recovery filters to its own wallet's
+    // mint, so a sweep that ran on one wallet would report success having examined half the hop.
+    #[test]
+    fn a_sweep_that_covered_one_mint_refuses_to_call_the_hop_swept() {
+        let pairing = journal("attempt-1");
+        require_both_mints_recovered(
+            &[pairing.source_mint.clone(), pairing.target_mint.clone()],
+            &pairing,
+        )
+        .expect("both mints covered");
+
+        for half in [&pairing.source_mint, &pairing.target_mint] {
+            let error = require_both_mints_recovered(std::slice::from_ref(half), &pairing)
+                .expect_err("one mint is not a recovery");
+            assert!(
+                error.to_string().contains("half its mints"),
+                "got: {error}"
+            );
+        }
+        // A recovery that touched two mints, but not the RIGHT two, is no better.
+        let error = require_both_mints_recovered(
+            &["https://elsewhere.example".to_owned(), pairing.source_mint.clone()],
+            &pairing,
+        )
+        .expect_err("the wrong second mint is not a recovery");
+        assert!(error.to_string().contains(&pairing.target_mint), "got: {error}");
+    }
+
+    // A melt the source mint reports as FAILED stops the attempt. Nothing left the wallet, so this
+    // is not the strand — but the quote is dead, and re-melting it is not the answer either.
+    #[test]
+    fn a_failed_melt_refuses_without_melting_again() {
+        let store = MemJournal::default();
+        let world = MintWorld::shared();
+        world.borrow_mut().melt_leg = Some(MeltLeg::Failed);
+        let mut effects = FakeMints {
+            world: Rc::clone(&world),
+        };
+        let error = run_hop(&store, &mut effects, &journal("attempt-1"))
+            .expect_err("a failed melt must refuse");
+        assert!(matches!(error, HopError::MeltFailed { .. }), "got: {error}");
+        assert!(world.borrow().melts.is_empty());
+        assert!(world.borrow().mints.is_empty());
+    }
+
+    // Every leg that can fail must leave the attempt un-completed: no completion record, so a later
+    // run re-reads the pairing and asks the mints again rather than assuming anything landed. This
+    // is the safety the old membership refusal used to provide, re-pinned at the layer that replaced
+    // it — the hop is now what stands between "cannot settle at the seller's mint" and a wrong spend.
+    #[test]
+    fn no_failing_leg_leaves_a_completion_record_behind() {
+        // Each case: how the world is broken, and the leg it breaks.
+        let cases: Vec<(&str, Box<dyn Fn(&mut MintWorld)>)> = vec![
+            (
+                "source mint unreachable",
+                Box::new(|world: &mut MintWorld| world.melt_leg = None),
+            ),
+            (
+                "melt in flight",
+                Box::new(|world: &mut MintWorld| world.melt_leg = Some(MeltLeg::Pending)),
+            ),
+            (
+                "melt failed",
+                Box::new(|world: &mut MintWorld| world.melt_leg = Some(MeltLeg::Failed)),
+            ),
+            (
+                "target mint unreachable",
+                Box::new(|world: &mut MintWorld| world.mint_leg = None),
+            ),
+            (
+                "target refuses to issue",
+                Box::new(|world: &mut MintWorld| world.mint_fails = true),
+            ),
+        ];
+        for (label, break_it) in cases {
+            let store = MemJournal::default();
+            let world = MintWorld::shared();
+            break_it(&mut world.borrow_mut());
+            let mut effects = FakeMints {
+                world: Rc::clone(&world),
+            };
+            let error = run_hop(&store, &mut effects, &journal("attempt-1"))
+                .expect_err(&format!("{label} must refuse"));
+            assert!(
+                settled_of(&store.replay("attempt-1").expect("replays")).is_none(),
+                "{label}: refused with {error}, but left a completion record"
+            );
+            assert!(
+                world.borrow().mints.is_empty(),
+                "{label}: refused but claimed ecash anyway"
+            );
+        }
+    }
+
     // A torn final record is refused, not parsed around: a half-written pairing is exactly the
     // state in which a wrong answer melts twice.
     #[test]

From 89de304fc781ba0dd8660d2c2827d67b86af28b7 Mon Sep 17 00:00:00 2001
From: orveth <orveth@proton.me>
Date: Mon, 27 Jul 2026 13:36:46 -0700
Subject: [PATCH 7/9] crossmint: format the new module, name the test's
 boxed-case type

`crossmint.rs` and `crossmint_hop.rs` are rustfmt-clean under edition 2024, and
the hand-formatted spots in `authorize_pay.rs` now match what rustfmt wants, so
the slice adds no formatting debt to a tree that already carries plenty.
---
 crates/mobee-core/src/authorize_pay.rs | 29 +++++++------
 crates/mobee-core/src/crossmint_hop.rs | 60 ++++++++++++++++----------
 2 files changed, 54 insertions(+), 35 deletions(-)

diff --git a/crates/mobee-core/src/authorize_pay.rs b/crates/mobee-core/src/authorize_pay.rs
index f3920102..31d0f5e6 100644
--- a/crates/mobee-core/src/authorize_pay.rs
+++ b/crates/mobee-core/src/authorize_pay.rs
@@ -408,13 +408,12 @@ pub async fn authorize_pay_async(
         None => None,
         Some(source) => {
             let store = FsHopJournal::new(crossmint_hop::hop_journal_dir(home));
-            let effects =
-                CdkHopEffects::open(
-                    home,
-                    &source.to_string(),
-                    &wallet_open_mint_url(home, &terms),
-                )
-                .await?;
+            let effects = CdkHopEffects::open(
+                home,
+                &source.to_string(),
+                &wallet_open_mint_url(home, &terms),
+            )
+            .await?;
             // A pairing already on disk WINS over freshly raised quotes. This attempt may have
             // melted on an earlier run, and a second melt quote for one attempt id is precisely the
             // double-pay the hop journal exists to prevent.
@@ -474,7 +473,8 @@ pub async fn authorize_pay_async(
         if let Some((store, hop_effects, pairing)) = hop.as_mut() {
             crossmint_hop::run_hop(store, hop_effects, pairing)?;
         }
-        let state = PaymentService::new(&journal).run_verified(&key, &terms, &authority, &mut effects)?;
+        let state =
+            PaymentService::new(&journal).run_verified(&key, &terms, &authority, &mut effects)?;
         Ok::<_, AuthorizePayError>(state)
     })??;
 
@@ -873,7 +873,10 @@ mod tests {
             false,
         )
         .unwrap_err();
-        assert!(error.to_string().contains("real-mint fence"), "got: {error}");
+        assert!(
+            error.to_string().contains("real-mint fence"),
+            "got: {error}"
+        );
     }
 
     // The boundary, half two. No overlap AND no admissible landing still refuses fail-closed — the
@@ -897,8 +900,8 @@ mod tests {
     // `allow_real_mints` is false (default safety posture)...
     #[test]
     fn pay_plan_real_mint_refused_by_default() {
-        let error = crate::crossmint::plan_payment(REAL_MINT, &[REAL_MINT.to_string()], false)
-            .unwrap_err();
+        let error =
+            crate::crossmint::plan_payment(REAL_MINT, &[REAL_MINT.to_string()], false).unwrap_err();
         assert!(matches!(error, AuthorizePayError::Input(_)));
         assert!(error.to_string().contains("real-mint fence"));
     }
@@ -906,8 +909,8 @@ mod tests {
     // ...and ADMITTED (pays at X when the creq lists X) once the operator opts in with the flag.
     #[test]
     fn pay_plan_real_mint_admitted_when_flag_true() {
-        let plan = crate::crossmint::plan_payment(REAL_MINT, &[REAL_MINT.to_string()], true)
-            .unwrap();
+        let plan =
+            crate::crossmint::plan_payment(REAL_MINT, &[REAL_MINT.to_string()], true).unwrap();
         assert!(!plan.is_hop());
         assert_eq!(plan.realized_mint(), &MintUrl::from_str(REAL_MINT).unwrap());
 
diff --git a/crates/mobee-core/src/crossmint_hop.rs b/crates/mobee-core/src/crossmint_hop.rs
index 90c47e98..f23b5ed3 100644
--- a/crates/mobee-core/src/crossmint_hop.rs
+++ b/crates/mobee-core/src/crossmint_hop.rs
@@ -115,7 +115,7 @@ pub enum HopError {
     ///
     /// interim: the attempt stops here rather than re-planning the melt leg against the (still
     /// unpaid) invoice at the target. Re-planning means a superseding-pairing record and a fresh
-    /// argument about pays-once, which is its own reviewed change — see MakePrisms/mobee#188.
+    /// argument about pays-once, which is its own reviewed change — see MakePrisms/mobee#194.
     MeltFailed {
         /// The attempt whose melt failed.
         attempt_id: String,
@@ -279,7 +279,9 @@ impl FsHopJournal {
         };
         let mut ids = Vec::new();
         for entry in entries {
-            let path = entry.map_err(|error| journal_error("read dir entry", error))?.path();
+            let path = entry
+                .map_err(|error| journal_error("read dir entry", error))?
+                .path();
             if path.extension().and_then(|ext| ext.to_str()) != Some("jsonl") {
                 continue;
             }
@@ -361,7 +363,8 @@ impl HopJournalStore for FsHopJournal {
         line.push(b'\n');
         file.write_all(&line)
             .map_err(|error| journal_error("append", error))?;
-        file.sync_all().map_err(|error| journal_error("sync", error))?;
+        file.sync_all()
+            .map_err(|error| journal_error("sync", error))?;
         sync_parent_directory(&path)
     }
 }
@@ -612,8 +615,12 @@ impl CdkHopEffects {
         let melt_quote = bounded(
             "source melt quote",
             MINT_TOUCH_TIMEOUT,
-            self.source
-                .melt_quote(PaymentMethod::BOLT11, mint_quote.request.clone(), None, None),
+            self.source.melt_quote(
+                PaymentMethod::BOLT11,
+                mint_quote.request.clone(),
+                None,
+                None,
+            ),
         )
         .await?;
         let cost = HopCost {
@@ -815,10 +822,7 @@ pub async fn sweep_hops(home: &MobeeHome) -> Result<Vec<SweptHop>, HopError> {
                 pairing.mint_quote_id,
             );
         }
-        swept.push(SweptHop {
-            attempt_id,
-            result,
-        });
+        swept.push(SweptHop { attempt_id, result });
     }
     Ok(swept)
 }
@@ -849,8 +853,7 @@ async fn sweep_one(
     store: &FsHopJournal,
     pairing: HopJournal,
 ) -> Result<HopSettled, HopError> {
-    let mut effects =
-        CdkHopEffects::open(home, &pairing.source_mint, &pairing.target_mint).await?;
+    let mut effects = CdkHopEffects::open(home, &pairing.source_mint, &pairing.target_mint).await?;
     let mut recovered = Vec::new();
     for (label, wallet) in [("source", &effects.source), ("target", &effects.target)] {
         bounded(
@@ -1063,7 +1066,10 @@ mod tests {
             "https://a.example",
             "https://b.example",
         ] {
-            assert!(line.contains(needle), "strand line missing {needle}: {line}");
+            assert!(
+                line.contains(needle),
+                "strand line missing {needle}: {line}"
+            );
         }
     }
 
@@ -1099,7 +1105,10 @@ mod tests {
         };
         let error = run_hop(&store, &mut effects, &journal("attempt-1"))
             .expect_err("an in-flight melt must refuse");
-        assert!(matches!(error, HopError::MeltInFlight { .. }), "got: {error}");
+        assert!(
+            matches!(error, HopError::MeltInFlight { .. }),
+            "got: {error}"
+        );
         assert!(
             world.borrow().melts.is_empty(),
             "never melt while a melt is in flight"
@@ -1297,18 +1306,21 @@ mod tests {
         for half in [&pairing.source_mint, &pairing.target_mint] {
             let error = require_both_mints_recovered(std::slice::from_ref(half), &pairing)
                 .expect_err("one mint is not a recovery");
-            assert!(
-                error.to_string().contains("half its mints"),
-                "got: {error}"
-            );
+            assert!(error.to_string().contains("half its mints"), "got: {error}");
         }
         // A recovery that touched two mints, but not the RIGHT two, is no better.
         let error = require_both_mints_recovered(
-            &["https://elsewhere.example".to_owned(), pairing.source_mint.clone()],
+            &[
+                "https://elsewhere.example".to_owned(),
+                pairing.source_mint.clone(),
+            ],
             &pairing,
         )
         .expect_err("the wrong second mint is not a recovery");
-        assert!(error.to_string().contains(&pairing.target_mint), "got: {error}");
+        assert!(
+            error.to_string().contains(&pairing.target_mint),
+            "got: {error}"
+        );
     }
 
     // A melt the source mint reports as FAILED stops the attempt. Nothing left the wallet, so this
@@ -1334,8 +1346,10 @@ mod tests {
     // it — the hop is now what stands between "cannot settle at the seller's mint" and a wrong spend.
     #[test]
     fn no_failing_leg_leaves_a_completion_record_behind() {
-        // Each case: how the world is broken, and the leg it breaks.
-        let cases: Vec<(&str, Box<dyn Fn(&mut MintWorld)>)> = vec![
+        /// How one case breaks the world, paired with the name of the leg it breaks.
+        type BrokenLeg = (&'static str, Box<dyn Fn(&mut MintWorld)>);
+
+        let cases: Vec<BrokenLeg> = vec![
             (
                 "source mint unreachable",
                 Box::new(|world: &mut MintWorld| world.melt_leg = None),
@@ -1391,7 +1405,9 @@ mod tests {
         bytes.extend_from_slice(b"{\"record\":\"settled\"");
         std::fs::write(&path, bytes).expect("write");
 
-        let error = store.replay("attempt-1").expect_err("a torn record refuses");
+        let error = store
+            .replay("attempt-1")
+            .expect_err("a torn record refuses");
         assert!(
             error.to_string().contains("torn write"),
             "expected a torn-write refusal, got: {error}"

From 48788bb3be7715de00f020d657d53d2d2796e493 Mon Sep 17 00:00:00 2001
From: orveth <orveth@proton.me>
Date: Mon, 27 Jul 2026 13:40:32 -0700
Subject: [PATCH 8/9] crossmint: the PR body, and a smoke script that refuses
 to start itself
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The smoke is the only thing that can prove real Lightning routing between two
mints, because test ecash structurally cannot hop. It is also a real-money
spend plus a money-gate config change, so it refuses unless an authorization
token names the exact amount and both mints, and it does not print that token
on refusal — a refusal that echoed it would hand it straight back to whatever
just tried to run this.

It restores the real-mint fence on both homes from an EXIT trap, whether the
trade succeeds or fails, and it asserts the thing the hop exists for: the
seller receives exactly the offer amount while the buyer is charged more.
---
 PR-BODY.md                 | 265 ++++++++++++++++++++-----------------
 scripts/crossmint-smoke.sh | 148 +++++++++++++++++++++
 2 files changed, 293 insertions(+), 120 deletions(-)
 create mode 100755 scripts/crossmint-smoke.sh

diff --git a/PR-BODY.md b/PR-BODY.md
index 363a87a2..d1d74ad5 100644
--- a/PR-BODY.md
+++ b/PR-BODY.md
@@ -1,128 +1,153 @@
-# Cross-mint payment: the buyer can pay a seller on a mint it holds no ecash at
-
-A buyer funded only at mint A can pay a seller who accepts only mint B. The buyer's own wallet does
-the hop: request a NUT-04 mint quote at **the seller's mint** (yields a bolt11) → NUT-05 **melt** from
-the buyer's funded mint to pay that invoice → receive fresh ecash at the seller's mint → hand it to the
-**existing, unchanged** send path.
-
-Lightning is connective tissue *between mints* only. The wire keeps exactly one settlement shape, so
-pays-once, the co-signed receipt, and amount-from-the-buyer-signed-offer are untouched.
-
-## The shape, and why it is not the obvious one
-
-agicash's `receive-cashu-token` solves the mirror problem — "fees eat the received amount" — with a
-bounded convergence loop: the token amount is fixed, so the **delivered** amount floats *down* until
-`melt.amount + fee_reserve` fits.
-
-Copying that direction here would break the strongest money invariant in the system. The amount is
-fixed by the **buyer-signed offer**, so delivery is pinned and the **buyer's cost** floats *up*
-instead:
-
-1. mint quote at **B** for exactly `offer.amount` → the bolt11
-2. melt quote at **A** for that bolt11 → `amount` + `fee_reserve`
-3. input fee at A (existing bounded, fail-closed reader)
-4. `planned_cost = melt.amount + melt.fee_reserve + input_fee`
-5. cap check on `planned_cost` **before** any melt — refuse ⇒ zero money moved
-6. journal the pairing, **then** melt at A → mint at B → existing send from B
-
-With delivery pinned, cost is a single forward computation and the convergence loop disappears. The
-amount the seller receives is never a function of a fee reading.
-
-## Invariant 1 — entry points to the spend gate
-
-The hop adds no path by which a seller- or mint-supplied number becomes the paid amount. The mint
-amount at B is `offer.amount`; every fee reading feeds `planned_cost` (what the *buyer* spends),
-never the delivered amount.
-
-The hop does, however, create **a new entry point to money**, found while building this slice and
-called out explicitly:
-
-- **The hop target mint.** A hop ends with the buyer holding ecash at the target. Fencing only the
-  buyer's source mint would therefore be a **real-mint back door with `allow_real_mints` off** — the
-  buyer could come to hold real-sats ecash at an unfenced mint that merely appeared in the seller's
-  accepted list. `plan_payment` fences **both** legs and refuses fail-closed ("nowhere permitted to
-  land") when no accepted mint is admissible.
-  Toothed by `hop_refuses_when_no_accepted_mint_passes_the_fence` and
-  `hop_skips_unfenced_entries_and_lands_on_the_first_admissible_one`; both confirmed to bite (below).
-
-## Recovery: the trap this design is built around
-
-`Wallet::recover_incomplete_sagas()` (cdk 0.17.2, `wallet/recovery.rs:302`) filters
-`saga.mint_url == self.mint_url && saga.unit == self.unit`. A hop has a **melt saga at A** and an
-**issue saga at B**, so recovery run on one wallet **silently skips** the other half — no error, just
-an unrecovered leg. Hop recovery therefore runs on **both** wallets, plus the repo-wide unissued-quote
-sweep, and a melted-at-A/unminted-at-B strand is surfaced **loud** rather than swept.
-
-cdk journals each half itself (`WalletSaga` carries `quote_id`, and `check_melt_quote_status(quote_id)`
-resumes off the persisted store from a cold process). The only thing cdk cannot know is that the two
-quotes are one logical hop, so that pairing — and nothing more — is what we journal, before the melt.
-
-## Deliberately not in this PR
-
-- **Fee-reserve reconciliation** → #186. The cap is charged the full `fee_reserve` before the melt; the
-  melt returns change worth `reserve − actual`, which is not credited back. The cap therefore
-  under-reports remaining allowance — the safe direction (refuses too early, never overspends). Netting
-  it would reshape `budget.rs`'s append-only fold, i.e. put a spend-gate change behind a feature review.
-  Marked `// interim:` at the charge site.
-- **The general fee-dust behaviour of `authorize_pay`** is untouched — that is #185 proper. The direct
-  path still charges `amount` exactly as before; only the hop path charges `planned_cost`.
-- **One mint list per side** → #187. Today `mint_allowed` admits exactly `DEFAULT_MINT_URL` when
-  `allow_real_mints` is off, so multi-mint is structurally unreachable in the safe posture, and
-  `extra_mints` is dead config the fence never consults.
-
-## Gate evidence — read this with eyes open
-
-The newest rust available on the build box is **1.95.0**; this repo is formatted and linted by a newer
-stable. Two of the charter's six gates therefore measure toolchain skew rather than this diff:
-
-- `cargo fmt --all -- --check` on the **pristine tip `7463cbe`, before any edit in this branch**:
-  **rc=1, 733 diffs**, in files this PR never opens.
-- `cargo clippy --no-default-features --features gateway,git-delivery,wallet --all-targets -- -D warnings`:
-  **57 errors across 20 files, all pre-existing** (authorize_pay, budget, buyer/*, gateway,
-  seller_node/*, wallet_ops, …). The run found exactly **one** lint in this PR's own file
-  (`assert_eq!` against a bool literal); it is fixed, taking the count 58 → 57.
-- This PR's own files are clean by both: `rustfmt --edition 2024 --check crossmint.rs` → **rc=0**, and
-  **0** clippy hits naming `crossmint.rs`.
-- **CI runs neither fmt nor clippy.** `.github/workflows/ci.yml` is build + test only, on
-  `dtolnay/rust-toolchain@stable`. The charter's fmt/clippy gates are stricter than CI.
-
-Per-file evidence was accepted for this slice specifically so a feature slice does not carry a
-fleet-wide toolchain change; the whole-tree question is tracked separately as a standing gate condition
-on this box.
-
-Note when reproducing: `rustfmt --check lib.rs` recurses the entire crate through `mod` declarations
-and will hand back the tip's 733 diffs — check the individual file.
-
-## Teeth
-
-Decision seam, 9 tests, all green. Both mutations were run **after** committing, and bite specifically
-rather than blanket:
+# Cross-mint hop: pay a seller at a mint the buyer holds nothing at
 
-```
-clean:       test result: ok. 9 passed; 0 failed   (rc=0)
+A buyer funded only at mint A could not pay a seller who accepts only mint B. Now it can: the buyer's own wallet raises a NUT-04 mint quote at B, melts at A to pay that invoice, and holds fresh ecash at B — where the existing send path takes over completely unchanged. Lightning is connective tissue between the two mints and nothing more, so the wire still carries exactly one settlement shape, and pays-once, the co-signed receipt, and amount-from-the-buyer-signed-offer are untouched by it.
+
+## Delivery is pinned; the buyer's cost floats
+
+The reference pattern for this (agicash's `receive-cashu-token`) solves the fee problem the other way round: it pins the token amount and lets the **delivered** amount float DOWN through a bounded convergence loop until the fees fit. That is precisely what our strongest money invariant forbids — the seller receives the amount they signed for.
 
-mutation 1 — overlap no longer short-circuits to Direct        -> rc=101
-  buyer_mint_in_accepted_set_pays_direct_without_hopping ... FAILED
-  buyer_mint_listed_but_not_first_still_pays_direct ... FAILED
-  (the other 7 still ok)
+So the direction is inverted here. Delivery is pinned at `offer.amount` and the **buyer's cost** floats up:
 
-mutation 2 — hop-target fence dropped, .find(fenced) -> .next() -> rc=101
-  hop_refuses_when_no_accepted_mint_passes_the_fence ... FAILED
-  hop_skips_unfenced_entries_and_lands_on_the_first_admissible_one ... FAILED
-  (the other 7 still ok)
 ```
+planned_cost = melt.amount + melt.fee_reserve + input_fee
+```
+
+Two consequences worth stating: the convergence loop disappears entirely (cost is one forward computation), and the fixed-delivery invariant holds *by construction* — the amount the seller receives is never a function of any fee reading.
+
+## ⚠ A documented refusal disappears
+
+**`mint_unreachable_pay` is unreachable on the pay path as of this slice.** "The single-mint buyer wallet holds no balance at any accepted mint" was a refusal; it is now a hop. That is the feature, but it is also a safety property being removed, so here is what replaces it.
+
+**The covering refusal is the target fence.** A hop ends with the buyer holding ecash at the target, so an unfenced target would be a real-mint back door with `allow_real_mints` off — a NEW entry point to money created by this slice. `plan_payment` fences the source AND the target and refuses fail-closed when no accepted mint is admissible. Both halves of the boundary are pinned by tests sitting next to each other:
+
+- `pay_plan_hops_when_the_configured_mint_is_not_listed_but_the_target_is_admissible` — the old refusal's fixture, now asserting the decision that replaced it.
+- `pay_plan_refuses_when_no_overlap_and_no_accepted_mint_is_admissible` — no admissible landing still refuses.
+- `pay_plan_refuses_a_no_overlap_hop_under_the_default_posture` — with the flag off the fence admits exactly one mint, so a hop is **structurally unreachable in the default posture**. The operator's opt-in is what makes two distinct admissible mints possible at all.
+- `authorize_pay_refuses_an_inadmissible_hop_with_zero_spend_and_no_pairing` — the same refusal end-to-end through the real pay path: zero budget burned, no pairing left on disk for a later run to resume.
+
+### The replacement invariant: the hop fails closed at every leg
+
+With the membership refusal gone, the hop is what now stands between "cannot settle at the seller's mint" and a wrong or partial spend. Every leg refuses without spending:
+
+| leg | what fails | what happens |
+|---|---|---|
+| plan | fence rejects source or target | refuse before the gate — **zero charge** |
+| plan | mint quote / melt quote / fee read fails or times out | refuse before the gate — **zero charge** |
+| plan | source wallet cannot cover `planned_cost` | refuse before the gate — **zero charge** |
+| gate | cap below `planned_cost` | the effect never runs, so **no melt is attempted at all** |
+| melt | source mint reports `Pending` | refuse, never melt again (money may be in flight) |
+| melt | source mint reports `Failed` | refuse; nothing left the wallet (see #194) |
+| mint | target unreachable or refuses to issue | refuse; no completion record, no ecash claimed |
+| mint | target issues an amount ≠ the pinned delivery | refuse rather than carry a short amount into the send |
+
+`no_failing_leg_leaves_a_completion_record_behind` drives all five reachable failure legs and asserts, for each, that no completion record was written and no ecash was claimed.
+
+## The decision seam turned out to be three seams
+
+`resolve_realized_mint` had **three** production callers, and wiring only the pay path would have shipped this feature dead — the other two refuse a no-overlap claim before the pay path ever sees it:
+
+1. `job_lifecycle::accept` — sealed the realized mint and refused no-overlap ("never accepted into an unpayable bind"), so such a job never reached `authorize_pay`.
+2. `buyer::lifecycle::claim_is_payable` — the award filter. Its own comment claimed "the SAME resolution the pay path performs", so the buyer would never even award a claim it can now settle. That comment is rewritten to the new truth.
+
+All three now call `crossmint::plan_payment`; `resolve_realized_mint` is deleted.
+
+### Why the accept-bind still seals the buyer's own mint
+
+The seal stays the buyer's **selected (funded)** mint, not the hop target. Sealing the target would break the feature: at pay time the sealed value would already be in the accepted set, `plan_payment` would say `Direct`, and the hop would never fire — a direct payment from a mint the buyer holds nothing at.
+
+Attempt-id stability is preserved without storing a second field. On the direct path the sealed value is byte-identical to before (the old resolver returned the buyer's own mint in every `Ok` branch). For a hop, the realized mint is re-derived deterministically from two values that are *both* frozen at accept — the sealed selection and the accepted set beside it — so a config-default change after accept still cannot shift the attempt id. `the_sealed_source_replans_into_the_same_plan` pins exactly that.
+
+## Pays-once across two mints
+
+cdk journals each leg on its own: a melt quote's state is recoverable from a cold process by quote id, and a mint quote that was paid but never issued can still be issued later. The one thing nothing in cdk knows is that the two quotes are **one hop** — so that pairing, and nothing more, is what gets journalled, before the melt.
+
+That ordering is what makes the melt leg safe to re-enter, and it is stronger than marking a melt "initiated" once the mint reports it pending — that leaves a window where money is in flight and the flag says otherwise.
+
+**On a resumed attempt the persisted quote ids WIN over freshly planned ones.** Raising a second melt quote for one attempt id is exactly the double-pay the journal exists to prevent; a pairing that disagrees with the persisted one is refused outright rather than reconciled.
 
-Invariant 2 is toothed on the **decision** (`PayPlan::Direct`), not on a downstream outcome — a hop
-that happened and then coincidentally produced the right amount would still be a bug.
+The resume decision is taken from what the mints say, never from what we infer:
 
-Also note a gate-hygiene trap worth not repeating: `cargo test -p mobee-core crossmint::` returns
-**rc=0 with zero tests run**, because `wallet`/`gateway` are not default features and the module is
-cfg-gated out. Assert the test **count**, not the rc. Correct invocation:
-`cargo test -p mobee-core --features wallet crossmint::`.
+| melt at source | mint at target | action |
+|---|---|---|
+| `Unpaid` | — | nothing left; melt (the mint's own answer, not a guess) |
+| `Pending` | — | money in flight; refuse, never melt again |
+| `Paid` | not issued | **the strand** — issue at the target, and say so LOUDLY |
+| `Paid` | issued | complete without touching either mint |
+
+The strand row is the one that must never pass in silence: a buyer whose sats left the source but whose ecash never arrived has money that is neither spent nor held.
+
+## Recovery runs on both mints, or refuses to call it recovery
+
+cdk's `recover_incomplete_sagas` filters to its own wallet's mint. A two-mint operation recovered on one wallet **silently skips the other mint's saga** — it reports success having examined half the problem. The buyer daemon's startup sweep opens both mints and recovers each, and `require_both_mints_recovered` turns a half-covered sweep into a refusal rather than a false "swept".
+
+The sweep exists because a hop interrupted by a crash is not something the next pay attempt necessarily re-drives: that attempt may never be retried, and the sats would sit melted at the source with no ecash anywhere and nothing looking for them. It reports unconditionally, including the pass that found nothing — silence would be indistinguishable from a sweep that has stopped running.
+
+## Teeth, and the mutations that prove they bite
+
+**577 workspace tests pass (`cargo test --workspace`, rc=0)**, up from 546 on the merge base. Seven mutations were each reverted after proving a *specific* tooth fails — not a blanket failure:
+
+| mutation | tooth that fails |
+|---|---|
+| overlap no longer plans `Direct` | the two decision teeth |
+| target fence dropped | the two fence teeth |
+| input fee dropped from the cap total | the cap-arithmetic tooth |
+| persisted pairing no longer wins | `a_second_pairing_for_one_attempt_is_refused_rather_than_melted` |
+| strand completed but not reported | `kill_between_melt_and_mint_pays_once_on_restart_and_reports_the_strand` |
+| recovery guard checks only the source | `a_sweep_that_covered_one_mint_refuses_to_call_the_hop_swept` |
+| cap charged `delivered_sats`, not `planned_cost` | `the_cap_is_charged_the_hop_cost_and_the_direct_amount` |
+
+`cap_charge` exists as a named function precisely so that last mutation has somewhere to bite; inline, only a live trade would have noticed it change.
+
+The kill-between-legs tooth is the strong form of pays-once: the run dies after the melt lands, a restart resumes from the journal, and the assertion is that the second run melts **zero** times, issues exactly once, and reports the strand.
+
+## Scoped out, named rather than hidden
+
+- **#186 — the fee reserve is charged in full.** A hop's cap charge includes the whole Lightning fee reserve, never reconciled against the fee actually paid, so a hop can leave the cap reporting *less* remaining budget than the buyer really spent. That is the safe direction. Reconciling reserve-versus-actual reshapes the spend ledger, which is money-gate machinery and its own slice. Marked `// interim:` at the charge site.
+- **The input fee is an upper bound.** The melt selects its inputs when it runs, so the exact count is not knowable before the cap check; it is priced at every unspent proof at the source — the most the melt could possibly select. Over-states rather than under-states, because under-stating would put a fee on the wire the cap never saw, which is the #185 defect class.
+- **#194 — a `Failed` melt dead-ends the attempt.** Recovering it means a superseding melt quote against the still-unpaid target invoice, which turns the melt leg into a sequence and requires every pays-once argument to be re-made over that sequence. Marked `// interim:` in code.
+- **#187 — one mint list per side.** The fence hardcodes a single admissible mint and `extra_mints` is dead config, which is why a hop needs `allow_real_mints` to be reachable at all.
+- **"Both wallets recovered" has no hermetic tooth.** Proving it would mean faking a cdk `Wallet` faithfully enough to reproduce its per-mint saga filtering. Instead the property is a runtime refusal, and the guard that enforces it *is* toothed. That is the honest form when the dependency cannot be faked: enforce it at runtime and test the enforcement.
+
+## No live cross-mint trade has been run
+
+Test ecash **structurally cannot hop**: fake mints cannot pay each other's invoices over real Lightning. So control flow, the journal, budget accounting and recovery are proven hermetically; **real Lightning routing between two mints is not.** A live cross-mint smoke is a real-money spend plus a money-gate config change, and is gated on the repo owner. The smoke script is written ready-to-run for the moment that authorization arrives.
+
+## ⚠ Gate evidence — this box's toolchain is older than the tree's
+
+The newest Rust available here is **1.95.0**; the tree is formatted and linted by a newer stable. On the **pristine** merge base `7463cbe`, before a single edit:
+
+- `cargo fmt --all -- --check` → **rc=1, 733 diffs**
+- money-combo clippy `--all-targets -- -D warnings` → **57 errors across 20 files**
+
+**CI runs neither fmt nor clippy** — `.github/workflows/ci.yml` is build + test only, on `dtolnay/rust-toolchain@stable`. Whole-tree fmt and clippy on this box therefore measure toolchain skew, not this diff, so the evidence below is per-file against that same merge base:
+
+| file | fmt hunks (base → branch) | clippy hits (base → branch) |
+|---|---|---|
+| `crossmint.rs` | new file → **0** | new file → **0** |
+| `crossmint_hop.rs` | new file → **0** | new file → **0** |
+| `authorize_pay.rs` | 28 → 26 | 13 → 4 |
+| `job_lifecycle.rs` | 53 → 53 | 5 → 5 |
+| `payment_wallet.rs` | 29 → 29 | 0 → 0 |
+| `wallet_ops.rs` | 13 → 13 | 1 → 1 |
+| `buyer/mod.rs` | 135 → 135 | 3 → 3 |
+| `buyer/lifecycle.rs` | 33 → 33 | 1 → 1 |
+
+Both new modules are fmt-clean and clippy-clean. No touched file gains a single fmt hunk or clippy hit; `authorize_pay.rs` loses several because the superseded resolver went with them. Whole-crate clippy goes **57 → 48**. Provisioning a matching toolchain fleet-wide is a separate call and deliberately does not ride this slice.
+
+Counting is per-hunk rather than per-byte on purpose: rustfmt prints the absolute path in every hunk header, so byte totals differ between two checkouts for reasons that have nothing to do with the code.
+
+## Gates run
+
+```
+cargo test --workspace                                                        rc=0   577 lib tests
+cargo test -p mobee-core --no-default-features \
+           --features gateway,git-delivery,wallet                             rc=0   577 lib tests
+cargo test -p mobee-core --features acp                                       rc=0   170 tests
+cargo build -p mobee --release                                                rc=0
+rustfmt --edition 2024 --check   (per file, table above)                      rc=0 on both new modules
+cargo clippy  (money combo, --all-targets -D warnings)                        0 hits on either new module
+```
 
-## Live smoke
+Every feature combo the slice ships in is compiled, not just the money set — a cfg-gated module is invisible to a gate that never enables its cfg.
 
-Test ecash structurally cannot hop — fake mints cannot pay each other's invoices over real Lightning —
-so the live proof is a small **real-sats** cross-mint trade. That is a real-money spend and a
-money-gate config change, so it is gudnuf-gated and not executed as part of this PR. The smoke script
-is written to be ready-to-run the moment authorization arrives.
+One gate-hygiene trap worth not repeating: `cargo test -p mobee-core crossmint::` returns **rc=0 with zero tests run**, because `wallet`/`gateway` are not default features and the module is cfg-gated out. Assert the test **count**, not the rc.
diff --git a/scripts/crossmint-smoke.sh b/scripts/crossmint-smoke.sh
new file mode 100755
index 00000000..cdbe2ce3
--- /dev/null
+++ b/scripts/crossmint-smoke.sh
@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+#
+# Live cross-mint hop smoke — a small REAL-SATS trade between two different mints.
+#
+# ┌───────────────────────────────────────────────────────────────────────────────────────────┐
+# │ THIS SCRIPT SPENDS REAL MONEY AND REQUIRES A MONEY-GATE CONFIG CHANGE.                     │
+# │ It refuses to run without an explicit authorization token naming the exact amount and      │
+# │ both mints, so it cannot be started by an agent, a retry, or a stray shell history entry.  │
+# └───────────────────────────────────────────────────────────────────────────────────────────┘
+#
+# Why this exists at all: test ecash structurally CANNOT hop. Fake mints cannot pay each other's
+# invoices over real Lightning, so the hermetic teeth prove control flow, the journal, budget
+# accounting and recovery — but not real LN routing between two mints. This is the only thing that
+# proves that leg, and it is the reason the slice ships with that caveat stated rather than hidden.
+#
+# Usage (after authorization):
+#   CROSSMINT_SMOKE_AUTH="<amount>:<source-mint>:<target-mint>" ./scripts/crossmint-smoke.sh
+#
+# The token must match the three values below exactly. Change the values, and the token stops
+# matching — which is the point: authorization is for one specific spend, not for the script.
+
+set -euo pipefail
+
+# ── The authorized spend ────────────────────────────────────────────────────────────────────────
+# Fill these in from the authorization, then hand the operator the matching CROSSMINT_SMOKE_AUTH.
+AMOUNT_SATS="${AMOUNT_SATS:-}"       # what the seller receives (the buyer pays this plus hop fees)
+SOURCE_MINT="${SOURCE_MINT:-}"       # the mint the buyer holds sats at
+TARGET_MINT="${TARGET_MINT:-}"       # the mint the seller accepts — MUST differ from SOURCE_MINT
+BUYER_HOME="${BUYER_HOME:-}"         # buyer home whose config gets allow_real_mints
+SELLER_HOME="${SELLER_HOME:-}"       # seller home advertising TARGET_MINT
+
+MOBEE="${MOBEE:-./target/release/mobee}"
+
+die() { echo "crossmint-smoke: $*" >&2; exit 1; }
+
+# ── Gate ────────────────────────────────────────────────────────────────────────────────────────
+for var in AMOUNT_SATS SOURCE_MINT TARGET_MINT BUYER_HOME SELLER_HOME; do
+    [ -n "${!var}" ] || die "$var is not set — fill in the authorized values first"
+done
+[ "$SOURCE_MINT" != "$TARGET_MINT" ] || die "source and target mints are identical; that is a direct payment, not a hop"
+
+expected_auth="${AMOUNT_SATS}:${SOURCE_MINT}:${TARGET_MINT}"
+# The token is not printed on refusal, deliberately. Its job is to make the run DELIBERATE — a human
+# naming the amount and both mints — and a refusal that echoed the expected value would hand that
+# right back to whatever just tried to run this, which is exactly the caller it exists to stop.
+[ "${CROSSMINT_SMOKE_AUTH:-}" = "$expected_auth" ] || die \
+"refusing to spend real sats without matching authorization.
+CROSSMINT_SMOKE_AUTH must be set to '<amount>:<source-mint>:<target-mint>' for the spend that was
+actually authorized. This is real money and a money-gate config change: it is authorized by a human
+naming those three values, never by an agent and never by a retry."
+
+echo "=== crossmint smoke: ${AMOUNT_SATS} sats, ${SOURCE_MINT} -> ${TARGET_MINT} ==="
+
+# ── 0. Record the before-state, so the after-state means something ──────────────────────────────
+echo "--- balances before ---"
+"$MOBEE" --home "$BUYER_HOME"  wallet balances
+"$MOBEE" --home "$SELLER_HOME" wallet balances
+before_spent=$("$MOBEE" --home "$BUYER_HOME" budget status --json | jq -r '.spent_total_sats')
+echo "buyer spent before: ${before_spent}"
+
+# ── 1. Money-gate config: allow_real_mints on both homes ────────────────────────────────────────
+# THIS IS THE MONEY-GATE CHANGE. It is part of what was authorized, and it is reverted in step 6
+# whether the trade succeeds or fails.
+restore_fence() {
+    echo "--- restoring the real-mint fence on both homes ---"
+    "$MOBEE" --home "$BUYER_HOME"  config set allow_real_mints false || true
+    "$MOBEE" --home "$SELLER_HOME" config set allow_real_mints false || true
+}
+trap restore_fence EXIT
+
+"$MOBEE" --home "$BUYER_HOME"  config set allow_real_mints true
+"$MOBEE" --home "$SELLER_HOME" config set allow_real_mints true
+
+# The buyer holds sats ONLY at the source; the seller accepts ONLY the target. That non-overlap is
+# the whole experiment — if they overlap, the pay path plans Direct and proves nothing.
+"$MOBEE" --home "$BUYER_HOME"  config set default_mint  "$SOURCE_MINT"
+"$MOBEE" --home "$SELLER_HOME" config set accepted_mints "$TARGET_MINT"
+
+buyer_balance=$("$MOBEE" --home "$BUYER_HOME" wallet balances --json \
+    | jq -r --arg m "$SOURCE_MINT" '.[] | select(.mint_url == $m) | .balance_sats')
+[ -n "$buyer_balance" ] && [ "$buyer_balance" -gt "$AMOUNT_SATS" ] || die \
+    "buyer holds ${buyer_balance:-0} sats at ${SOURCE_MINT}; the hop needs more than ${AMOUNT_SATS} (delivery plus fees)"
+
+# ── 2. Run one trade ────────────────────────────────────────────────────────────────────────────
+# Nothing here is hop-specific: it is an ordinary trade, which is the point. The hop is chosen
+# inside the pay path because the mints do not overlap, and every other step is unchanged.
+echo "--- posting and settling one job ---"
+job_id="crossmint-smoke-$(date -u +%Y%m%dT%H%M%SZ)"
+"$MOBEE" --home "$BUYER_HOME" job post --id "$job_id" --amount "$AMOUNT_SATS" --spec "cross-mint hop smoke"
+"$MOBEE" --home "$BUYER_HOME" job settle --id "$job_id" --wait
+
+# ── 3. What has to be true ──────────────────────────────────────────────────────────────────────
+echo "--- assertions ---"
+outcome=$("$MOBEE" --home "$BUYER_HOME" job show --id "$job_id" --json)
+
+state=$(echo "$outcome"        | jq -r '.state')
+amount_sats=$(echo "$outcome"  | jq -r '.amount_sats')
+charged_sats=$(echo "$outcome" | jq -r '.charged_sats')
+
+[ "$state" = "Paid" ]                  || die "job state is ${state}, expected Paid"
+# THE headline assertion: the seller received exactly the offer amount, and the hop's fees came out
+# of the BUYER's cost rather than the seller's delivery.
+[ "$amount_sats" = "$AMOUNT_SATS" ]    || die "seller received ${amount_sats}, expected exactly ${AMOUNT_SATS} — delivery is supposed to be pinned"
+[ "$charged_sats" -gt "$amount_sats" ] || die "charged ${charged_sats} vs delivered ${amount_sats}: a hop must cost the buyer MORE than it delivers (fee reserve + input fee), so this did not hop"
+
+# The receipt binds the TARGET mint: after the hop, that is where the seller's ecash lives.
+receipt_mint=$(echo "$outcome" | jq -r '.receipt.mint')
+[ "$receipt_mint" = "$TARGET_MINT" ]   || die "receipt binds ${receipt_mint}, expected the hop target ${TARGET_MINT}"
+
+# The hop journal recorded the pairing and completed it — one hop, both quote ids, settled.
+journal="${BUYER_HOME}/crossmint-journal"
+attempt_id=$(echo "$outcome" | jq -r '.attempt_id')
+[ -f "${journal}/${attempt_id}.jsonl" ] || die "no hop journal at ${journal}/${attempt_id}.jsonl — the pay path did not hop"
+grep -q '"record":"planned"' "${journal}/${attempt_id}.jsonl" || die "hop journal has no pairing record"
+grep -q '"record":"settled"' "${journal}/${attempt_id}.jsonl" || die "hop journal never settled — a leg is stranded"
+
+# The budget moved by the hop's COST, not by the delivered amount.
+after_spent=$("$MOBEE" --home "$BUYER_HOME" budget status --json | jq -r '.spent_total_sats')
+delta=$(( after_spent - before_spent ))
+[ "$delta" = "$charged_sats" ] || die "budget moved ${delta} but the hop charged ${charged_sats}"
+
+echo "--- balances after ---"
+"$MOBEE" --home "$BUYER_HOME"  wallet balances
+"$MOBEE" --home "$SELLER_HOME" wallet balances
+
+# ── 4. Pays-once under a restart ────────────────────────────────────────────────────────────────
+# Re-driving a settled attempt must touch neither mint. This is the live form of the hermetic
+# exactly-once tooth, and it is cheap: if it is wrong, it costs another AMOUNT_SATS and we find out.
+echo "--- re-driving the settled attempt (must be a no-op) ---"
+"$MOBEE" --home "$BUYER_HOME" job settle --id "$job_id" --wait || true
+replay_spent=$("$MOBEE" --home "$BUYER_HOME" budget status --json | jq -r '.spent_total_sats')
+[ "$replay_spent" = "$after_spent" ] || die \
+    "PAYS-ONCE VIOLATED: re-driving the attempt moved the budget from ${after_spent} to ${replay_spent}"
+
+# ── 5. The startup sweep sees a finished hop and leaves it alone ────────────────────────────────
+echo "--- restarting the buyer daemon (the sweep must find nothing to resume) ---"
+"$MOBEE" --home "$BUYER_HOME" buyer restart 2>&1 | tee /dev/stderr | grep -q "cross-mint hop sweep" \
+    || die "the daemon did not report a hop sweep at startup"
+
+echo
+echo "=== SMOKE PASSED ==="
+echo "  delivered to seller : ${amount_sats} sats at ${TARGET_MINT}"
+echo "  charged to buyer    : ${charged_sats} sats (hop fees = $(( charged_sats - amount_sats )))"
+echo "  attempt             : ${attempt_id}"
+echo
+echo "Report the delivered/charged pair and the fee delta — the gap between them IS the hop, and it"
+echo "is the number #186 will later reconcile."
+# The EXIT trap restores allow_real_mints=false on both homes from here.

From daf499d564f1ea0d2cf689eb130df2abfe264b88 Mon Sep 17 00:00:00 2001
From: orveth <orveth@proton.me>
Date: Mon, 27 Jul 2026 13:41:14 -0700
Subject: [PATCH 9/9] crossmint: keep the research report and PR body out of
 the product tree

Both are scaffolding for shipping this change, not part of what ships. The
argument for the design belongs in the PR description and the module docs,
where a reader who has never seen this branch will actually find it; a
PR-BODY.md checked into dev is a copy that goes stale the moment the PR is
edited.
---
 CROSSMINT-RESEARCH.md | 353 ------------------------------------------
 PR-BODY.md            | 153 ------------------
 2 files changed, 506 deletions(-)
 delete mode 100644 CROSSMINT-RESEARCH.md
 delete mode 100644 PR-BODY.md

diff --git a/CROSSMINT-RESEARCH.md b/CROSSMINT-RESEARCH.md
deleted file mode 100644
index e91ee211..00000000
--- a/CROSSMINT-RESEARCH.md
+++ /dev/null
@@ -1,353 +0,0 @@
-# Cross-mint hop — research report (worker:mobee-crossmint, 2026-07-27)
-
-Charter: `/srv/forge/projects/mobee-seller-node/CROSSMINT-CHARTER.md` · parent: keeper:mobee-orchestrator
-Ground truth read: cdk `=0.17.2` (the pinned version, vendored at
-`~/.cargo/registry/src/index.crates.io-*/cdk-0.17.2` + `cdk-common-0.17.2`), agicash @ `23788b7c`,
-mobee @ `origin/dev` `7463cbe`.
-
-⚠ Do NOT read `/srv/forge/projects/cdk` for this work — it is the MakePrisms fork at **v0.16.0-48**,
-not the version mobee compiles against.
-
-## Verdict
-
-**No cross-mint primitive exists in cdk 0.17.2 — we build the hop.** But both halves already exist
-*in mobee* as separate CLI ops, and cdk gives us persisted, quote-id-addressable crash recovery for
-each half. So this is a **composition over existing money machinery**, not new money machinery. The
-agicash pattern gives us the fee decomposition, and its loop **inverts** for our invariant 1 (below —
-this is the sharpest finding).
-
-## 1. cdk 0.17.2 — what's actually there
-
-**Cross-mint transfer primitive: NO.**
-- `cdk-common-0.17.2/src/error.rs:410` declares `Error::TransferTimeout { source_mint, target_mint, amount }`
-  — but it is a **dead variant**: never constructed anywhere in `cdk` or `cdk-common` (only declared
-  and classified in a match arm at `error.rs:755`). It is a leftover surface, not a feature.
-- No `MultiMintWallet` in 0.17.2.
-- The fork's `cdk-cli/src/sub_commands/transfer.rs` "transfer" is `source.prepare_send()` →
-  `target.receive(token)` — that is a same-mint move mislabelled; receiving a mint-A token at a
-  mint-B wallet is rejected (`Error::IncorrectMint` / `MultiMintTokenNotSupported`). **Not a model to copy.**
-
-**Multi-mint wallet management: YES — `WalletRepository`** (`cdk/src/wallet/wallet_repository.rs`).
-One shared `localstore` + one seed, N wallets keyed by `WalletKey { mint_url, unit }`:
-`get_wallet(mint_url, unit)`, `add_wallet`, `has_mint`, `get_balances`, `total_balance`.
-This is how we hold mint A and mint B at once without two databases.
-
-**Quote lifecycle (both halves).**
-- Mint side (NUT-04), `cdk/src/wallet/issue/mod.rs`:
-  `mint_quote(PaymentMethod, Option<Amount>, description, extra) -> MintQuote` (`:106`) — the
-  `MintQuote.request` field IS the bolt11 we need; `mint(...)` (`:416`); `check_mint_quote_status(quote_id)` (`:286`).
-- Melt side (NUT-05), `cdk/src/wallet/melt/mod.rs`:
-  `melt_quote(method, request, options, extra) -> MeltQuote` (`:1156`); `check_melt_quote_status(quote_id)` (`:1260`).
-
-**Fee reserve reporting: YES, as a first-class field.**
-`cdk-common/src/wallet/mod.rs:215` — `MeltQuote { amount, fee_reserve, state, used_by_operation, version, .. }`.
-`amount` and `fee_reserve` are **separate** — exactly the two numbers invariant 3 must add up.
-Mint (input/keyset) fee is the third: `cdk/src/fees.rs::calculate_fee`.
-
-**Saga machinery (this is the good news).** Every wallet money op is a typed saga with a persisted
-record and a resume path: `wallet/{melt,issue,send,receive,swap}/saga/{mod,state,resume,compensation}.rs`.
-`cdk-common/src/wallet/saga/mod.rs:162` — `WalletSaga { id, kind, state, amount, mint_url, unit,
-quote_id: Option<String>, data, version, .. }`. `version` is optimistic-locking; the doc says a
-version conflict means "someone else handled it — skip", which is our multi-process safety net.
-
-## 2. Parent's question: is melt quote state recoverable by quote id after process death?
-
-**Yes — recoverable by quote id, from a cold process, without a live wallet handle.** Mechanism:
-
-1. The quote itself is **persisted in the wallet DB** (sqlite), not in-memory:
-   `check_melt_quote_status(quote_id)` (`melt/mod.rs:1260`) starts with
-   `self.localstore.get_melt_quote(quote_id)` → `Error::UnknownQuote` if absent.
-2. The quote row carries `used_by_operation: Option<String>` → the saga UUID. The function then does
-   `localstore.get_saga(&operation_id)` and, if a saga exists, calls `resume_melt_saga(&saga)` — i.e.
-   **asking for the quote's status is itself the recovery trigger.**
-3. `resume_melt_saga` (`melt/saga/resume.rs:20`) queries the mint and either finalizes or compensates.
-   Its contract: `Ok(Some(FinalizedMelt))` = finalized or compensated; **`Ok(None)` = still pending or
-   mint unreachable → skipped** (retry later); `Err` = recovery error.
-4. Cold-start sweep: `Wallet::recover_incomplete_sagas()` (`wallet/recovery.rs:302`) reads
-   `localstore.get_incomplete_sagas()` and dispatches per kind. Also
-   `get_pending_melt_quotes()` / `get_active_melt_quotes()` (`melt/mod.rs:970,983`) read from the store,
-   and `finalize_pending_melts()` (`:749`).
-
-**So the primitive's shape, before we design the journal:** we do NOT need to journal melt state
-ourselves — cdk already journals it. What we MUST journal is the **pairing** (which melt quote at A
-belongs to which mint quote at B, for which job/attempt), because nothing in cdk knows the two quotes
-are one logical hop. That's the whole content of our journal: `(attempt_id, mint_a, melt_quote_id,
-mint_b, mint_quote_id, planned_cost)` written **before** the melt fires.
-
-**⚠ Trap that hangs directly off this** (and it is why per-wallet recovery is not enough):
-`recover_incomplete_sagas()` filters `sagas.retain(|s| s.mint_url == self.mint_url && s.unit == self.unit)`
-(`recovery.rs:308-311`). A hop has one saga at **mint A** (melt) and one at **mint B** (issue). Recovery
-run on the mint-A wallet **silently skips** the mint-B saga and vice versa. A single-wallet startup
-sweep therefore leaves half the hop unrecovered, with no error — the exact "absent signal from a
-changed source" shape. ⇒ **the hop's recovery must run on both wallets** (or over
-`WalletRepository::get_wallets()`).
-
-**The paid-but-unminted strand has a purpose-built sweeper.** `MintQuote` tracks `amount_paid` vs
-`amount_issued` with `amount_mintable()` (`cdk-common/src/wallet/mod.rs:303`; for BOLT11 it is
-all-or-nothing on `state == Paid`). `Wallet::mint_unissued_quotes()` (`issue/mod.rs:340`) +
-`get_unissued_mint_quotes()` (`:408`) find and complete them, and
-**`WalletRepository::check_all_mint_quotes(None)` (`wallet_repository.rs:822`) iterates every wallet and
-calls `mint_unissued_quotes()` on each** — repo-wide, which is what the cross-mint case needs. So
-"melted at A, paid at B, crashed before minting at B" is recoverable and must be surfaced loudly, not
-silently swept.
-
-## 3. agicash `receive-cashu-token` — the fee pattern
-
-Files (main tree, ignore `worktrees/*` copies):
-`apps/web-wallet/app/features/receive/cashu-token-melt-data.ts`,
-`receive-cashu-token-quote-service.ts`, `cashu-receive-quote-service.ts`, `cashu-receive-quote-hooks.ts`.
-
-**Fee decomposition** (`cashu-token-melt-data.ts`) — their persisted per-hop record. Four money fields:
-- `cashuReceiveFee` — mint input fee for spending the source proofs as melt inputs
-  (`sourceAccount.wallet.getFeesForProofs(token.proofs)`)
-- `lightningFeeReserve` — `meltQuote.fee_reserve`
-- `lightningFee` (optional) — the **actual** LN fee, known only after the melt completes;
-  `reserve - actual = change`. Their comment: "For cashu token receives over lightning, we are
-  currently not returning the change to the user."
-- plus `sourceMintUrl`, `tokenAmount`, `tokenProofs`, `meltQuoteId`, `meltInitiated: boolean`
-
-**Fee sizing = a bounded convergence loop** (`receive-cashu-token-quote-service.ts:205-273`). The
-circularity is real: fee reserve needs a melt quote, which needs an invoice, which needs an amount.
-Their resolution:
-
-```
-cashuReceiveFee = getFeesForProofs(token.proofs)
-targetAmount    = tokenAmount - cashuReceiveFee        // hard ceiling
-amountToMelt    = targetAmount
-loop (attempts < 5):
-    amountToMint = convert(amountToMelt)
-    if amountToMint < 1        -> DomainError "too small to cover the fees"
-    invoice   = destination.mintQuote(amountToMint).request     // NUT-04 at DESTINATION
-    meltQuote = source.createMeltQuoteBolt11(invoice)           // NUT-05 at SOURCE
-    required  = meltQuote.amount + meltQuote.fee_reserve
-    diff      = required - targetAmount
-    if diff <= 0 -> DONE
-    amountToMelt -= diff                                       // shrink, retry
-throw "Failed to find valid quotes after 5 attempts"
-```
-
-Properties worth keeping: **bounded** (5, no unbounded retry), **fail-closed** (throws rather than
-melting something that doesn't fit), and the fit predicate is exactly
-`melt.amount + melt.fee_reserve <= budgeted`.
-
-**Pays-once discipline** (`cashu-receive-quote-service.ts:127`, `cashu-receive-quote-hooks.ts:775-820`).
-`markMeltInitiated` is idempotent (no-op if set) and state-gated (must be `UNPAID`). Recovery is a
-decision table driven by the **melt quote state at the source mint**, looked up **by melt quote id**:
-- `Unpaid` + `meltInitiated` ⇒ the melt **failed** → fail the hop. **Never re-melt.**
-- `Unpaid` + `!meltInitiated` ⇒ safe to initiate.
-- `Pending` ⇒ mark initiated (money in flight).
-- `Expired` ⇒ expire.
-
-⚠ One honest weakness to NOT copy: they set `meltInitiated` **reactively**, on observing `Pending`.
-A crash between sending the melt request and observing `Pending` leaves the flag false with money
-possibly in flight; they are then relying on the mint rejecting a second melt on the same quote. We
-should instead **write the journal before the melt call** (write-before-effect) — which is already
-mobee's own discipline for the budget ledger (`budget.rs:6-14`, "appended (never rewritten) **before**
-the pay effect"), and is strictly stronger.
-
-## 4. Mobee-side seams (what we compose)
-
-- `crates/mobee-core/src/wallet_ops.rs:354` — `mint_quote(PaymentMethod::BOLT11, Some(amount), ..)` (deposit path)
-- `crates/mobee-core/src/wallet_ops.rs:651` — `melt_quote(PaymentMethod::BOLT11, bolt11, ..)` (withdraw path)
-  ⇒ **both halves of the hop already exist and are exercised.**
-- `crates/mobee-core/src/payment_wallet.rs:246` — `prepare_send(terms.amount, options)`; `:577` — "Gate on
-  the **realized** locked token after prepare_send/confirm — never input face." This is the send path the
-  hop must feed **unchanged**.
-- `crates/mobee-core/src/payment_wallet.rs:521` — `require_fee_safe_amount(wallet, amount)` via
-  `mint_input_fee_bounded(wallet, 1, MINT_TOUCH_TIMEOUT)` returning
-  `BoundedFee::{Fee, Failed, Unreachable}`. **This is our invariant-5 precedent: a timeout-bounded,
-  fail-closed mint touch.** Reuse it for quote request/poll rather than inventing a timeout.
-- `crates/mobee-core/src/authorize_pay.rs:385` — `require_fee_safe_amount(&wallet, terms.amount)`
-  (pre-budget dust check); `:415` — `gate.authorize_then_attempt(attempt_id, amount, ..)`.
-  **⇒ the #185 seam is visible right here:** the gate is charged `amount` (the buyer-signed number)
-  while the fee is only *dust-checked* (`require_amount_covers_fee`: `amount > fee`), never *added to
-  the cap*. For the hop, `amount + fee_reserve + input_fee` must be what the cap sees.
-- `crates/mobee-core/src/budget.rs` — append-only `spent.jsonl`, fold-at-read, cross-process `flock`,
-  `attempt_id`-keyed idempotence. The hop charges through this, not around it.
-
-## 5. Design consequence — the loop INVERTS (headline)
-
-agicash solves "**receive**: fees eat the amount" — the token amount is fixed by whoever sent it, so
-the **delivered** amount floats *down* to absorb fees.
-
-Our charter's invariant 1 forbids exactly that: the amount is fixed by the **buyer-signed offer** and
-no mint- or seller-supplied number may become the paid amount. So we must **not** shrink the mint
-amount. We pin the delivery and let the **buyer's cost** float *up*:
-
-1. `mint_quote` at seller's mint **B** for **exactly `offer.amount`** → `MintQuote.request` (bolt11)
-2. `melt_quote` at buyer's funded mint **A** for that bolt11 → `amount`, `fee_reserve`
-3. input fee at A for the proofs to be spent (mobee's bounded reader)
-4. `planned_cost = melt.amount + melt.fee_reserve + input_fee`
-5. **budget check on `planned_cost` BEFORE any melt** — insufficient ⇒ abort, zero money moved
-6. journal `(attempt_id, A, melt_quote_id, B, mint_quote_id, planned_cost)` **before** the melt
-7. melt at A → mint at B → hand fresh mint-B ecash to the **unchanged** send path
-
-No convergence loop is needed: with the delivery pinned, cost is a single forward computation. That is
-both simpler than agicash's loop **and** satisfies invariant 1 by construction — the seller-received
-amount is never a function of any fee reading. (A retry loop would only be needed if we allowed the
-delivered amount to float, which is precisely what we must not do.)
-
-Invariant map: 1 → step 1 pins `offer.amount`, nothing downstream can rewrite it. 2 → decision tooth
-before step 1 (overlap ⇒ existing path, byte-identical). 3 → step 4+5. 4 → step 6 + both-wallet
-recovery + `check_all_mint_quotes`. 5 → every mint touch through the bounded/fail-closed reader; abort
-before melt on any quote failure.
-
-## 6. Traps found (each would bite)
-
-1. **Per-wallet recovery filter** — `recover_incomplete_sagas()` skips the other mint's saga silently. Run on both.
-2. **`TransferTimeout` is bait** — a dead cdk error variant suggesting a transfer feature that isn't there.
-3. **The fork is the wrong cdk** — `/srv/forge/projects/cdk` is v0.16; mobee pins `=0.17.2`.
-4. **`cdk-cli transfer` is not a cross-mint hop** — naive send→receive; copying it produces `IncorrectMint`.
-5. **Reactive `meltInitiated`** (agicash) leaves a crash window; use write-before-effect.
-6. **Fee reserve ≠ fee charged** — `reserve - actual` comes back as melt change, so the *planned* cost
-   is an upper bound on the *realized* cost (see open question).
-
-## 7. Open questions for parent (2)
-
-**Q1 — budget reconciliation of the unused fee reserve.** We charge `planned_cost` (with the full
-`fee_reserve`) before the melt, per invariant 3. The melt then returns change worth
-`fee_reserve - actual_ln_fee`. Options: (a) leave the conservative overcharge standing — safe,
-fail-closed, but the cap under-reports remaining allowance; (b) append a reconciliation record keyed to
-the same `attempt_id` so the fold reflects true spend. **Recommendation: (a) for this slice**, and note
-it in code as interim — (b) touches the ledger fold, which is money-gate machinery I should not
-reshape inside a feature slice. Your call.
-
-**Q2 — second test mint.** Charter names `testnut.cashudevkit.org` as our default and the
-`testnut.cashu.space` family as candidates for mint B. I'll probe candidates for NUT-04/NUT-05 support
-and report which pair actually works. Expect an honest caveat: if both are fake-wallet mints, the LN
-leg auto-settles and the smoke proves the *hop's control flow, journal, budget accounting and
-recovery* — but **not** real LN routing or a real fee reserve being consumed. Real-LN proof stays
-gudnuf-gated; I won't attempt it.
-
-Nothing here needs a money-gate config change. No budget/mint/`allow_real_mints` edit is implied by
-the design above.
-
----
-
-# Part II — rulings + implementation design (post-research)
-
-## Rulings received (keeper:mobee-orchestrator)
-
-- **Q1 = (a)** conservative overcharge, `// interim:` at the charge site linking a filed follow-up.
-  ⇒ **MakePrisms/mobee#186**.
-- **Q2 = (iii)** hermetic teeth this slice; live cross-mint smoke deferred (gudnuf holds the
-  second-mint money-gate ask). Fence defect filed separately ⇒ **MakePrisms/mobee#187**
-  (testnut allow-LIST + `extra_mints` dead-config, one fence one review).
-- **Req 1** — the per-wallet saga-sweep trap is the heart of invariant 4: recovery on BOTH wallets +
-  the mint-quote sweep; a melted-at-A/unminted-at-B strand must surface LOUD.
-- **Req 2** — the hop's cap check sees `planned_cost`; do NOT touch `authorize_pay`'s general
-  fee-dust behaviour (that is #185 proper, stays separate).
-- **Req 3** — CLEARED, no migration; recommendation accepted (below).
-
-## Req 3 resolution: no WalletRepository, no migration
-
-Mobee already has WalletRepository's model. `open_wallet_at_mint_async(home, mint_url)`
-(`buyer_fund.rs:85-106`) uses `sqlite_path(&home.wallet_dir)` — **one store per home, independent of
-mint** — then `Wallet::new(mint_url, Sat, Arc::new(store), seed, None)`. Its own docstring: *"The
-store (sqlite) is shared across mints; only the `Wallet`'s bound mint differs."*
-
-⇒ Call that helper **twice** (mint A, mint B). Three reasons it beats introducing `WalletRepository`:
-1. Zero schema/layout change to any existing money home.
-2. The **real-mint fence lives inside the helper**, so both legs of the hop are fenced automatically
-   rather than depending on us remembering to fence the second one.
-3. The shared store makes req-1 recovery work for free: `get_incomplete_sagas()` returns sagas for
-   every mint off the one store, and each `Wallet` filters to its own `mint_url` — so opening both
-   wallets and recovering each covers the whole hop.
-
-## The decision seam (invariant 2)
-
-`resolve_realized_mint(buyer_mint_url, accepted_mints, allow_real_mints)` (`authorize_pay.rs:471`)
-already **is** the decision, and its no-overlap branch already names the gap it errors on:
-
-> `mint_unreachable_pay: buyer mint {buyer_mint} is not in the creq mint list {listed:?}; the
-> single-mint buyer wallet holds no balance at any accepted mint`
-
-That error is the hop's trigger. Shape the seam as a plan, not a bool:
-
-```
-enum PayPlan {
-    Direct { mint: MintUrl },                        // buyer mint ∈ accepted_mints
-    Hop    { source: MintUrl, target: MintUrl },     // no overlap: melt at source, mint at target
-}
-```
-
-- **Overlap ⇒ `Direct`** and every downstream byte is what it is today. The tooth asserts on the
-  *decision* (`PayPlan::Direct`), per charter — not on the outcome.
-- **No overlap ⇒ `Hop`**, `target` = the first admissible entry of `accepted_mints` (seller's list
-  order is their preference; **deterministic**, because replay/pays-once depends on re-deriving the
-  same target).
-- **Realized mint** sealed into `terms.mint` = `Direct.mint` or `Hop.target`. That keeps
-  `wallet_open_mint_url` (`:462`) honest — after the hop the ecash *is* at `target`, so the send, the
-  attempt id, and the co-signed receipt all stay on one mint. One settlement shape on the wire.
-
-## Order of operations in `authorize_pay_async`
-
-Today: verify delivery (pre-budget) → `require_fee_safe_amount` → `gate.authorize_then_attempt(attempt_id, amount, effect)`.
-
-With a hop, the pre-budget region grows the *planning* (no money moves) and the effect grows the
-*hop execution* (money moves, after the durable append):
-
-1. verify delivery + bind-check — **unchanged**, pre-budget, zero spend on failure
-2. **plan** (pre-budget, no money moves, all reads timer-bounded/fail-closed):
-   a. `mint_quote(BOLT11, Some(offer.amount))` at **B** → `MintQuote.request` (bolt11) — amount pinned
-      to the buyer-signed offer, never a mint- or seller-supplied number
-   b. `melt_quote(BOLT11, bolt11)` at **A** → `amount`, `fee_reserve`
-   c. input fee at A via the existing bounded reader
-   d. `planned_cost = melt.amount + melt.fee_reserve + input_fee`
-3. `gate.authorize_then_attempt(attempt_id, planned_cost, effect)` — cap sees the whole hop
-   **before** any melt; refuse ⇒ zero money moved (the gate never calls `effect` on refuse)
-4. inside `effect`: journal the pairing → melt at A → mint at B → **existing send path from B, unchanged**
-
-`authorize_then_attempt` already gives us write-before-effect and cross-process `flock` (budget.rs
-`reserve`), so the hop inherits the TOCTOU closure rather than re-inventing it. On the `Direct` path
-we pass `amount` exactly as today — req 2 honoured, general fee-dust behaviour untouched.
-
-## The journal (only what cdk does not already know)
-
-cdk journals each half itself (`WalletSaga` + `used_by_operation` + quote rows). The one thing nothing
-in cdk knows is that the two quotes are **one logical hop**, so that is the entire journal payload,
-written **before** the melt:
-
-```
-(attempt_id, source_mint, melt_quote_id, target_mint, mint_quote_id, planned_cost)
-```
-
-Recovery then reads the pairing and asks cdk for each half by quote id:
-`check_melt_quote_status(melt_quote_id)` at A, `check_mint_quote_status(mint_quote_id)` /
-`amount_mintable()` at B. Decision table (agicash's, keyed by quote id, but with our
-write-before-effect ordering so the "initiated" flag can never be false while money is in flight):
-
-| melt @ A | mint @ B | action |
-|---|---|---|
-| Unpaid, journal present | — | melt never landed → safe to retry the melt (quote still Unpaid at the mint) |
-| Pending | — | money in flight → wait, timer-bounded; never re-melt |
-| Paid | not issued | **the strand** → mint at B (recoverable), and surface LOUD |
-| Paid | issued | complete → hand to send path; exactly-once |
-
-## Invariant → tooth map
-
-1. **Amount from the buyer-signed offer only** — step 2a pins `offer.amount`; nothing downstream can
-   rewrite it. Tooth: enumerate the entry points to the spend gate and show the hop adds none — the
-   hop's only new gate call passes `planned_cost` as the *cost*, while the *delivered* amount stays
-   `offer.amount`. Red-on-revert: make the mint amount a function of any mint/seller number → tooth bites.
-2. **Hop only when needed** — decision tooth on `PayPlan`, not the outcome: overlap ⇒ `Direct`.
-3. **Budget covers the WHOLE hop** — `planned_cost` includes melt amount + fee reserve + input fee,
-   charged before the melt. Strong-form bite: shrink the cap to just under `planned_cost` and assert
-   *no melt is attempted at all* (not merely that it fails afterwards).
-4. **Pays-once across the hop** — kill between melt and mint, restart, assert exactly-one payment
-   **and** the loud strand line; recovery runs on both wallets + the repo-wide mint-quote sweep.
-5. **Fail-closed, timer-bounded** — every mint touch through the bounded/fail-closed reader
-   (`BoundedFee::{Fee,Failed,Unreachable}`, `MINT_TOUCH_TIMEOUT`); any quote failure aborts before the
-   melt; no timer-less await anywhere on the hop.
-
-## Build environment (this workspace)
-
-Clone `/srv/forge/workspaces/mobee-crossmint`, branch `crossmint/hop` off `origin/dev` @ `7463cbe`.
-Toolchain is NOT on the default PATH — rust 1.95.0 + gcc-wrapper 15.2.0 from the nix store; edition
-2024 needs ≥1.85 so 1.95.0 is fine. `CARGO_TARGET_DIR=/srv/forge/workspaces/.crossmint-target`
-(separate, per the charter). Gate runner writes `<label>.log` + `<label>.rc` with no trailing
-pipeline, so pasted rcs are real rcs.
-
-⚠ Shell gotcha that already bit once: `cat` is aliased to `bat` here, so `$(cat file)` expands to
-**empty** silently — it filed issue #186 with an empty body before I caught it. Use `--body-file`,
-`command cat`, or `$(<file)`.
diff --git a/PR-BODY.md b/PR-BODY.md
deleted file mode 100644
index d1d74ad5..00000000
--- a/PR-BODY.md
+++ /dev/null
@@ -1,153 +0,0 @@
-# Cross-mint hop: pay a seller at a mint the buyer holds nothing at
-
-A buyer funded only at mint A could not pay a seller who accepts only mint B. Now it can: the buyer's own wallet raises a NUT-04 mint quote at B, melts at A to pay that invoice, and holds fresh ecash at B — where the existing send path takes over completely unchanged. Lightning is connective tissue between the two mints and nothing more, so the wire still carries exactly one settlement shape, and pays-once, the co-signed receipt, and amount-from-the-buyer-signed-offer are untouched by it.
-
-## Delivery is pinned; the buyer's cost floats
-
-The reference pattern for this (agicash's `receive-cashu-token`) solves the fee problem the other way round: it pins the token amount and lets the **delivered** amount float DOWN through a bounded convergence loop until the fees fit. That is precisely what our strongest money invariant forbids — the seller receives the amount they signed for.
-
-So the direction is inverted here. Delivery is pinned at `offer.amount` and the **buyer's cost** floats up:
-
-```
-planned_cost = melt.amount + melt.fee_reserve + input_fee
-```
-
-Two consequences worth stating: the convergence loop disappears entirely (cost is one forward computation), and the fixed-delivery invariant holds *by construction* — the amount the seller receives is never a function of any fee reading.
-
-## ⚠ A documented refusal disappears
-
-**`mint_unreachable_pay` is unreachable on the pay path as of this slice.** "The single-mint buyer wallet holds no balance at any accepted mint" was a refusal; it is now a hop. That is the feature, but it is also a safety property being removed, so here is what replaces it.
-
-**The covering refusal is the target fence.** A hop ends with the buyer holding ecash at the target, so an unfenced target would be a real-mint back door with `allow_real_mints` off — a NEW entry point to money created by this slice. `plan_payment` fences the source AND the target and refuses fail-closed when no accepted mint is admissible. Both halves of the boundary are pinned by tests sitting next to each other:
-
-- `pay_plan_hops_when_the_configured_mint_is_not_listed_but_the_target_is_admissible` — the old refusal's fixture, now asserting the decision that replaced it.
-- `pay_plan_refuses_when_no_overlap_and_no_accepted_mint_is_admissible` — no admissible landing still refuses.
-- `pay_plan_refuses_a_no_overlap_hop_under_the_default_posture` — with the flag off the fence admits exactly one mint, so a hop is **structurally unreachable in the default posture**. The operator's opt-in is what makes two distinct admissible mints possible at all.
-- `authorize_pay_refuses_an_inadmissible_hop_with_zero_spend_and_no_pairing` — the same refusal end-to-end through the real pay path: zero budget burned, no pairing left on disk for a later run to resume.
-
-### The replacement invariant: the hop fails closed at every leg
-
-With the membership refusal gone, the hop is what now stands between "cannot settle at the seller's mint" and a wrong or partial spend. Every leg refuses without spending:
-
-| leg | what fails | what happens |
-|---|---|---|
-| plan | fence rejects source or target | refuse before the gate — **zero charge** |
-| plan | mint quote / melt quote / fee read fails or times out | refuse before the gate — **zero charge** |
-| plan | source wallet cannot cover `planned_cost` | refuse before the gate — **zero charge** |
-| gate | cap below `planned_cost` | the effect never runs, so **no melt is attempted at all** |
-| melt | source mint reports `Pending` | refuse, never melt again (money may be in flight) |
-| melt | source mint reports `Failed` | refuse; nothing left the wallet (see #194) |
-| mint | target unreachable or refuses to issue | refuse; no completion record, no ecash claimed |
-| mint | target issues an amount ≠ the pinned delivery | refuse rather than carry a short amount into the send |
-
-`no_failing_leg_leaves_a_completion_record_behind` drives all five reachable failure legs and asserts, for each, that no completion record was written and no ecash was claimed.
-
-## The decision seam turned out to be three seams
-
-`resolve_realized_mint` had **three** production callers, and wiring only the pay path would have shipped this feature dead — the other two refuse a no-overlap claim before the pay path ever sees it:
-
-1. `job_lifecycle::accept` — sealed the realized mint and refused no-overlap ("never accepted into an unpayable bind"), so such a job never reached `authorize_pay`.
-2. `buyer::lifecycle::claim_is_payable` — the award filter. Its own comment claimed "the SAME resolution the pay path performs", so the buyer would never even award a claim it can now settle. That comment is rewritten to the new truth.
-
-All three now call `crossmint::plan_payment`; `resolve_realized_mint` is deleted.
-
-### Why the accept-bind still seals the buyer's own mint
-
-The seal stays the buyer's **selected (funded)** mint, not the hop target. Sealing the target would break the feature: at pay time the sealed value would already be in the accepted set, `plan_payment` would say `Direct`, and the hop would never fire — a direct payment from a mint the buyer holds nothing at.
-
-Attempt-id stability is preserved without storing a second field. On the direct path the sealed value is byte-identical to before (the old resolver returned the buyer's own mint in every `Ok` branch). For a hop, the realized mint is re-derived deterministically from two values that are *both* frozen at accept — the sealed selection and the accepted set beside it — so a config-default change after accept still cannot shift the attempt id. `the_sealed_source_replans_into_the_same_plan` pins exactly that.
-
-## Pays-once across two mints
-
-cdk journals each leg on its own: a melt quote's state is recoverable from a cold process by quote id, and a mint quote that was paid but never issued can still be issued later. The one thing nothing in cdk knows is that the two quotes are **one hop** — so that pairing, and nothing more, is what gets journalled, before the melt.
-
-That ordering is what makes the melt leg safe to re-enter, and it is stronger than marking a melt "initiated" once the mint reports it pending — that leaves a window where money is in flight and the flag says otherwise.
-
-**On a resumed attempt the persisted quote ids WIN over freshly planned ones.** Raising a second melt quote for one attempt id is exactly the double-pay the journal exists to prevent; a pairing that disagrees with the persisted one is refused outright rather than reconciled.
-
-The resume decision is taken from what the mints say, never from what we infer:
-
-| melt at source | mint at target | action |
-|---|---|---|
-| `Unpaid` | — | nothing left; melt (the mint's own answer, not a guess) |
-| `Pending` | — | money in flight; refuse, never melt again |
-| `Paid` | not issued | **the strand** — issue at the target, and say so LOUDLY |
-| `Paid` | issued | complete without touching either mint |
-
-The strand row is the one that must never pass in silence: a buyer whose sats left the source but whose ecash never arrived has money that is neither spent nor held.
-
-## Recovery runs on both mints, or refuses to call it recovery
-
-cdk's `recover_incomplete_sagas` filters to its own wallet's mint. A two-mint operation recovered on one wallet **silently skips the other mint's saga** — it reports success having examined half the problem. The buyer daemon's startup sweep opens both mints and recovers each, and `require_both_mints_recovered` turns a half-covered sweep into a refusal rather than a false "swept".
-
-The sweep exists because a hop interrupted by a crash is not something the next pay attempt necessarily re-drives: that attempt may never be retried, and the sats would sit melted at the source with no ecash anywhere and nothing looking for them. It reports unconditionally, including the pass that found nothing — silence would be indistinguishable from a sweep that has stopped running.
-
-## Teeth, and the mutations that prove they bite
-
-**577 workspace tests pass (`cargo test --workspace`, rc=0)**, up from 546 on the merge base. Seven mutations were each reverted after proving a *specific* tooth fails — not a blanket failure:
-
-| mutation | tooth that fails |
-|---|---|
-| overlap no longer plans `Direct` | the two decision teeth |
-| target fence dropped | the two fence teeth |
-| input fee dropped from the cap total | the cap-arithmetic tooth |
-| persisted pairing no longer wins | `a_second_pairing_for_one_attempt_is_refused_rather_than_melted` |
-| strand completed but not reported | `kill_between_melt_and_mint_pays_once_on_restart_and_reports_the_strand` |
-| recovery guard checks only the source | `a_sweep_that_covered_one_mint_refuses_to_call_the_hop_swept` |
-| cap charged `delivered_sats`, not `planned_cost` | `the_cap_is_charged_the_hop_cost_and_the_direct_amount` |
-
-`cap_charge` exists as a named function precisely so that last mutation has somewhere to bite; inline, only a live trade would have noticed it change.
-
-The kill-between-legs tooth is the strong form of pays-once: the run dies after the melt lands, a restart resumes from the journal, and the assertion is that the second run melts **zero** times, issues exactly once, and reports the strand.
-
-## Scoped out, named rather than hidden
-
-- **#186 — the fee reserve is charged in full.** A hop's cap charge includes the whole Lightning fee reserve, never reconciled against the fee actually paid, so a hop can leave the cap reporting *less* remaining budget than the buyer really spent. That is the safe direction. Reconciling reserve-versus-actual reshapes the spend ledger, which is money-gate machinery and its own slice. Marked `// interim:` at the charge site.
-- **The input fee is an upper bound.** The melt selects its inputs when it runs, so the exact count is not knowable before the cap check; it is priced at every unspent proof at the source — the most the melt could possibly select. Over-states rather than under-states, because under-stating would put a fee on the wire the cap never saw, which is the #185 defect class.
-- **#194 — a `Failed` melt dead-ends the attempt.** Recovering it means a superseding melt quote against the still-unpaid target invoice, which turns the melt leg into a sequence and requires every pays-once argument to be re-made over that sequence. Marked `// interim:` in code.
-- **#187 — one mint list per side.** The fence hardcodes a single admissible mint and `extra_mints` is dead config, which is why a hop needs `allow_real_mints` to be reachable at all.
-- **"Both wallets recovered" has no hermetic tooth.** Proving it would mean faking a cdk `Wallet` faithfully enough to reproduce its per-mint saga filtering. Instead the property is a runtime refusal, and the guard that enforces it *is* toothed. That is the honest form when the dependency cannot be faked: enforce it at runtime and test the enforcement.
-
-## No live cross-mint trade has been run
-
-Test ecash **structurally cannot hop**: fake mints cannot pay each other's invoices over real Lightning. So control flow, the journal, budget accounting and recovery are proven hermetically; **real Lightning routing between two mints is not.** A live cross-mint smoke is a real-money spend plus a money-gate config change, and is gated on the repo owner. The smoke script is written ready-to-run for the moment that authorization arrives.
-
-## ⚠ Gate evidence — this box's toolchain is older than the tree's
-
-The newest Rust available here is **1.95.0**; the tree is formatted and linted by a newer stable. On the **pristine** merge base `7463cbe`, before a single edit:
-
-- `cargo fmt --all -- --check` → **rc=1, 733 diffs**
-- money-combo clippy `--all-targets -- -D warnings` → **57 errors across 20 files**
-
-**CI runs neither fmt nor clippy** — `.github/workflows/ci.yml` is build + test only, on `dtolnay/rust-toolchain@stable`. Whole-tree fmt and clippy on this box therefore measure toolchain skew, not this diff, so the evidence below is per-file against that same merge base:
-
-| file | fmt hunks (base → branch) | clippy hits (base → branch) |
-|---|---|---|
-| `crossmint.rs` | new file → **0** | new file → **0** |
-| `crossmint_hop.rs` | new file → **0** | new file → **0** |
-| `authorize_pay.rs` | 28 → 26 | 13 → 4 |
-| `job_lifecycle.rs` | 53 → 53 | 5 → 5 |
-| `payment_wallet.rs` | 29 → 29 | 0 → 0 |
-| `wallet_ops.rs` | 13 → 13 | 1 → 1 |
-| `buyer/mod.rs` | 135 → 135 | 3 → 3 |
-| `buyer/lifecycle.rs` | 33 → 33 | 1 → 1 |
-
-Both new modules are fmt-clean and clippy-clean. No touched file gains a single fmt hunk or clippy hit; `authorize_pay.rs` loses several because the superseded resolver went with them. Whole-crate clippy goes **57 → 48**. Provisioning a matching toolchain fleet-wide is a separate call and deliberately does not ride this slice.
-
-Counting is per-hunk rather than per-byte on purpose: rustfmt prints the absolute path in every hunk header, so byte totals differ between two checkouts for reasons that have nothing to do with the code.
-
-## Gates run
-
-```
-cargo test --workspace                                                        rc=0   577 lib tests
-cargo test -p mobee-core --no-default-features \
-           --features gateway,git-delivery,wallet                             rc=0   577 lib tests
-cargo test -p mobee-core --features acp                                       rc=0   170 tests
-cargo build -p mobee --release                                                rc=0
-rustfmt --edition 2024 --check   (per file, table above)                      rc=0 on both new modules
-cargo clippy  (money combo, --all-targets -D warnings)                        0 hits on either new module
-```
-
-Every feature combo the slice ships in is compiled, not just the money set — a cfg-gated module is invisible to a gate that never enables its cfg.
-
-One gate-hygiene trap worth not repeating: `cargo test -p mobee-core crossmint::` returns **rc=0 with zero tests run**, because `wallet`/`gateway` are not default features and the module is cfg-gated out. Assert the test **count**, not the rc.