diff --git a/app/src/RollupWallet.tsx b/app/src/RollupWallet.tsx
index 0302e565..4d0aa837 100644
--- a/app/src/RollupWallet.tsx
+++ b/app/src/RollupWallet.tsx
@@ -38,7 +38,7 @@ import {WalletBrand,WalletHeaderActions} from './WalletHeaderActions.tsx';
 import {WalletCreatedNotice,WalletSecurityMenu,type WalletSecurityView} from './WalletSecurityMenu.tsx';
 import {isNativeHost,nativeClaimFetch,nativeOperationFetch,nativeSessionFetch,nativeSwapConfig,nativeWalletProviders} from '../../src/native/index.ts';
 import {loadWalletPoseidon} from './wallet-crypto.ts';
-import {pendingPoolNullifiers,pendingPoolOutpoints,reconcileNativeJournal} from '../../src/native/mutations.ts';
+import {forceReleaseNativeJournal,pendingPoolNullifiers,pendingPoolOutpoints,reconcileNativeJournal} from '../../src/native/mutations.ts';
 import {privateTransport,PRIVATE_SHIELD_COINS} from '../../src/shielded/private-transport.ts';
 import {PRIVATE_FLAG} from './private-boot.ts';
 
@@ -89,7 +89,7 @@ const focusOnMount=(el:HTMLElement|null)=>{el?.focus();};
 export default function RollupWallet({storage=globalThis.localStorage,reload=()=>location.reload(),onShutdown,onReady,onStartupFailure,onStartupStage,onClearWallet,nativeHost=INJECTED_NATIVE,paymentRequest,onPaymentRequestHandled,onResumeSnapshot,onScannerIntentChange,resumeScanner,onResumeScannerHandled,animateEntrance=true,suspended=false,viewActive=true,hidden=false}:{storage?:Storage;reload?:()=>void;onShutdown?:(shutdown:(()=>Promise<void>)|undefined)=>void;onReady?:()=>void;onStartupFailure?:(message:string)=>void;onStartupStage?:(message:string)=>void;onClearWallet?:()=>Promise<void>;nativeHost?:boolean;paymentRequest?:IncomingPayment;onPaymentRequestHandled?:(id:number)=>void;onResumeSnapshot?:(snapshot:NativeResumeSnapshot)=>void;onScannerIntentChange?:(requested:boolean)=>void;resumeScanner?:number;onResumeScannerHandled?:(token:number)=>void;animateEntrance?:boolean;suspended?:boolean;viewActive?:boolean;hidden?:boolean}={}){
  const [sessionFetch]=useState(()=>nativeHost?nativeSessionFetch():undefined);
  const [pool,setPool]=useState<RollupPoolStatus>(),[poolError,setPoolError]=useState(''),[journalError,setJournalError]=useState('');
- const [nativePending,setNativePending]=useState(false);
+ const [nativePending,setNativePending]=useState(false),[confirmRelease,setConfirmRelease]=useState(false),[releaseNote,setReleaseNote]=useState('');
  const [startupError,setStartupError]=useState(''),[startupFailure,setStartupFailure]=useState(''),[refreshError,setRefreshError]=useState(''),[feeNotice,setFeeNotice]=useState(''),[feeConfirmed,setFeeConfirmed]=useState(false);
  const [startupStage,setStartupStage]=useState('Preparing your private wallet');
  const [initialPool,setInitialPool]=useState<RollupPoolStatus>();
@@ -473,6 +473,16 @@ export default function RollupWallet({storage=globalThis.localStorage,reload=()=
    .then(pending=>{if(live){setNativePending(pending);setJournalError('');}},error=>{if(live){setNativePending(true);setJournalError(errorText(error));}});
   return()=>{live=false;};
   },[wallet,tick,nativeHost,sessionFetch]);
+ const releaseReserved=()=>{
+  setConfirmRelease(false);
+  try{
+   const {released,payments,waiting}=nativeHost?forceReleaseNativeJournal(POOL_ORIGIN):PRIVATE!.journal.forceRelease(PRIVATE!.poolOrigin);
+   setReleaseNote([released?`Released ${released===1?'one reserved shield':`${released} reserved shields`}.`:'No shield was released.',
+    waiting?'A shield sent in the last 15 minutes stays reserved while it may still reach the pool.':'',
+    payments?'A payment stays reserved until this wallet can prove the pool will not include it, which it rechecks every minute.':''].filter(Boolean).join(' '));
+   setTick(t=>t+1);
+  }catch(error){setJournalError(errorText(error));}
+ };
  useEffect(()=>{lnLimits.current=wallet?.swaps;lnLimitsRead.current++;setLnBounds(undefined);setLnBoundsError('');},[wallet,wallet?.swaps]);
  // markets() must load the snapshot before resolve() reads it.
  const readLnBounds=()=>{
@@ -738,7 +748,11 @@ export default function RollupWallet({storage=globalThis.localStorage,reload=()=
   const inactive=hidden||suspended||!viewActive;
   if(!secret||!wallet)return <div hidden={inactive} style={inactive?{display:'none'}:undefined} inert={suspended||!viewActive}><WalletOnboarding transport={nativeHost?'tor':'browser'} setup={!secret&&!restoring.current} opening={opening} busy={busy||restoreStarted||opening} phase={opening?startupStage:startupFailure?'Wallet could not open':restoring.current?'Reload to continue restoring your wallet.':'Create or restore your wallet'} error={restoreError||startupError||startupFailure} phrase={restore} onPhraseChange={setRestore} onCreate={createWallet} onRestore={()=>void restoreWallet()} onReconnect={reload}/></div>;
   return <WalletEntrance enabled={animateEntrance}><div ref={pageNode} hidden={inactive} style={inactive?{display:'none'}:undefined} inert={suspended||!viewActive} className={'stock-page'+(docked?' has-dock':'')+(docked&&sheetOpen?' has-sheet':'')+(docked&&sheetOpen&&tab==='activity'?' has-activity':'')}><div className="wallet-pull-refresh" role="status" aria-live="polite" aria-hidden={pullRefresh.distance===0&&!pullRefresh.refreshing}><Icon name="reset" size={16}/><span>{pullRefresh.refreshing?'Syncing wallet…':pullRefresh.ready?'Release to sync':'Pull to sync'}</span></div>{notice&&<WalletBalanceNotice notice={notice} onDismiss={dismissNotice}/>}<div className="wallet-glass-field" aria-hidden="true"><svg viewBox="0 0 640 900" preserveAspectRatio="xMidYMid slice"><defs><pattern id="wallet-contours" width="96" height="96" patternUnits="userSpaceOnUse"><path d="M-24 48Q24 0 72 48T168 48M-24 64Q24 16 72 64T168 64M-24 80Q24 32 72 80T168 80M-24 96Q24 48 72 96T168 96" fill="none" stroke="currentColor" strokeWidth=".6"/></pattern></defs><path d="M320 76Q442 130 542 130V394Q542 610 320 752Q98 610 98 394V130Q198 130 320 76Z" fill="url(#wallet-contours)" stroke="currentColor"/></svg></div><main className="stock-shell"><header className="stock-header"><WalletBrand native={nativeHost} onAbout={()=>setAboutOpen(true)}/><div className="app-header-status">{!nativeHost&&<AppUpdateNotice/>}<WalletHeaderActions native={nativeHost} onAbout={()=>setAboutOpen(true)}/></div></header>
-   {nativePending&&<section className="stock-warning" role="status">Some payments have unresolved outcomes. Their inputs stay reserved until this wallet can prove they cannot land, which it rechecks every minute; a dropped status alone is no proof.</section>}
+   {nativePending&&<section className="stock-warning" role="status"><span>Some payments have unresolved outcomes. Their inputs stay reserved until this wallet can prove they cannot land, which it rechecks every minute; a dropped status alone is no proof.</span>
+    {confirmRelease
+     ?<p><span>Releasing a shield is safe: its coin can be spent only once, so a retry cannot pay what the first attempt did. A payment is never released here, since a retry with other notes could pay its recipient twice.</span><button type="button" className="stock-ghost stock-mini" onClick={releaseReserved}>Release reserved shields</button><button type="button" className="stock-ghost stock-mini" onClick={()=>setConfirmRelease(false)}>Keep them reserved</button></p>
+     :<p><button type="button" className="stock-ghost stock-mini" onClick={()=>{setReleaseNote('');setConfirmRelease(true);}}>Release reserved shields</button></p>}</section>}
+   {releaseNote&&<section className="stock-warning" role="status"><span>{releaseNote}</span><p><button type="button" className="stock-ghost stock-mini" onClick={()=>setReleaseNote('')}>Dismiss</button></p></section>}
    <details className="stock-warning stock-network"><summary><strong>Mutinynet</strong><span>Test funds only.</span></summary><p>The proving keys come from a small testnet ceremony: one contribution per circuit, sealed by a Bitcoin beacon. Payments inside the pool hide their amount, sender and recipient; deposits and withdrawals show their amounts.</p></details>
   {pool?.pool?.notice&&<section className="stock-warning"><strong>The pool is waiting</strong><span>{pool.pool.notice}</span></section>}
   {wallet?.operatorDown&&<section className="stock-warning" role="alert"><strong>Pool status is delayed</strong><span>We haven't refreshed the pool status recently. Checks retry automatically. If the operator stops renewing the pool, its head and payouts expire {wallet.operatorDown.headExpiresAt?`on the last observed deadline, ${when(wallet.operatorDown.headExpiresAt)}`:'within a week of its last renewal'}. To withdraw without the operator, see <a href="https://github.com/arkade-os/shielded#if-the-operator-stops">If the operator stops</a>.</span></section>}
diff --git a/spec/tla/PoolSpendJournal.cfg b/spec/tla/PoolSpendJournal.cfg
index 4ec4a86a..31c1de9f 100644
--- a/spec/tla/PoolSpendJournal.cfg
+++ b/spec/tla/PoolSpendJournal.cfg
@@ -2,16 +2,16 @@
 SPECIFICATION Spec
 CONSTANTS
     MaxClock = 2
-    MaxBatches = 2
+    MaxBatches = 3
     BreakGrace = FALSE
     BreakTrackedWindow = FALSE
     BreakForeignRefusal = FALSE
     BreakEdgeRefusal = FALSE
     BreakRetention = FALSE
     BreakCoinProof = FALSE
-    BreakCoinSpentCheck = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
     NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal.tla b/spec/tla/PoolSpendJournal.tla
index 2fcb4c8e..e117188d 100644
--- a/spec/tla/PoolSpendJournal.tla
+++ b/spec/tla/PoolSpendJournal.tla
@@ -3,17 +3,18 @@ EXTENDS Naturals
 
 CONSTANTS MaxClock, MaxBatches,
           BreakGrace, BreakTrackedWindow, BreakForeignRefusal, BreakEdgeRefusal,
-          BreakRetention, BreakCoinProof, BreakCoinSpentCheck
+          BreakRetention, BreakCoinProof, BreakForceNotes, BreakUnreadableCoin
 
 VARIABLES journal, inFlight, answer, pool, tracked, clock, batches, seen,
-          batchAt, marked, deposit, falseDeath, stranded
+          batchAt, marked, deposit, coinSpent, freed, retry, paid, stranded
 
 vars == <<journal, inFlight, answer, pool, tracked, clock, batches, seen,
-          batchAt, marked, deposit, falseDeath, stranded>>
+          batchAt, marked, deposit, coinSpent, freed, retry, paid, stranded>>
 
 Journals == {"none", "open", "gone"}
 Answers == {"none", "edge429", "pool429", "foreign429", "accepted", "lost", "handled"}
 Pools == {"none", "admitted", "landed", "dropped"}
+Retries == {"none", "dispatched", "admitted", "landed"}
 
 \* Clock 0 is inside the grace, 1 past it and inside the pool's tracking hour, 2 past both.
 Grace == 1
@@ -23,42 +24,38 @@ CanLand == tracked /\ pool \in {"admitted", "dropped"}
 IdAnswer == IF ~tracked \/ pool = "none" THEN "missing"
             ELSE IF pool = "admitted" THEN "pending"
             ELSE IF pool = "landed" THEN "included" ELSE "dropped"
-\* A deposit spends no note of ours, so the account's history never carries one and only its coin answers.
-Verdict == IF deposit
-           THEN IF ~BreakCoinSpentCheck
-                THEN (IF pool = "landed" THEN "landed" ELSE "nothing")
-                ELSE IF seen # batches THEN "unknown" ELSE "nothing"
-           ELSE IF seen # batches THEN "unknown"
-           ELSE IF pool = "landed" THEN "landed" ELSE "nothing"
+\* A deposit spends no note of ours, so the account's history never carries one and only its coin answers, unless that read fails.
+Verdicts == IF deposit THEN {IF pool = "landed" THEN "landed" ELSE "nothing", "unknown"}
+            ELSE {IF seen # batches THEN "unknown" ELSE IF pool = "landed" THEN "landed" ELSE "nothing"}
 NewBatchAt == IF marked THEN batchAt ELSE seen
-\* What a settle pass can prove dead: nothing in flight, nothing landed, nothing left that can land, and a proof it can read.
-SettleProven == /\ ~inFlight /\ pool # "landed" /\ ~CanLand /\ clock >= Retention
-                /\ (deposit \/ (seen = batches /\ seen # NewBatchAt))
+\* What a pass must release: a deposit past the pool's retention whatever its coin says, since the coin bounds what a retry can do; a note spend only once it is proven dead on a current view.
+SettleProven == IF deposit THEN clock >= Retention
+                ELSE /\ ~inFlight /\ pool # "landed" /\ ~CanLand /\ clock >= Retention
+                     /\ seen = batches /\ seen # NewBatchAt
 RefusalProven == pool = "none" /\ ~inFlight
-Doomed(release) == release /\ (inFlight \/ CanLand \/ pool = "landed")
 
 Init == /\ journal = "none" /\ inFlight = FALSE /\ answer = "none"
         /\ pool = "none" /\ tracked = TRUE
         /\ clock = 0 /\ batches = 0 /\ seen = 0
         /\ batchAt = 0 /\ marked = FALSE
         /\ deposit \in BOOLEAN
-        /\ falseDeath = FALSE /\ stranded = FALSE
+        /\ coinSpent = FALSE /\ freed = FALSE /\ retry = "none" /\ paid = 0 /\ stranded = FALSE
 
 Reserve == /\ journal = "none" /\ answer = "none" /\ ~inFlight
            /\ journal' = "open"
            /\ UNCHANGED <<inFlight, answer, pool, tracked, clock, batches, seen,
-                          batchAt, marked, deposit, falseDeath, stranded>>
+                          batchAt, marked, deposit, coinSpent, freed, retry, paid, stranded>>
 
 \* beforeNativeMutation stamps createdAt in the same fetch call that sends, so a POST leaves inside its grace or never.
 Dispatch == /\ journal = "open" /\ answer = "none" /\ ~inFlight /\ clock = 0
             /\ inFlight' = TRUE
             /\ UNCHANGED <<journal, answer, pool, tracked, clock, batches, seen,
-                           batchAt, marked, deposit, falseDeath, stranded>>
+                           batchAt, marked, deposit, coinSpent, freed, retry, paid, stranded>>
 
 Answered(reply) ==
     /\ inFlight /\ inFlight' = FALSE /\ answer' = reply
     /\ UNCHANGED <<journal, tracked, clock, batches, seen, batchAt,
-                   marked, deposit, falseDeath, stranded>>
+                   marked, deposit, coinSpent, freed, retry, paid, stranded>>
 
 \* The edge rate limit and the gateway's admit() both refuse before they forward, so the pool never saw it.
 EdgeRefuse == /\ pool = "none" /\ Answered("edge429") /\ UNCHANGED pool
@@ -70,43 +67,58 @@ Accept == /\ pool = "none" /\ Answered("accepted") /\ pool' = "admitted"
 AcceptLost == /\ pool = "none" /\ Answered("lost") /\ pool' = "admitted"
 LoseUnseen == /\ pool = "none" /\ Answered("lost") /\ UNCHANGED pool
 
-Batched(from, to) ==
-    /\ pool = from /\ tracked /\ batches < MaxBatches
-    /\ pool' = to /\ batches' = batches + 1
+\* A deposit's batch spends its one coin, so a coin already spent is a slot that can never land.
+Batched(from) ==
+    /\ pool = from /\ tracked /\ batches < MaxBatches /\ (~deposit \/ ~coinSpent)
+    /\ pool' = "landed" /\ batches' = batches + 1
+    /\ paid' = paid + 1 /\ coinSpent' = (coinSpent \/ deposit)
     /\ UNCHANGED <<journal, inFlight, answer, tracked, clock, seen,
-                   batchAt, marked, deposit, falseDeath, stranded>>
+                   batchAt, marked, deposit, freed, retry, stranded>>
 
-Land == Batched("admitted", "landed")
+Land == Batched("admitted")
 \* The operator takes a drop back when an abandoned batch lands after all, while it still tracks the spend.
-Reinclude == Batched("dropped", "landed")
+Reinclude == Batched("dropped")
 PoolDrop == /\ pool = "admitted" /\ pool' = "dropped"
             /\ UNCHANGED <<journal, inFlight, answer, tracked, clock, batches,
-                           seen, batchAt, marked, deposit, falseDeath, stranded>>
+                           seen, batchAt, marked, deposit, coinSpent, freed, retry, paid, stranded>>
 
 OtherBatch == /\ batches < MaxBatches /\ batches' = batches + 1
               /\ UNCHANGED <<journal, inFlight, answer, pool, tracked, clock, seen,
-                             batchAt, marked, deposit, falseDeath, stranded>>
+                             batchAt, marked, deposit, coinSpent, freed, retry, paid, stranded>>
+
+\* What the wallet does with funds it believes are free. A deposit is rebuilt on the same coin; a note spend can be rebuilt on other notes, and two of those can both land.
+RetryDispatch == /\ journal = "gone" /\ freed /\ retry = "none" /\ retry' = "dispatched"
+                 /\ UNCHANGED <<journal, inFlight, answer, pool, tracked, clock, batches,
+                                seen, batchAt, marked, deposit, coinSpent, freed, paid, stranded>>
+RetryAdmit == /\ retry = "dispatched" /\ retry' = "admitted"
+              /\ UNCHANGED <<journal, inFlight, answer, pool, tracked, clock, batches,
+                             seen, batchAt, marked, deposit, coinSpent, freed, paid, stranded>>
+RetryLand == /\ retry = "admitted" /\ (~deposit \/ ~coinSpent) /\ batches < MaxBatches
+             /\ retry' = "landed" /\ batches' = batches + 1
+             /\ paid' = paid + 1 /\ coinSpent' = (coinSpent \/ deposit)
+             /\ UNCHANGED <<journal, inFlight, answer, pool, tracked, clock, seen,
+                            batchAt, marked, deposit, freed, stranded>>
 
 \* The grace covers the longest a POST can be in flight, so one cannot outlive it.
 Tick == /\ clock < MaxClock /\ ~inFlight
         /\ clock' = clock + 1
         /\ tracked' = IF clock + 1 >= Retention THEN FALSE ELSE tracked
         /\ UNCHANGED <<journal, inFlight, answer, pool, batches, seen,
-                       batchAt, marked, deposit, falseDeath, stranded>>
+                       batchAt, marked, deposit, coinSpent, freed, retry, paid, stranded>>
 
 \* An idle pool never raises batches; a wallet behind the count it reads gives no verdict at all.
 Catchup == /\ seen # batches /\ seen' = batches
            /\ UNCHANGED <<journal, inFlight, answer, pool, tracked, clock, batches,
-                          batchAt, marked, deposit, falseDeath, stranded>>
+                          batchAt, marked, deposit, coinSpent, freed, retry, paid, stranded>>
 
 Observe(reply, release) ==
     /\ journal = "open" /\ answer = reply
     /\ answer' = "handled"
     /\ journal' = IF release THEN "gone" ELSE "open"
-    /\ falseDeath' = (falseDeath \/ Doomed(release))
+    /\ freed' = (freed \/ release)
     /\ stranded' = (stranded \/ (~release /\ RefusalProven /\ reply = "edge429"))
     /\ UNCHANGED <<inFlight, pool, tracked, clock, batches, seen,
-                   batchAt, marked, deposit>>
+                   batchAt, marked, deposit, coinSpent, retry, paid>>
 
 ObserveEdgeRefusal == Observe("edge429", ~BreakEdgeRefusal)
 ObserveForeignRefusal == Observe("foreign429", BreakForeignRefusal)
@@ -116,29 +128,40 @@ ObserveOutcome == \E reply \in {"accepted", "lost"} : Observe(reply, FALSE)
 \* The pool forgets a spend an hour after admitting it, so past that hour a 404 no longer tells an arrival from a landing.
 ReconcileId ==
     /\ journal = "open"
-    /\ LET missing == IdAnswer = "missing"
-           release == \/ IdAnswer = "included"
-                      \/ /\ missing
+    /\ LET release == \/ IdAnswer = "included"
+                      \/ /\ IdAnswer = "missing"
                          /\ (BreakGrace \/ clock >= Grace)
                          /\ (BreakTrackedWindow \/ clock < Retention)
        IN /\ journal' = IF release THEN "gone" ELSE "open"
-          /\ falseDeath' = (falseDeath \/ Doomed(missing /\ release))
+          /\ freed' = (freed \/ (release /\ IdAnswer = "missing"))
     /\ UNCHANGED <<inFlight, answer, pool, tracked, clock, batches, seen,
-                   batchAt, marked, deposit, stranded>>
+                   batchAt, marked, deposit, coinSpent, retry, paid, stranded>>
 
 Settle ==
     /\ journal = "open"
-    /\ LET dead == Verdict = "nothing"
-           release == \/ Verdict = "landed"
+    /\ \E verdict \in Verdicts :
+       LET dead == verdict = "nothing" \/ (deposit /\ verdict = "unknown" /\ ~BreakUnreadableCoin)
+           noted == dead /\ ~deposit
+           release == \/ verdict = "landed"
                       \/ /\ dead
                          /\ (BreakRetention \/ clock >= Retention)
                          /\ ((deposit /\ ~BreakCoinProof) \/ seen # NewBatchAt)
        IN /\ journal' = IF release THEN "gone" ELSE "open"
-          /\ falseDeath' = (falseDeath \/ Doomed(dead /\ release))
+          /\ freed' = (freed \/ (release /\ verdict # "landed"))
           /\ stranded' = (stranded \/ (~release /\ SettleProven))
-          /\ batchAt' = IF dead THEN NewBatchAt ELSE batchAt
-          /\ marked' = (marked \/ dead)
-    /\ UNCHANGED <<inFlight, answer, pool, tracked, clock, batches, seen, deposit>>
+          /\ batchAt' = IF noted THEN NewBatchAt ELSE batchAt
+          /\ marked' = (marked \/ noted)
+    /\ UNCHANGED <<inFlight, answer, pool, tracked, clock, batches, seen,
+                   deposit, coinSpent, retry, paid>>
+
+\* The user's own release from the banner: a deposit at any age, looser than the app, which also waits out the grace, since its coin bounds what a retry can do. A note spend is never offered here; only Settle, which also weighs the pool count, may free one.
+ForceRelease ==
+    /\ journal = "open"
+    /\ LET free == deposit \/ (BreakForceNotes /\ clock >= Retention)
+       IN /\ journal' = IF free THEN "gone" ELSE "open"
+          /\ freed' = (freed \/ free)
+    /\ UNCHANGED <<inFlight, answer, pool, tracked, clock, batches, seen,
+                   batchAt, marked, deposit, coinSpent, retry, paid, stranded>>
 
 Terminal == clock = MaxClock /\ ~inFlight /\ UNCHANGED vars
 
@@ -146,8 +169,9 @@ Next == \/ Reserve \/ Dispatch
         \/ EdgeRefuse \/ PoolRefuse \/ ForeignRefuseUnseen \/ ForeignRefuseSeen
         \/ Accept \/ AcceptLost \/ LoseUnseen
         \/ Land \/ Reinclude \/ PoolDrop \/ OtherBatch \/ Tick \/ Catchup
+        \/ RetryDispatch \/ RetryAdmit \/ RetryLand
         \/ ObserveEdgeRefusal \/ ObserveForeignRefusal \/ ObservePoolRefusal
-        \/ ObserveOutcome \/ ReconcileId \/ Settle
+        \/ ObserveOutcome \/ ReconcileId \/ Settle \/ ForceRelease
         \/ Terminal
 
 Spec == Init /\ [][Next]_vars
@@ -156,11 +180,11 @@ TypeOK == /\ journal \in Journals /\ inFlight \in BOOLEAN /\ answer \in Answers
           /\ pool \in Pools /\ tracked \in BOOLEAN
           /\ clock \in 0..MaxClock /\ batches \in 0..MaxBatches /\ seen \in 0..MaxBatches
           /\ batchAt \in 0..MaxBatches /\ marked \in BOOLEAN
-          /\ deposit \in BOOLEAN /\ falseDeath \in BOOLEAN /\ stranded \in BOOLEAN
+          /\ deposit \in BOOLEAN /\ coinSpent \in BOOLEAN /\ freed \in BOOLEAN /\ retry \in Retries
+          /\ paid \in 0..2 /\ stranded \in BOOLEAN
 
-\* No release of a reservation while its payment is in flight, can still land, or already landed.
-NoDoublePayment == ~falseDeath
-DispatchJournaled == inFlight => journal = "open"
-\* A reservation a pass could prove dead is released by that pass.
+\* These funds are never paid twice: a first attempt and a retry after a release cannot both land.
+NoDoublePayment == paid <= 1
+\* A reservation a pass could release is released by that pass.
 NoStrandedReservation == ~stranded
 ====
diff --git a/spec/tla/PoolSpendJournal_CoinProof.cfg b/spec/tla/PoolSpendJournal_CoinProof.cfg
index f903ce14..30690751 100644
--- a/spec/tla/PoolSpendJournal_CoinProof.cfg
+++ b/spec/tla/PoolSpendJournal_CoinProof.cfg
@@ -2,16 +2,16 @@
 SPECIFICATION Spec
 CONSTANTS
     MaxClock = 2
-    MaxBatches = 2
+    MaxBatches = 3
     BreakGrace = FALSE
     BreakTrackedWindow = FALSE
     BreakForeignRefusal = FALSE
     BreakEdgeRefusal = FALSE
     BreakRetention = FALSE
     BreakCoinProof = TRUE
-    BreakCoinSpentCheck = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
     NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal_EdgeRefusal.cfg b/spec/tla/PoolSpendJournal_EdgeRefusal.cfg
index f1a9f2a7..45775a03 100644
--- a/spec/tla/PoolSpendJournal_EdgeRefusal.cfg
+++ b/spec/tla/PoolSpendJournal_EdgeRefusal.cfg
@@ -2,16 +2,16 @@
 SPECIFICATION Spec
 CONSTANTS
     MaxClock = 2
-    MaxBatches = 2
+    MaxBatches = 3
     BreakGrace = FALSE
     BreakTrackedWindow = FALSE
     BreakForeignRefusal = FALSE
     BreakEdgeRefusal = TRUE
     BreakRetention = FALSE
     BreakCoinProof = FALSE
-    BreakCoinSpentCheck = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
     NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal_CoinSpentCheck.cfg b/spec/tla/PoolSpendJournal_ForceNotes.cfg
similarity index 61%
rename from spec/tla/PoolSpendJournal_CoinSpentCheck.cfg
rename to spec/tla/PoolSpendJournal_ForceNotes.cfg
index 9ed3982d..4e2c0ef2 100644
--- a/spec/tla/PoolSpendJournal_CoinSpentCheck.cfg
+++ b/spec/tla/PoolSpendJournal_ForceNotes.cfg
@@ -2,16 +2,16 @@
 SPECIFICATION Spec
 CONSTANTS
     MaxClock = 2
-    MaxBatches = 2
+    MaxBatches = 3
     BreakGrace = FALSE
     BreakTrackedWindow = FALSE
     BreakForeignRefusal = FALSE
     BreakEdgeRefusal = FALSE
     BreakRetention = FALSE
     BreakCoinProof = FALSE
-    BreakCoinSpentCheck = TRUE
+    BreakForceNotes = TRUE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
-\* A deposit judged by nullifier history also strands while the wallet lags, so this cfg isolates the landing it misses.
+    NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal_ForeignRefusal.cfg b/spec/tla/PoolSpendJournal_ForeignRefusal.cfg
index 011fdf36..079b5aa1 100644
--- a/spec/tla/PoolSpendJournal_ForeignRefusal.cfg
+++ b/spec/tla/PoolSpendJournal_ForeignRefusal.cfg
@@ -2,16 +2,16 @@
 SPECIFICATION Spec
 CONSTANTS
     MaxClock = 2
-    MaxBatches = 2
+    MaxBatches = 3
     BreakGrace = FALSE
     BreakTrackedWindow = FALSE
     BreakForeignRefusal = TRUE
     BreakEdgeRefusal = FALSE
     BreakRetention = FALSE
     BreakCoinProof = FALSE
-    BreakCoinSpentCheck = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
     NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal_Grace.cfg b/spec/tla/PoolSpendJournal_Grace.cfg
index 8f81cfed..f7df4a26 100644
--- a/spec/tla/PoolSpendJournal_Grace.cfg
+++ b/spec/tla/PoolSpendJournal_Grace.cfg
@@ -2,16 +2,16 @@
 SPECIFICATION Spec
 CONSTANTS
     MaxClock = 2
-    MaxBatches = 2
+    MaxBatches = 3
     BreakGrace = TRUE
     BreakTrackedWindow = FALSE
     BreakForeignRefusal = FALSE
     BreakEdgeRefusal = FALSE
     BreakRetention = FALSE
     BreakCoinProof = FALSE
-    BreakCoinSpentCheck = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
     NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal_Retention.cfg b/spec/tla/PoolSpendJournal_Retention.cfg
index 03afacce..dfb27b19 100644
--- a/spec/tla/PoolSpendJournal_Retention.cfg
+++ b/spec/tla/PoolSpendJournal_Retention.cfg
@@ -2,16 +2,16 @@
 SPECIFICATION Spec
 CONSTANTS
     MaxClock = 2
-    MaxBatches = 2
+    MaxBatches = 3
     BreakGrace = FALSE
     BreakTrackedWindow = FALSE
     BreakForeignRefusal = FALSE
     BreakEdgeRefusal = FALSE
     BreakRetention = TRUE
     BreakCoinProof = FALSE
-    BreakCoinSpentCheck = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
     NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal_Sim.cfg b/spec/tla/PoolSpendJournal_Sim.cfg
index 0ade65cb..5fe32fd4 100644
--- a/spec/tla/PoolSpendJournal_Sim.cfg
+++ b/spec/tla/PoolSpendJournal_Sim.cfg
@@ -9,9 +9,9 @@ CONSTANTS
     BreakEdgeRefusal = FALSE
     BreakRetention = FALSE
     BreakCoinProof = FALSE
-    BreakCoinSpentCheck = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
     NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal_TrackedWindow.cfg b/spec/tla/PoolSpendJournal_TrackedWindow.cfg
index 0f3e720f..12a05c10 100644
--- a/spec/tla/PoolSpendJournal_TrackedWindow.cfg
+++ b/spec/tla/PoolSpendJournal_TrackedWindow.cfg
@@ -2,16 +2,16 @@
 SPECIFICATION Spec
 CONSTANTS
     MaxClock = 2
-    MaxBatches = 2
+    MaxBatches = 3
     BreakGrace = FALSE
     BreakTrackedWindow = TRUE
     BreakForeignRefusal = FALSE
     BreakEdgeRefusal = FALSE
     BreakRetention = FALSE
     BreakCoinProof = FALSE
-    BreakCoinSpentCheck = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = FALSE
 INVARIANTS
     TypeOK
     NoDoublePayment
-    DispatchJournaled
     NoStrandedReservation
diff --git a/spec/tla/PoolSpendJournal_UnreadableCoin.cfg b/spec/tla/PoolSpendJournal_UnreadableCoin.cfg
new file mode 100644
index 00000000..53a581fd
--- /dev/null
+++ b/spec/tla/PoolSpendJournal_UnreadableCoin.cfg
@@ -0,0 +1,17 @@
+\* EXPECT: Invariant NoStrandedReservation is violated
+SPECIFICATION Spec
+CONSTANTS
+    MaxClock = 2
+    MaxBatches = 3
+    BreakGrace = FALSE
+    BreakTrackedWindow = FALSE
+    BreakForeignRefusal = FALSE
+    BreakEdgeRefusal = FALSE
+    BreakRetention = FALSE
+    BreakCoinProof = FALSE
+    BreakForceNotes = FALSE
+    BreakUnreadableCoin = TRUE
+INVARIANTS
+    TypeOK
+    NoDoublePayment
+    NoStrandedReservation
diff --git a/spec/tla/README.md b/spec/tla/README.md
index a19b36e0..ad723c75 100644
--- a/spec/tla/README.md
+++ b/spec/tla/README.md
@@ -741,6 +741,8 @@ FIFO native reads are an assumption; if IPC reorders them, a stale foreground fl
 | `Observe*` | `src/native/mutations.ts`: `observeNativeResponse` and `preAdmissionRefusal` |
 | `ReconcileId` | `src/native/mutations.ts`: `reconcileNativeMutations` and the 404 branch of `observeNativeResponse` |
 | `Settle` | `src/native/mutations.ts`: `settleLandedMutations` and `reconcileJournal`; `src/shielded/wallet.ts`: `settledNullifiers`, `settledDeposit`, `landedDeposit` |
+| `RetryDispatch`, `RetryAdmit`, `RetryLand` | `src/shielded/wallet.ts`: `autoShield` rebuilding a released shield on the same coin, or a payment rebuilt on other notes |
+| `ForceRelease` | `src/native/mutations.ts`: `forceRelease`; the Release reserved shields action in `app/src/RollupWallet.tsx` |
 
 ```mermaid
 stateDiagram-v2
@@ -749,8 +751,9 @@ stateDiagram-v2
     open --> gone: id answers included, or the wallet's verdict says landed
     open --> gone: Cloudflare's edge-limit 429, or the pool's own refusal
     open --> gone: 404 past the grace and inside the pool's tracking hour
-    open --> gone: past that hour, a deposit coin still unspent
+    open --> gone: past that hour, a deposit, whatever its coin says
     open --> gone: past that hour, no history row and a batch since the entry was first judged
+    open --> gone: the reader releases a deposit, at any age in the model, past the grace in the app
     open --> open: 404 inside the grace, a foreign 429, a lost answer, or a verdict it cannot give
 ```
 
@@ -762,13 +765,16 @@ stateDiagram-v2
 | `PoolSpendJournal_EdgeRefusal.cfg` | a recognised edge-limit 429 leaves the row reserved for good; `NoStrandedReservation` |
 | `PoolSpendJournal_Retention.cfg` | settle releases before the pool can have forgotten it; `NoDoublePayment` |
 | `PoolSpendJournal_CoinProof.cfg` | a deposit waits for a batch an idle pool never makes; `NoStrandedReservation` |
-| `PoolSpendJournal_CoinSpentCheck.cfg` | a deposit judged by nullifier history, which no deposit of ours appears in; `NoDoublePayment` |
+| `PoolSpendJournal_ForceNotes.cfg` | the reader's release reaches a payment, past the window; `NoDoublePayment` |
+| `PoolSpendJournal_UnreadableCoin.cfg` | a deposit whose coin read fails keeps its row past the hour; `NoStrandedReservation` |
 
-Pinned TLC v1.7.4 on November 13, 2026: the base generated 10,158 states (2,516 distinct, depth 11) with every action fired, and `PoolSpendJournal_Sim.cfg` (four clock steps, four batches) is exhaustively green at 60,662 states (14,590 distinct). `node tools/check-native-model.mjs` matched all 112 configurations.
+`paid` counts landings, so `NoDoublePayment` is the real promise rather than a proxy for it: a first attempt and a retry after a release never both land. The asymmetry the deposit rule rests on is in `Land` and `RetryLand`, which a deposit may take only while its coin is unspent. A note spend has no such bound — it can be rebuilt on other notes — so it keeps the verdict and count rules. A retry follows only a release that declared the payment dead, never one that proved it landed.
+
+Pinned TLC v1.7.4 on November 13, 2026: the base generated 27,307 states (6,388 distinct) with every action fired. `node tools/check-native-model.mjs` matched all 127 configurations. The reader's release is offered for deposits only. An earlier revision also let it free a payment past the window on a current unlanded verdict, and this model stays green on that rule — which is the argument against it, not for it: the hazard such a rule misses is a stalled operator's count, exactly what `count # batchAt` in `settleLandedMutations` guards and exactly what this model scopes out. A manual path cannot re-derive a proof the model cannot see, so payments are left to the settle rule, which runs every minute anyway. `ForceRelease` frees a deposit at any age, its POST still in flight included. That is a deliberate over-approximation: `forceRelease` in the app also keeps a shield younger than the grace, so there its POST has already left and answered, and the model staying green without that wait shows the coin, not the grace, bounds a retry. Because a released row can still have its POST in flight here, `DispatchJournaled` is not an invariant of this model; `NativeSession.tla`'s own `DispatchJournaled` still owns "journal before send". `Settle` may read a deposit's coin as `unknown` on any pass, as `reconcileJournal` turns a failed read into `undefined`; past the hour that releases all the same.
 
 The model assumes a recognised edge-limit 429 (Cloudflare's `error code: 1015`) was written before the request was forwarded, which is what makes `ObserveEdgeRefusal` safe; any other 429 is modelled as possibly forwarded and left to the 404 window or the coin. It assumes the Ark indexer's answer for a deposit coin is not stale by anything near the tracking hour, and that the operator a wallet reads is the one that batches: the account's view is a prefix of the truth, and a wallet behind the count it reads gives no verdict at all.
 
-With that last assumption dropped — a frozen replica serving a count the wallet has fully synced while another operator keeps batching — the model finds a `NoDoublePayment` trace against the existing count rule: the wallet advances 0 → 1, the spend lands in batch 2 that the replica never serves, and `count # batchAt` then reads as proof the view is current. That rule is unchanged here and the hazard is the one its comment already names; the deposit path does not rely on it, because a coin read answers past any operator. Amounts, group members, several concurrent spends per origin, storage durability and the Ark layer's own refusal to spend a coin twice are outside this model.
+With that last assumption dropped — a frozen replica serving a count the wallet has fully synced while another operator keeps batching — the model finds a `NoDoublePayment` trace against the existing count rule: the wallet advances 0 → 1, the spend lands in batch 2 that the replica never serves, and `count # batchAt` then reads as proof the view is current. That rule is unchanged here and the hazard is the one its comment already names; the deposit path does not rely on it, because a coin read answers past any operator. Amounts, group members, several concurrent spends per origin, storage durability and the Ark layer's own refusal to spend a coin twice are outside this model. So is the operator's rule that a batch takes one slot per coin (`run` in `src/rollup/epoch-operator.ts`, tested in `tests/rollup-epoch-operator.test.ts`): `paid` counts landings, and two slots on one coin cannot both land, but one batch carrying both is refused by the network. Admission cannot tell a coin's owner, so both slots queue and signing drops the one its owner did not sign.
 
 ## Isolated indexer streams
 
diff --git a/src/native/mutations.ts b/src/native/mutations.ts
index 50bd8ca2..07ac593e 100644
--- a/src/native/mutations.ts
+++ b/src/native/mutations.ts
@@ -112,22 +112,36 @@ export function makeNativeMutationJournal(storage:JournalStorage,{graceMs,now=()
  };
  /**
   * A copy can still be admitted graceMs after the POST and its id answers for an hour after that; past both, only this wallet is left to say.
-  * A deposit spends no note of ours, so `settled` is blind to one and `deposited` answers from its coin, which no stalled operator can fake.
-  * For a note spend the account's history answers, trusted once the pool count differs from the one the entry was first judged at: a stalled operator still answers /status, and a new genesis restarts the count lower.
+  * A deposit spends one coin of ours, and a coin can be spent once: past that bound it has either landed, leaving nothing to re-shield, or it never can, so its coin only settles it sooner.
+  * A note spend can be rebuilt on other notes and two of those can both land, so the account's history answers, trusted once the pool count differs from the one the entry was first judged at: a stalled operator still answers /status, and a new genesis restarts the count lower.
   */
  const settleLandedMutations=(poolOrigin:string,settled:(nullifiers:readonly bigint[])=>boolean|undefined,count:number,deposited?:(coin:string)=>boolean|undefined)=>{
   if(graceMs===undefined||!Number.isSafeInteger(count)||count<0)return;
   const origin=new URL(poolOrigin).origin,at=now(),entries=load();let marked=false;
   const remaining=entries.filter(row=>{
-   const verdict=row.origin!==origin?undefined:row.coin!==undefined?deposited?.(row.coin):settled(row.nullifiers.map(BigInt));
+   if(row.origin!==origin)return true;
+   if(row.coin!==undefined)return deposited?.(row.coin)!==true&&at-row.createdAt<=TRACKED_MS+graceMs;
+   const verdict=settled(row.nullifiers.map(BigInt));
    if(verdict!==false)return verdict!==true;
    if(row.batchAt===undefined){row.batchAt=count;marked=true;}
-   if(at-row.createdAt<=TRACKED_MS+graceMs)return true;
-   return row.coin===undefined&&count===row.batchAt;
+   return at-row.createdAt<=TRACKED_MS+graceMs||count===row.batchAt;
   });
   if(marked||remaining.length!==entries.length)save(remaining);
  };
- return {beforeNativeMutation,cancelNativeMutation,pendingPoolNullifiers,pendingPoolOutpoints,observeNativeResponse,reconcileNativeMutations,settleLandedMutations};
+ /**
+  * The reader's own release, from the banner: shields only, once past their grace, since one coin can be spent once and a retry cannot pay what the first attempt did.
+  * A payment keeps settleLandedMutations alone, which also waits for a pool count that has moved since the entry was first judged; no hand on a button stands in for that proof.
+  */
+ const forceRelease=(poolOrigin:string)=>{
+  const origin=new URL(poolOrigin).origin,at=now(),entries=load();
+  // A shield younger than the grace may still be in flight, and an operator without one-slot-per-coin selection would batch it beside its retry.
+  const fresh=(row:PendingMutation)=>graceMs===undefined||at-row.createdAt<graceMs;
+  const remaining=entries.filter(row=>row.origin!==origin||row.coin===undefined||fresh(row));
+  if(remaining.length!==entries.length)save(remaining);
+  const mine=remaining.filter(row=>row.origin===origin);
+  return {released:entries.length-remaining.length,payments:mine.filter(row=>row.coin===undefined).length,waiting:mine.filter(row=>row.coin!==undefined).length};
+ };
+ return {beforeNativeMutation,cancelNativeMutation,pendingPoolNullifiers,pendingPoolOutpoints,observeNativeResponse,reconcileNativeMutations,settleLandedMutations,forceRelease};
 }
 
 export interface JournalWallet {settledNullifiers(nullifiers:readonly bigint[]):boolean|undefined;settledDeposit(coin:string):Promise<boolean|undefined>;batchCount():number}
@@ -137,7 +151,8 @@ export const reconcileJournal=async(journal:ReturnType<typeof makeNativeMutation
  if(!pending())return false;
  await journal.reconcileNativeMutations(fetcher,poolOrigin);
  if(wallet){
-  const coins=new Map(await Promise.all(journal.pendingPoolOutpoints(poolOrigin).map(async coin=>[coin,await wallet.settledDeposit(coin)] as const)));
+  // A coin this wallet cannot read says nothing; it must not stop the pass that ages the rest out.
+  const coins=new Map(await Promise.all(journal.pendingPoolOutpoints(poolOrigin).map(async coin=>[coin,await wallet.settledDeposit(coin).catch(()=>undefined)] as const)));
   journal.settleLandedMutations(poolOrigin,nullifiers=>wallet.settledNullifiers(nullifiers),wallet.batchCount(),coin=>coins.get(coin));
  }
  return pending();
@@ -153,3 +168,4 @@ export const observeNativeResponse=(response:NativeMutationResponse)=>{
  if(journalledRoute(response.url,response.method))current().observeNativeResponse(response);
 };
 export const reconcileNativeJournal=(fetcher:typeof fetch,poolOrigin:string,wallet?:JournalWallet)=>reconcileJournal(current(),fetcher,poolOrigin,wallet);
+export const forceReleaseNativeJournal=(poolOrigin:string)=>current().forceRelease(poolOrigin);
diff --git a/src/rollup/epoch-operator.ts b/src/rollup/epoch-operator.ts
index 70e3fa4a..cc637c41 100644
--- a/src/rollup/epoch-operator.ts
+++ b/src/rollup/epoch-operator.ts
@@ -367,7 +367,9 @@ export async function openRollupEpochOperator(o:RollupEpochOperatorOptions){
   }
   let taken:RollupEpochSpend[]=[];
   const pad=(count:number)=>{if(padding[kind].length<count)throw new Error('padding');taken=padding[kind].splice(0,count);return taken;};
-  const ready=pending[kind].filter(selectable);
+  // One slot per coin, as a batch spending an outpoint twice is refused. Admission cannot tell the coin's owner, so a twin waits, and signing drops whichever slot the owner did not sign.
+  const held=new Set<string>(),first=(outpoint:string)=>!held.has(outpoint)&&!!held.add(outpoint);
+  const ready=pending[kind].filter(s=>selectable(s)&&(!s.coin||first(s.coin.txid+':'+s.coin.vout)));
   // A recover batch is one slot wide: it takes no padding and waits for no company.
   const selection=kind==='recover'?select(ready.slice(0,1),()=>[],undefined,0,lastBatchAt.recover)
    :select(ready,pad,kind==='spend'?coinCap:undefined,kind==='join'?o.joinWaitMs??JOIN_BATCH_WAIT_MS:o.batchWaitMs??BATCH_WAIT_MS,lastBatchAt[kind]);
diff --git a/tests/app-private-build.test.ts b/tests/app-private-build.test.ts
index 80ddbd30..ed0dc81d 100644
--- a/tests/app-private-build.test.ts
+++ b/tests/app-private-build.test.ts
@@ -59,6 +59,20 @@ test('every tick hands the journal the wallet itself, on the native path as much
  assert.match(effect?.[2]??'',/\bwallet\b/);
 });
 
+test('the unresolved-outcomes banner offers a release behind a confirm, on either private path',()=>{
+ const wallet=read('app/src/RollupWallet.tsx'),banner=/\{nativePending&&<section className="stock-warning" role="status">([\s\S]*?)<\/section>\}/.exec(wallet)?.[1]??'';
+ assert.match(banner,/\{confirmRelease\s*\?/,'the action asks before it releases');
+ assert.match(banner,/coin can be spent only once[\s\S]*?A payment is never released here/,'the confirm says why a shield is safe and a payment is not offered');
+ assert.equal((banner.match(/>Release reserved shields<\/button>/g)??[]).length,2,'one button opens the confirm, one does the release');
+ assert.match(banner,/onClick=\{releaseReserved\}/);
+ assert.doesNotMatch(banner,/releaseNote&&/);
+ assert.match(wallet,/<\/section>\}\s*\{releaseNote&&<section className="stock-warning" role="status"><span>\{releaseNote\}<\/span>[\s\S]*?onClick=\{\(\)=>setReleaseNote\(''\)\}>Dismiss</,'the result outlives the banner, which unmounts once nothing is reserved');
+ const handler=/const releaseReserved=\(\)=>\{([\s\S]*?)\n \};/.exec(wallet)?.[1]??'';
+ assert.match(handler,/nativeHost\?forceReleaseNativeJournal\(POOL_ORIGIN\):PRIVATE!\.journal\.forceRelease\(PRIVATE!\.poolOrigin\)/,'both paths release through the journal, never the component');
+ assert.doesNotMatch(handler,/settledNullifiers/,'a payment is never released by hand, whatever the wallet would say');
+ assert.match(handler,/setTick/,'the banner is recomputed from the journal, not assumed');
+});
+
 const PREFETCH_EFFECT=/useEffect\(\(\)=>\{\s*if\(!pool\)return;([\s\S]*?)\},\[([^\]]*)\]\);/;
 test('a private wallet prefetches both proving circuits on open, not on the send tab',()=>{
  const effect=PREFETCH_EFFECT.exec(read('app/src/RollupWallet.tsx')),body=effect?.[1]??'',branch=/if\(PRIVATE\)\{([^}]*)\}/.exec(body);
diff --git a/tests/private-transport.test.ts b/tests/private-transport.test.ts
index 407c073d..6ebb9132 100644
--- a/tests/private-transport.test.ts
+++ b/tests/private-transport.test.ts
@@ -205,11 +205,12 @@ test('the sealed path asks a shield\'s coin, not its nullifiers, and releases on
  const start=Date.now();let at=start;t.mock.method(Date,'now',()=>at);
  const post={method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({id:ID,slot:{nullifiers:['17']},coin})};
  assert.equal((await g.transport.fetch('/api/rollup/spends',post)).status,202);
- at=start+3_600_001+PRIVATE_GRACE_MS;const asked:string[]=[];
+ at=start+3_600_000+PRIVATE_GRACE_MS;const asked:string[]=[];
  const wallet=(verdict:boolean|undefined)=>({settledNullifiers:()=>{throw new Error('a deposit has no history row');},settledDeposit:async(outpoint:string)=>{asked.push(outpoint);return verdict;},batchCount:()=>9});
- assert.equal(await g.transport.reconcile(wallet(undefined)),true);
+ assert.equal(await g.transport.reconcile(wallet(undefined)),true,'the pool could still admit it, and the coin cannot say');
  assert.deepEqual([asked,g.transport.journal.pendingPoolOutpoints(POOL)],[[`${coin.txid}:1`],[`${coin.txid}:1`]]);
- assert.equal(await g.transport.reconcile(wallet(false)),false);
+ at=start+3_600_001+PRIVATE_GRACE_MS;
+ assert.equal(await g.transport.reconcile(wallet(undefined)),false,'past that its coin need not say: one coin bounds any retry');
  assert.deepEqual(g.transport.journal.pendingPoolOutpoints(POOL),[]);
 });
 
diff --git a/tests/rollup-epoch-operator.test.ts b/tests/rollup-epoch-operator.test.ts
index 87b8422a..07f89af8 100644
--- a/tests/rollup-epoch-operator.test.ts
+++ b/tests/rollup-epoch-operator.test.ts
@@ -96,7 +96,7 @@ async function world(epochLen:number){
   pin:{version:1 as const,network:'local-stock' as const,descriptorProfileId:sha('rollup-epoch-test'),programsHash:sha(leaves.batchRecover),artifactsHash:sha('stub'),checkpointHash:sha(checkpoint.script),genesisTxid:parent.id,serverKey:hex.encode(server),emulatorKey:hex.encode(emulator)},
   genesis:{version:1 as const,head:{txid:parent.id,vout:0,value:100_330,sourceTxHex:hex.encode(parent.toBytes())},reserves:{},batches:0},
   clientKey:{spend:{},join:{},recover:{}},prover:{spend:stub,join:stub,recover:stub},verify:async()=>true};
- return {dir,landed,coin,coinOf,cash,program:userTree.pkScript.subarray(2),feeTo,feeView,fee,shield,transport,open:async(t:TestContext,overrides:Partial<Parameters<typeof openRollupEpochOperator>[0]>={})=>{const op=await openRollupEpochOperator({...options,...overrides});t.after(()=>op.close());return op;}};
+ return {dir,landed,coin,coinOf,cash,program:userTree.pkScript.subarray(2),feeTo,feeView,fee,shield,transport,signDeposits,open:async(t:TestContext,overrides:Partial<Parameters<typeof openRollupEpochOperator>[0]>={})=>{const op=await openRollupEpochOperator({...options,...overrides});t.after(()=>op.close());return op;}};
 }
 type World=Awaited<ReturnType<typeof world>>;
 type Operator=Awaited<ReturnType<typeof openRollupEpochOperator>>;
@@ -302,6 +302,18 @@ test('admission checks a double-spend before the anchor, so stale-anchor never h
  }
 });
 
+test('a slot squatting on another depositor\'s coin cannot keep the owner out: a batch takes one slot per coin, and signing drops the squatter',async t=>{
+ const w=await world(64),drops:[string[],string][]=[];
+ const op=await w.open(t,{onDrop:(ids,reason)=>drops.push([ids,reason]),signDeposits:async(request,spends)=>spends.some(s=>s.id==='squat')?request:w.signDeposits(request,spends)});
+ const squat=spendOf(deposit(op.state,1000n),{id:'squat',coin:w.coin(1)}),own=spendOf(deposit(op.state,1000n),{coin:w.coin(1)});
+ await op.submit(squat);await op.submit(own);
+ op.addPadding(padsFor(op.state,'spend',BATCH_SLOTS-1));
+ await assert.rejects(op.tick(),/did not sign/);
+ assert.deepEqual([drops,op.pendingIds()],[[[['squat'],'A depositor did not sign; the batch is rebuilt without their deposits.']],[own.id]]);
+ assert.equal(await landsAs(op),0);
+ assert.equal(Transaction.fromPSBT(base64.decode(w.landed[0]!.arkTx)).inputsLength,2,'the pool head, and the coin once');
+});
+
 test('a pad whose rCur has no root is refused once, and the next tick still builds a batch',async t=>{
  const w=await world(2),op=await w.open(t),good=fastSpend(op.state);
  const bad:[string,unknown][]=[['no root',{epoch:0}],['a root outside the field',{epoch:0,root:ROLLUP_FIELD}],['a fractional epoch',{epoch:0.5,root:1n}]];
diff --git a/tests/tor-mutations.test.ts b/tests/tor-mutations.test.ts
index 3a2ecddd..fc486458 100644
--- a/tests/tor-mutations.test.ts
+++ b/tests/tor-mutations.test.ts
@@ -154,8 +154,8 @@ test('a shield the pool never admitted clears on its coin alone, hours later, wi
  assert.deepEqual([journal.pendingPoolNullifiers(origin),journal.pendingPoolOutpoints(origin)],[[],[]]);
 });
 
-test('a shield stays reserved while the pool could still admit it, and for good while its coin cannot say',async()=>{
- for(const [age,verdict,left] of [[NATIVE_BOUND,false,[OUTPOINT]],[NATIVE_BOUND+1,undefined,[OUTPOINT]],[NATIVE_BOUND+1,false,[]]] as const){
+test('a shield stays reserved while the pool could still admit it, and past that goes whatever its coin says',async()=>{
+ for(const [age,verdict,left] of [[NATIVE_BOUND,false,[OUTPOINT]],[NATIVE_BOUND,undefined,[OUTPOINT]],[NATIVE_BOUND,true,[]],[NATIVE_BOUND+1,undefined,[]],[NATIVE_BOUND+1,false,[]]] as const){
   let at=1_000_000;const journal=makeNativeMutationJournal(storage(),{graceMs:NATIVE_GRACE_MS,now:()=>at});
   journal.beforeNativeMutation(shield());
   at+=age;
@@ -165,19 +165,53 @@ test('a shield stays reserved while the pool could still admit it, and for good
  }
 });
 
+test('a coin this wallet cannot read at all still ages out, and never stops the pass',async()=>{
+ let at=1_000_000;const journal=makeNativeMutationJournal(storage(),{graceMs:NATIVE_GRACE_MS,now:()=>at});
+ journal.beforeNativeMutation(shield());journal.beforeNativeMutation(mutation(other,['23']));
+ const unreadable:JournalWallet={settledNullifiers:()=>false,settledDeposit:async()=>{throw new Error('the indexer is unreachable');},batchCount:()=>140};
+ at+=NATIVE_BOUND;
+ assert.equal(await reconcileJournal(journal,unknownFetch,origin,unreadable),true);
+ assert.deepEqual(journal.pendingPoolOutpoints(origin),[OUTPOINT]);
+ at+=1;
+ await reconcileJournal(journal,unknownFetch,origin,unreadable);
+ assert.deepEqual([journal.pendingPoolOutpoints(origin),journal.pendingPoolNullifiers(origin)],[[],[23n]],'the payment beside it keeps its own rule');
+});
+
 test('a shield is judged by its coin, never by the nullifier history no deposit of ours appears in',async()=>{
  let at=1_000_000,asked=0;const journal=makeNativeMutationJournal(storage(),{graceMs:NATIVE_GRACE_MS,now:()=>at});
  journal.beforeNativeMutation(shield());
- at+=NATIVE_BOUND+1;
+ at+=NATIVE_BOUND;
  await reconcileJournal(journal,unknownFetch,origin,{settledNullifiers:()=>{asked++;return false;},settledDeposit:async()=>undefined,batchCount:()=>1});
  assert.deepEqual([asked,journal.pendingPoolOutpoints(origin)],[0,[OUTPOINT]]);
 });
 
-test('a reconciliation round with nothing pending asks the pool and the wallet nothing',async()=>{
- const journal=makeNativeMutationJournal(storage(),{graceMs:NATIVE_GRACE_MS});let reads=0,asks=0;
- const counted=(async()=>{reads++;return new Response(UNKNOWN,{status:404});}) as typeof fetch;
- assert.equal(await reconcileJournal(journal,counted,origin,{settledNullifiers:()=>false,settledDeposit:async()=>{asks++;return false;},batchCount:()=>1}),false);
- assert.deepEqual([reads,asks],[0,0]);
+test('the reader\'s own release frees a shield past its grace and never a payment',()=>{
+ let at=1_000_000;const journal=makeNativeMutationJournal(storage(),{graceMs:NATIVE_GRACE_MS,now:()=>at});
+ journal.beforeNativeMutation(shield());journal.beforeNativeMutation(mutation(other,['23']));
+ assert.deepEqual(journal.forceRelease(origin),{released:0,payments:1,waiting:1},'a shield still within its grace may be in flight');
+ at+=NATIVE_GRACE_MS;
+ assert.deepEqual(journal.forceRelease(origin),{released:1,payments:1,waiting:0});
+ assert.deepEqual([journal.pendingPoolOutpoints(origin),journal.pendingPoolNullifiers(origin)],[[],[23n]],'the shield goes while the pool could still admit it; the payment stays');
+ at+=NATIVE_BOUND+1;
+ assert.deepEqual(journal.forceRelease(origin),{released:0,payments:1,waiting:0},'past the window the payment is still the settle rule\'s to free, for its count proof');
+ assert.deepEqual(journal.pendingPoolNullifiers(origin),[23n]);
+});
+
+test('a payment is left to the settle rule the reader cannot stand in for',()=>{
+ for(const age of [0,NATIVE_BOUND,NATIVE_BOUND+1,24*3_600_000]){
+  let at=1_000_000;const journal=makeNativeMutationJournal(storage(),{graceMs:NATIVE_GRACE_MS,now:()=>at});
+  journal.beforeNativeMutation(mutation());
+  at+=age;
+  assert.deepEqual(journal.forceRelease(origin),{released:0,payments:1,waiting:0},String(age));
+  assert.deepEqual(journal.pendingPoolNullifiers(origin),[17n],String(age));
+ }
+});
+
+test('the reader\'s release leaves another origin alone and reports nothing to free',()=>{
+ const journal=makeNativeMutationJournal(storage(),{graceMs:NATIVE_GRACE_MS}),elsewhere='https://other.test';
+ journal.beforeNativeMutation({...mutation(other,['23']),url:elsewhere+'/api/rollup/spends'});
+ assert.deepEqual(journal.forceRelease(origin),{released:0,payments:0,waiting:0});
+ assert.deepEqual(journal.pendingPoolNullifiers(elsewhere),[23n]);
 });
 
 const settle=(journal:ReturnType<typeof makeNativeMutationJournal>,verdict:boolean|undefined,count=0)=>journal.settleLandedMutations(origin,()=>verdict,count);