coinosv3-server.git/names, branch master

names: custom offers carry their owner's key; ones that can't reach a wallet are retired

2026-10-22T05:19:07Z

Releasing a name disabled its own offer but left its custom offers live (27 orphans on 2026-10-22, rick@ had 4): a payment to one found no name and no key, and would have sat in the forward queue for good. Custom offers now record the owner's pubkey (backfilled at start from the name, or for an orphaned npub1xxxxxxx@ name from the one current key with that npub prefix — 4 recovered), and the settle loop forwards by it, so a released name's offer pays the same key's name now, as the name's own offer already did. Orphans with no owner to follow are disabled on the node and dropped (23), as are a released staging name's. Co-Authored-By: Claude Opus 5.5

names: mint nothing payable for a wallet on another network, and retire what was minted

2026-10-22T05:16:57Z

A staging name is a mutinynet wallet, but every claim got a mainnet BOLT12 offer on our node published in its record, and custom offers and POS sales were minted there too: real sats paid that way had no route onward (2,092 sat parked on 2026-10-22). otherNetwork() — the record's ark address decides, a staging name without one is mutinynet — now gates the claim's stand-in offer, custom offers and POS invoices (LNURL already refused staging). At start, retireOtherNetworkOffers() disables the offers already out there (83 staging names, 13 custom offers), takes their lno= out of the published DNS record and drops them from state; idempotent, so a failure retries next start. npub1x7acf8s@staging.coinos.io keeps its offers: its wallet is mainnet. Co-Authored-By: Claude Opus 5.5

names: a queued payment the float can cover goes now, backoff or not

2026-10-22T05:03:55Z

Float top-ups that missed their 60 s settle window landed later (+300k on 2026-10-22 once the ASP's vtxo pool refilled), but only a top-up seen to settle resets the queue's backoff, so jarryd's 248k sat in a 1-hour wait with 477k in the float. Co-Authored-By: Claude Opus 5.5

names: a wallet on another ark server gets its own Lightning invoice, one on another network is parked

2026-10-22T04:43:05Z

The float step threw 'address belongs to a different ark server' before the Lightning step ever ran, so manna and rogerv3 (wallets on Second) were retried 100 times since 10-18 without once asking their wallets for an invoice. The destination's ark id now decides: the float only on our own server, otherwise straight to the wallet's CLINK invoice — those wait for the wallet without paging (waitingOnWallet in /health). A staging name's tark address paid real sats through its mainnet offer has no route at all: such a forward is parked (state.parked, with its reason) instead of retried forever, and /health counts it for the desk monitor. Ten such payments (2,092 sat, Sep–Oct test payments to @staging.coinos.io names) had been retried ~900 times each. Co-Authored-By: Claude Opus 5.5

names: deliver to coinos wallets over a circular route, shrink failing float top-ups, report stuck money in /health

2026-10-22T04:39:11Z

The ASP's vtxo pool sat empty for 35 hours (2026-10-20/22: 614k in the rounds wallet against 1.12M needed to refill), and two forwards of ~124k for jarryd sat in the queue the whole time: - viaClink paid the wallet's own invoice with a plain pay, but a coinos wallet's invoice is minted by our ASP on this very node: a self-payment the hold plugin never sees ('Destination said it doesn't know invoice'). It now goes out and back in over a channel pair (payCircular, shared with the float top-up) and waits for the wallet to claim, so a payment is delivered whenever the wallet is open, float or no float. - a float top-up that doesn't settle halves the next ask (down to 20k), back to full size after one lands: 79 tries of 200k failed where the pool's 100k coins could have funded half of it. - the retry tick can't overlap itself any more (a circular delivery waits up to 4 min; an overlapping tick would forward the same payment twice). - /health reports pendingSat, oldestPendingAt, the top-up failure streak and last error, and payments for wallets on another ark server apart (undeliverable): the desk float monitor pages on these. Co-Authored-By: Claude Opus 5.5

live: a name streams a day after it's claimed (the registrar now records when; older records count from their last update), never if banned; GET /live/allowed says which and until when. Viewers can report a stream (POST /live//report, NIP-98): kept in .reports.jsonl and DM'd to the admins from the welcome key. An admin takes a stream down (POST /live//remove {ban}): it ends, its playlists and segments answer 410, its files move to .removed/ (kept for reporting, never trimmed), and a ban stops its sender streaming.

2026-10-19T06:03:57Z

Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg

coinosv3 → 73bffd9: the services run the wallet's current Ark code; names/vendor/ goes.

2026-10-16T23:33:53Z

The pin had stayed at 082fc2e (Sep 14) while the app's Ark manager moved on — renewals priced at a 300-sat base fee and re-priced on "insufficient refresh fee", expiry-aware coin selection, standing (scheduled) renewals merged by unlock hash, policy-aware freeing of in-flight coins — so the registrar's forwarder float was a month behind the wallets it forwards to. The manager's constructor, the methods the services call (balance, sync, refresh, send, address, createLnInvoice, driveLn, startBoard, pendingActions, htlcClaim, htlcCosignRefund, _key) and the storage contract (load → state or null, save ← state) are unchanged between the two commits, and nothing new is imported from a package the server lacks. names/translate.js imports translate-split.js from the submodule now, as feed/cache.js already did lang-guess.js: the vendored copies were byte-equal to what the pin now carries. The README's note about them goes with them. Resolve-checked every service entry (bun build --target=bun); the moved tests (registry-ownership, public-feed-cache) and the bun-test files (deepl-translate, names/store) pass. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J1Kon8bxJoHRpJdSzshCkp

README, example config and the deploy hook

2026-10-16T19:58:17Z

Co-Authored-By: Claude Opus 5.5

names: keep state in SQLite

2026-10-16T19:57:19Z

persist() rewrote the whole state file, close to 10 MB, on every settled payment and every queue tick, so one crash during a write could take every name with it. State now lives in SQLite (bun:sqlite, WAL, synchronous=FULL): one row per name, offer, invoice and so on, with the forwarder wallet's state kept as a single row. Each persist() is one transaction that writes only the rows that changed, so a crash leaves the previous state or the new one, never a torn file. The in-memory state object and every persist() call stay as they were. On the first start the JSON state file is imported, and a corrupt one stops startup. The file is left in place, so a rollback to the JSON build still finds its data. store.snapshot() makes a consistent copy while the service runs, for backups. Co-Authored-By: Claude Opus 5.5

Make this the coinosv3-server repo: the services, with coinosv3 pinned

2026-10-16T19:57:19Z

Carved out of coinosv3 (names, feed, nwcpush, blossom, vmedia, bridge and their tests, with history). The shared wallet code they import (src/ark, noffer, bolt12, popular-feed) now comes from a coinosv3 submodule pinned at 082fc2e, the commit the services have actually run on, so moving here changes no behaviour; bumping it is its own commit. The two text helpers translation uses arrived on the server later than that commit and are vendored under names/vendor at the versions deployed, until the pin moves past them. Root package.json pins the npm versions installed on the server. compose.yml runs names, nwcpush and blossom from this checkout (read-only) with configs and state under $STATE, outside the repo, and pins the Bun image. Co-Authored-By: Claude Opus 5.5