Recovery & limits
Resolve uncertain wallet results, retain destination bindings, and keep the right backups.
An uncertain result is not a failed payment
The journal records signing intent before invoking the wallet. If a response is lost, another signature stays blocked across reload. Verify the original transaction or bound on-chain record before continuing.
A timeout does not authorize automatic resending. Retain the original operation, nullifier, vault, recipient, and disclosure reference.
Retry only when contract state permits
- Active deposits and Complete withdrawals are already finished.
- NotFound does not trigger automatic resubmission.
- Retryable operations expose bound recovery calls. Unacknowledged pending registry requests use the contract’s 20-block delay.
- Withdrawal retries keep the original vault and recipient with no second protocol fee. Applicable NEAR storage and gas still apply.
- A permanently missing vault payout callback remains conservatively reserved. This version cannot safely reset or redirect it.
Keep each backup separate
The browser journal uses passphrase-derived encryption and cross-tab exclusion. There is no passphrase recovery. Backup restoration requires empty storage and refuses overwrite.
The optional invoice library has a separate encrypted backup for signed business requests. It does not replace private-note backups or wallet-operation recovery. The service cannot recover a lost library passphrase. Restore into empty library storage or merge after unlocking the existing library.
Browser notes use a separate encrypted single-note file. Download and reopen it before preparing a deposit; it is not persisted in local storage. The backup carries its original policy and can be used in the local CLI for Groth16 spend proving. Locking or leaving does not retain the active note.
Private notes and the invoice library also lock on page-hide and persisted history-cache return. Pending work cannot reopen the locked view. Encrypted invoice-library storage remains intact; a note must be reopened from its saved backup.
The operation journal and settlement workspace also lock on page-hide and persisted cache return. Pending decrypt, restore, review and approval work cannot reopen the journal or dispatch a late wallet request. If a wallet request already started, its durable signing intent remains blocked for explicit reconciliation; locking does not prove failure or permit another signature.
Private receipts have their own encrypted full-receipt backup. Selected disclosure files contain only the fields you exported and cannot restore all eight original openings. Keep the full receipt and passphrase separately; the service stores no receipt recovery copy.
| Record | What it preserves |
|---|---|
| Encrypted private note | Downloaded file with spend secrets and original group policy; not persisted in browser storage. |
| Encrypted full receipt | Downloaded file with all eight openings; selected disclosure files cannot restore it. |
| Encrypted browser journal | Stored locally with operation metadata and unresolved signing intents; not spendable notes. |
| Encrypted invoice library | Optional local signed-request archive and separate backup; no trusted paid-status cache. |
| Signed invoice / selected disclosure | Readable terms or selected openings; not an encrypted backup or tax certificate. |
Recover organization access
If the session expires or the signing key is removed in finalized chain state, sign in with a current FullAccess wallet key. If membership was removed, an authorized organization member must issue a new directed invitation. A wallet login does not restore that membership.
Version conflicts require a fresh read and explicit review. After an uncertain mutation result, inspect Members, Invitations and the Audit log before retrying; there is no automatic mutation replay. An Owner must transfer to an active member before leaving, and there is no lost-wallet Owner reset.
Organization records use a separate server database. Consistent online backup and digest-pinned restore commands now create quarantined files with sessions and login challenges discarded. The service refuses to start from these files. Browser note, receipt, journal and invoice-library backups cannot recover this database.
The operator generates a blank access-review template, checks every current owner/member and revision against independent current authority, and obtains approval of the exact review-file hash. Historical roles are not prefilled or inherited. Activation revokes historical memberships and pending invitations, grants only reviewed access, advances revisions and records recovery audit in a new database.
Each restore has a new recovery ID and a one-use activation intent. A review for another restore or a reused activation is rejected. If current authority is unavailable, leave the data quarantined. A checksum or fresh wallet login cannot establish who retained organization permissions after an old snapshot.
Stop all old API instances before cutover and require everyone to sign in again. Existing old processes cannot be revoked by creating another database. Current-audience recovery is supported; audience migration, encrypted off-host transport, backup scheduling and retention remain operator configuration.
Current protocol limits
Groups use fixed denominations and 256 total outputs, including private transfers. Withdrawal does not recycle capacity. Groups remain separate proof/privacy domains. Arbitrary-amount private payments, automatic private cross-group migration and a bundled funded browser FT deployment remain outside this release. A separate native NEAR reference group is documented with its recorded qualification.
Production use needs independent contract/circuit/SDK review and a reviewed trusted setup. The Sumsub connector is available through Organization → Verification; actual provider qualification, full jurisdiction legal advice and statutory filing remain separate. Source-bound Tax drafts provide limited internal preparation with independent review.