v5.7.0

v5.7.0 — Arbiter accountability, and trades that come back

Two threads land together: the arbiter is no longer the least-accountable
party on the screen, and history that looked lost is recoverable.

The arbiter, described

An arbiter is the only participant who can decide where your money goes, and
was the only one nobody described. Their commitment is now shown in Parties by
default — how much is locked, how long it has stood, and the funding outpoint,
so anyone can check the claim in a block explorer instead of trusting the app.
The tint deepens with tenure and is never green: time is a fact, and Chama does
not vouch for people.

The rescue is no longer silent

Substitution has always worked — an assigned arbiter who never answers a
dispute is replaced by a backup and the trade settles. Nobody was told. Now the
trade says a backup stepped in, and the arbiter who didn't show carries that on
their own standing. Derived purely from the committed chain: no new event, no
reducer change, every client computes the same number. Deliberately narrow —
slow is not absent, and an unresolved dispute is still live.

Fault attestations (engine, dormant)

Kind 38136: a signed statement that an arbiter acted in bad faith, valid only
when BOTH principals of a settled disputed trade sign it. One side alone is
worth exactly nothing — whoever loses a dispute always feels cheated, so the
winner's signature is what makes it credible. Settled-only, so it can never
become leverage over a ruling in progress. Costs the arbiter the seat for at
least 180 days on an absolute clock (term length is their own choice, so terms
are the wrong unit), never a satoshi of their bond, and the accused gets a
signed right of reply that travels beside the accusation.

Exclusion is a PREFERENCE: if honouring it would leave nobody assignable, it is
dropped and they are seated. Punishing an arbiter by stranding a trade would
punish the traders instead.

Shipping dormant — reads are gated off until the dual-signature flow exists,
since no valid attestation can exist before then.

Honest about what a bond is

The ceremony now states the tradeoff where an arbiter posts real money: nobody
can seize these sats or pay a wronged trader from them, and they return at term
end even if the arbiter ruled badly. The weight is the lock, public standing,
and whether anyone seats them again. Better said plainly by us than discovered
by a critic.

Trades that wouldn't open, now open

The durable event cache existed for exactly the case that kept failing, and
never fired: it was consulted only when relays returned NOTHING, so a partial
answer skipped it, replay failed on the incomplete chain, and the UI blamed
relay eviction that mostly wasn't happening. A failed replay now retries
against the cache. On a long-lived device this recovers dozens of trades whose
missing pieces were already on disk.

Repair is opt-in — an explicit open, a deep link, or a manual heal. Boot
discovery, listing hydration and sweeps stay relay-only, because moving
IndexedDB back onto the launch path is what froze Tauri at startup once before.

Load failures now say which failure it was: nothing found anywhere, an
incomplete chain, or an undecryptable one. Recovered events are handed back to
the community relay so the repair reaches the other participants too — one
relay, once per trade per session, capped and paced. And anything the relay
didn't accept is queued and re-offered on its next connect, so a vote published
during a reconnect stops vanishing in the first place.

Arbiter premiums stopped being paid twice

The premium double-pay guard was device-local for an identity-level payment, so
every fresh device or origin swept its settled trades and paid again. The gate
is now the trade's own chain: a 38113 authored by you IS proof you already paid.
No new storage, no sync, works across every device.

Also

• Uncollected ecash from Manual Fund is stashed durably and offered back
  ("put it back in my wallet") instead of existing only as a string on screen.
• An already-renewed bond is no longer offered for renewal — it pointed at an
  outpoint that no longer exists — and the renew CTA stops calling itself
  "recommended" when a live bond already stands.
• Ruling-concentration analysis (how often an arbiter's rulings favour the same
  counterparty) is built and tested; not yet displayed.

Verified: 3,476 tests green, typecheck clean. The recovery path is reproduced
end to end against a fake relay — a COMPLETED chain served without its votes
fails as incomplete, is reported honestly rather than as gone, opens once the
cache fills the gap, and republishes exactly the missing votes.