iPhone: a push shows its line first and the outcome replaces it; a crash loop on open lands in safe mode; a closed-app payment is one history row

PullCap's night of 2026-10-22 on an iPhone: four hourly payments made while
closed, no notification for the fourth, then no more wake-ups until the app
was opened — WebKit's silent-push quota. APNs accepted every push (no 410);
the device had stopped listening. The stand-in line went up at the END of
the push handler, after a payment that can take most of the budget, and a
worker stopped before its last line showed nothing. On an Apple endpoint the
line now goes up first and the outcome ("Payment sent") replaces it.

The same phone then crashed on every open ("A problem repeatedly occurred").
An inline guard counts page starts before the app runs; the app clears the
count after eight seconds alive or a clean leave, and notes the boot phase
it reaches. A third start in a row opens in safe mode: no automatic Ark
connection, a notice naming the last phase, "Open normally" and "Copy
report".

Every payment the worker made showed twice once the app opened: the worker's
own ln-send row (merged from the mirror) and the "while closed" note the app
adds from its spend log. The note now stamps the existing row, and
lnFoldedIds hides a twin that still forms. The balance was never counted
twice — it comes from the coins.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

1 files changed, 10 insertions, 0 deletions

diff --git a/build.js b/build.js
index eb81f80..838e891 100644
--- a/build.js
+++ b/build.js
@@ -159,6 +159,15 @@ const SW_REGISTER =
   `navigator.serviceWorker.addEventListener('controllerchange',function(){_ask(navigator.serviceWorker.controller)});` +
   `addEventListener('load',function(){navigator.serviceWorker.register('/sw.js',{updateViaCache:'none'}).catch(function(){})})}</script>`;
 
+// Crash-loop guard. iOS kills a page that dies twice in a row while opening
+// ("A problem repeatedly occurred") and the wallet is locked out with nothing
+// to go on. Count page starts here, before the app runs; the app clears the
+// count once it has lived a while or is left cleanly (hidden / pagehide) and
+// notes the boot phase it reaches. Three starts with no clear = the app
+// opens in safe mode: no automatic connections, a notice naming the last
+// phase, and a way back to a normal boot.
+export const BOOT_GUARD = `<script>try{var _bk='coinos-boot',_bn=+(localStorage.getItem(_bk)||0)+1;localStorage.setItem(_bk,String(_bn));window.__bootPhase=localStorage.getItem('coinos-boot-phase')||'';if(_bn>=3)window.__safeBoot=_bn;}catch(e){}</script>`;
+
 // Lazy bundles load as classic scripts into the page's global scope, where
 // the main bundle's minified top-level names already live — two Bun outputs
 // can mint the same identifier and die with "already been declared". An IIFE
@@ -434,6 +443,7 @@ ${siteTags(staging)}${pwa ? PWA_HEAD : ''}<script>try{var t=localStorage.getItem
 <body>
 <div id="app">${bootShell(await brandSvg(), staging)}</div>
 ${BOOT_SHELL_SCRIPT}
+${BOOT_GUARD}
 ${scriptHtml}
 ${pwa && !NO_SW ? SW_REGISTER + '\n' : ''}</body>
 </html>`;