ty-everett · Oct 11, 2026 · Oct 3, 2026 · Oct 3, 2026 · Oct 3, 2026 · Oct 3, 2026
@@ -82,6 +82,12 @@ output-tag ID arrays like omitted optional filters, matching Knex. Nonempty
 arrays, partial predicates and user ownership remain enforced. No API, wire
 or database migration is required.
 
+Internalizing an unproven transaction new to a user attempts broadcast before
+storing recipient outputs, including a sender's no-send transaction already
+known to shared storage. Rejected broadcasts return a review-actions error
+and store no recipient outputs. Transactions backed by a mining proof are
+not rebroadcast. Upgrade active storage; no API, wire or schema migration is required.
+
 ## Backup and recovery
 
 Recover both key material and wallet records; a manager snapshot or device

@@ -77,6 +77,12 @@ negotiated compact binary JSON codec. Legacy peers retain numeric-array JSON
 and identical transaction/proof bytes. Authentication and payload ceilings
 remain unchanged; upgrade both clients and active storage for the savings.
 
+Internalizing an unproven transaction new to a user attempts broadcast before
+storing recipient outputs, including a sender's no-send transaction already
+known to shared storage. Rejected broadcasts return a review-actions error
+and store no recipient outputs. Transactions backed by a mining proof are
+not rebroadcast. Upgrade active storage; no API, wire or schema migration is required.
+
 ## Backup and recovery
 
 Recover both key material and wallet records; a manager snapshot or device

@@ -29,6 +29,12 @@ output-tag ID arrays like omitted optional filters, matching Knex. Nonempty
 arrays, partial predicates and user ownership remain enforced. No API, wire
 or database migration is required.
 
+Internalizing an unproven transaction new to a user attempts broadcast before
+storing recipient outputs, including a sender's no-send transaction already
+known to shared storage. Rejected broadcasts return a review-actions error
+and store no recipient outputs. Transactions backed by a mining proof are
+not rebroadcast. Upgrade active storage; no API, wire or schema migration is required.
+
 ## Optional registry descriptions
 
 ProtoMap, BasketMap and CertMap supply descriptive metadata, not permission grants.

@@ -6,6 +6,11 @@ attention to changes that materially alter behavior or extend functionality.
 
 ## wallet-toolbox 2.14.7
 
+- Internalization broadcasts unproven transactions new to the receiving user,
+  including shared-storage no-send payments. A rejected broadcast stores no
+  recipient outputs; proven transactions are not rebroadcast. Upgrade active
+  storage; no API, wire or schema migration is required.
+
 - IndexedDB empty certificate certifier/type, transaction status and output-tag
   ID arrays mean no optional filter, matching Knex. Nonempty arrays, partial
   predicates and user ownership remain enforced; no schema migration is required.

@@ -252,6 +252,15 @@ describe('WalletStorageManager tests', () => {
         isValidRootForHeight: async (_root: string, _height: number) => true
       }))
       fred.services.getChainTracker = getChainTracker
+      // Receiving an unproven no-send payment now broadcasts it. Keep this
+      // writer-batch fixture independent of public transaction processors too.
+      const postBeef = jest.spyOn(fred.services, 'postBeef').mockImplementation(async (_beef, txids) => [
+        {
+          name: 'writer-batch-fixture',
+          status: 'success' as const,
+          txidResults: txids.map(txid => ({ txid, status: 'success' as const }))
+        }
+      ])
       const promises: Array<Promise<number>> = []
       const result: Array<{ i: number; r: any }> = []
       const crs1: bsv.CreateActionResult[] = []
@@ -310,6 +319,8 @@ describe('WalletStorageManager tests', () => {
       for (let i = 0; i < maxI; i++) promises.push(makeWriter2(fred, crs1[j++], i, result))
       await Promise.all(promises)
       expect(result).toHaveLength(maxI)
+      expect(new Set(postBeef.mock.calls.flatMap(call => call[1]))).toEqual(new Set(crs1.map(cr => cr.txid)))
+      postBeef.mockRestore()
       expect(getChainTracker).toHaveBeenCalled()
       await fred.wallet.destroy()
     }

@@ -658,7 +658,7 @@ class InternalizeActionContext {
     if (btx == null) throw new WERR_INTERNAL(`Could not find transaction ${this.txid} in AtomicBEEF`)
     const bump = this.ab.findBump(this.txid)
 
-    let pr: StorageProvenOrReq = { isNew: false, proven: undefined, req: undefined }
+    let pr: StorageProvenOrReq = { proven: undefined, req: undefined }
 
     await this.storage.transaction(async trx => {
       if (bump != null) {
@@ -694,9 +694,8 @@ class InternalizeActionContext {
 
     const transactionId = this.etx!.transactionId
 
-    if (pr.isNew) {
-      // This storage didn't know about this txid and the beef didn't include a mining proof.
-      // Assume the transaction has never been broadcast.
+    if (pr.proven == null) {
+      // The transaction is new to this user and the beef didn't include a mining proof.
       // Attempt to broadcast it to the network, throwing an error if it fails.
 
       // Skip looking up txids and building an aggregate beef,

@@ -150,6 +150,9 @@ describe('idb find tests', () => {
       expect(await storage.findTransactions({ partial: {}, status: [status] })).toEqual(
         rows.filter(row => row.status === status)
       )
+      // A nonempty status filter must still reject rows that do not match.
+      expect(rows.every(row => row.status !== 'failed')).toBe(true)
+      expect(await storage.findTransactions({ partial: {}, status: ['failed'] })).toEqual([])
       expect(await storage.findTransactions({ partial: { userId: setup.u1.userId }, status: [] })).toEqual(
         rows.filter(row => row.userId === setup.u1.userId)
       )