bsv-blockchain · ty-everett · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026
@@ -4,8 +4,8 @@ title: '@bsv/wallet-toolbox-client'
 kind: package
 domain: wallet
 version: '2.5.0'
-last_updated: '2026-07-31'
-last_verified: '2026-07-31'
+last_updated: '2026-08-04'
+last_verified: '2026-08-04'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/wallet-toolbox-client'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/client'
@@ -20,6 +20,9 @@ It includes the BRC-100 wallet, signer, services, IndexedDB storage, and remote
 storage client without Node-only Knex, SQLite, MySQL, or filesystem adapters.
 Opt-in remote-storage timing spans retain trace and parent-span correlation in
 the telemetry sink without adding headers to authenticated requests.
+Browser authentication accepts one verified matching UMP token as an existing
+account. When no token verifies, one clean empty overlay response establishes a
+new account even if other hosts fail or return malformed records.
 
 ## Install
 

@@ -4,8 +4,8 @@ title: '@bsv/wallet-toolbox-mobile'
 kind: package
 domain: wallet
 version: '2.5.0'
-last_updated: '2026-07-31'
-last_verified: '2026-07-31'
+last_updated: '2026-08-04'
+last_verified: '2026-08-04'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/wallet-toolbox-mobile'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox/mobile'
@@ -20,6 +20,9 @@ Toolbox distribution. It includes wallet, signer, services, monitoring, and
 remote storage surfaces without Knex, SQLite/MySQL, IndexedDB, or Node-only IO.
 Opt-in remote-storage timing spans retain trace and parent-span correlation in
 the telemetry sink without adding headers to authenticated requests.
+Mobile authentication accepts one verified matching UMP token as an existing
+account. When no token verifies, one clean empty overlay response establishes a
+new account even if other hosts fail or return malformed records.
 
 ## Install
 

@@ -5,8 +5,8 @@ kind: package
 domain: wallet
 npm: '@bsv/wallet-toolbox'
 version: '2.5.0'
-last_updated: '2026-07-31'
-last_verified: '2026-07-31'
+last_updated: '2026-08-04'
+last_verified: '2026-08-04'
 review_cadence_days: 30
 status: stable
 tags: ['wallet', 'brc100']
@@ -23,6 +23,12 @@ Opt-in remote-storage timing spans retain trace and parent-span correlation in
 the telemetry sink without adding headers to authenticated requests. BRC-103,
 BRC-104, AuthFetch, and the storage RPC wire contract remain unchanged.
 
+UMP account lookup accepts one verified matching token as an existing account.
+When no token verifies, one clean empty overlay response establishes a new
+account even if other hosts fail or return malformed records. Multiple distinct
+verified tokens and lookups with no usable response remain errors; WAB
+existing-account continuity still prevents replacement-wallet onboarding.
+
 ## Install
 
 ```bash

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "lastReviewed": "2026-08-02",
+  "lastReviewed": "2026-08-03",
   "owner": "ts-stack-maintainers",
   "entries": [
     {
@@ -196,22 +196,22 @@
       "name": "@bsv/wallet-toolbox",
       "publishedVersion": "2.4.22",
       "releaseType": "minor",
-      "summary": "Makes the successful fragmented createAction path atomic and set-based, overlaps batched proof reads with persistence, batch-validates compound proofs and canonical P2PKH signatures, shares BRC-42 derivation work, removes unused commit reads, bulk-inserts outputs, coalesces authenticated timestamp-only Knex session touches, and adds timings for every remaining material phase.",
-      "migration": "No consumer migration is required. Storage-provider additions are backward-compatible with fallbacks, existing databases use the normal migration path, and wallet results, BRC-103/104, AuthFetch, Auth Express Middleware, AuthSocket, JSON-RPC, provider calls, and wallet wire behavior are unchanged."
+      "summary": "Makes the successful fragmented createAction path atomic and set-based, overlaps batched proof reads with persistence, batch-validates compound proofs and canonical P2PKH signatures, shares BRC-42 derivation work, removes unused commit reads, bulk-inserts outputs, coalesces authenticated timestamp-only Knex session touches, adds timings for every remaining material phase, and makes UMP account lookup resilient to partial overlay failure.",
+      "migration": "No API or persistence migration is required. Storage-provider additions are backward-compatible with fallbacks and existing databases use the normal migration path. Applications may now enter new-user flow when at least one overlay host returns a clean empty result despite malformed or unavailable peers; one verified token still establishes an existing account, multiple unresolved verified tokens remain an error, and WAB existing-account continuity still blocks replacement-wallet onboarding. Wallet results, BRC-103/104, AuthFetch, Auth Express Middleware, AuthSocket, JSON-RPC, provider calls, and wallet wire behavior are otherwise unchanged."
     },
     {
       "name": "@bsv/wallet-toolbox-client",
       "publishedVersion": "2.4.22",
       "releaseType": "minor",
-      "summary": "Carries the lockstep browser build with batched proof assembly, linear funding/signing work, canonical P2PKH verification, expired-reservation filtering, and complete privacy-safe createAction timings.",
-      "migration": "No consumer migration is required; older compatible SDK peers retain the validated sequential proof fallback, IndexedDB upgrades automatically, and BRC-103/104, AuthFetch, browser entry points, JSON-RPC, and remote storage contracts remain unchanged."
+      "summary": "Carries the lockstep browser build with batched proof assembly, linear funding/signing work, canonical P2PKH verification, expired-reservation filtering, complete privacy-safe createAction timings, and resilient UMP account lookup.",
+      "migration": "No API or persistence migration is required. Browser wallets receive the resilient partial-host UMP lookup behavior described for @bsv/wallet-toolbox; older compatible SDK peers retain the validated sequential proof fallback, IndexedDB upgrades automatically, and BRC-103/104, AuthFetch, browser entry points, JSON-RPC, and remote storage contracts remain unchanged."
     },
     {
       "name": "@bsv/wallet-toolbox-mobile",
       "publishedVersion": "2.4.22",
       "releaseType": "minor",
-      "summary": "Carries the lockstep mobile build with batched proof assembly, linear funding/signing work, canonical P2PKH verification, expired-reservation filtering, and complete privacy-safe createAction timings.",
-      "migration": "No consumer migration is required; older compatible SDK peers retain the validated sequential proof fallback, and BRC-103/104, AuthFetch, React Native, the mobile bridge, JSON-RPC, and remote storage contracts remain unchanged."
+      "summary": "Carries the lockstep mobile build with batched proof assembly, linear funding/signing work, canonical P2PKH verification, expired-reservation filtering, complete privacy-safe createAction timings, and resilient UMP account lookup.",
+      "migration": "No API or persistence migration is required. Mobile wallets receive the resilient partial-host UMP lookup behavior described for @bsv/wallet-toolbox; older compatible SDK peers retain the validated sequential proof fallback, and BRC-103/104, AuthFetch, React Native, the mobile bridge, JSON-RPC, and remote storage contracts remain unchanged."
     },
     {
       "name": "create-bsv-app",

@@ -34,6 +34,21 @@ attention to changes that materially alter behavior or extend functionality.
 - Make expired action-batch reservations non-blocking in indexed queries and
   repair MySQL rollback support indexes. Existing databases migrate through the
   normal Knex path, and full PXC down-to-empty/re-upgrade is regression-tested.
+- Make UMP account lookup resilient to stale SLAP advertisements and partial
+  overlay failure. One verified matching token establishes an existing account;
+  otherwise one clean empty response establishes a new account. Malformed,
+  rejected, empty, and unavailable peers cannot veto a verified token, and
+  malformed or unavailable peers cannot veto a clean empty response. Lookups
+  with no usable response remain errors; WAB existing-account continuity still
+  prevents replacement-wallet onboarding.
+- Resolve competing verified UMP tokens on on-chain proof. A candidate spent
+  anywhere in another candidate's BEEF ancestry is superseded (evidence merged
+  across hosts serving different depths; ancestry walked iteratively so deep
+  update chains cannot exhaust the stack). Forked candidates resolve only when
+  exactly one provably consumed a same-identity predecessor token, which
+  requires the account's keys; anything less decisive stays an error so a
+  wrong token can never be chosen silently. Resolved conflicts report a
+  `supersededTokens` count in lookup telemetry.
 - Plan legacy `createAction` funding against the exact unreserved managed-change
   set before persistence, claim the selected inputs atomically in one storage
   transaction, and fail economically impossible fragmented wallets before
@@ -225,6 +240,7 @@ attention to changes that materially alter behavior or extend functionality.
 
 - audit fix
 
+
 ## wallet-toolbox 2.1.14
 
 - fix update timestamp on all updated currencies

@@ -58,20 +58,32 @@ not affect authentication or wallet behavior.
 `authenticationFlow` starts as `unknown`. A password cannot create a wallet
 until account lookup has completed.
 
-An empty UMP answer means `new-user` only when every selected overlay host
-settled successfully and returned an empty output list. Timeout, host failure,
-malformed response, semantic rejection, or a malformed UMP token raises
-`UMPTokenLookupError`. Multiple distinct valid UMP tokens are also treated as
-ambiguous instead of choosing one by response order. Applications should
-present retry and account-recovery options for these errors, never a
-new-password prompt.
+UMP account lookup prefers usable evidence over peer unanimity. Exactly one
+verified token matching the requested presentation or recovery hash means
+`existing-user`, regardless of empty, malformed, rejected, or unavailable peer
+responses. When no token verifies, one host's valid empty output list is enough
+to mean `new-user`; malformed and unavailable peers cannot veto that result.
+Multiple distinct verified UMP tokens resolve on on-chain proof alone. A token
+update spends its predecessor's outpoint, so a candidate spent anywhere in
+another candidate's transaction ancestry (walked through each candidate's BEEF,
+with evidence merged across hosts serving different depths) is superseded.
+Forked candidates with no spend relationship resolve only when exactly one of
+them provably consumed a same-identity UMP token — spending a token requires
+the account's keys, so this demonstrates continuity of control, whereas an
+independently minted competitor is typically the residue of an erroneous
+re-onboarding. A resolved conflict reports `supersededTokens` in the completed
+event. Anything less decisive — true forks, competing proven continuations, or
+candidates without examinable evidence — remains ambiguous, and a lookup with
+neither a verified token nor a clean empty response raises
+`UMPTokenLookupError`. Applications should present retry and account-recovery
+options for these errors, never a new-password prompt.
 
 WAB completion uses an explicit `accountStatus` or `existingUser` response when
 available. For older WAB servers it derives the status from the established
 protocol: a new account returns the temporary presentation key, while an
 existing account returns its stored key. If WAB identifies an existing account
-but UMP authoritatively appears absent, `WABAccountContinuityError` prevents
-new-wallet creation.
+but UMP lookup returns no verified token, `WABAccountContinuityError` prevents
+new-wallet creation even when an overlay host returned a clean empty result.
 
 Temporary WAB authentication state expires after ten minutes by default and is
 cleared when authentication is cancelled, completed, or destroyed.