iPhone: a push shows its line first and the outcome replaces it; a crash loop on open lands in safe mode; a closed-app payment is one history row

PullCap's night of 2026-10-22 on an iPhone: four hourly payments made while
closed, no notification for the fourth, then no more wake-ups until the app
was opened — WebKit's silent-push quota. APNs accepted every push (no 410);
the device had stopped listening. The stand-in line went up at the END of
the push handler, after a payment that can take most of the budget, and a
worker stopped before its last line showed nothing. On an Apple endpoint the
line now goes up first and the outcome ("Payment sent") replaces it.

The same phone then crashed on every open ("A problem repeatedly occurred").
An inline guard counts page starts before the app runs; the app clears the
count after eight seconds alive or a clean leave, and notes the boot phase
it reaches. A third start in a row opens in safe mode: no automatic Ark
connection, a notice naming the last phase, "Open normally" and "Copy
report".

Every payment the worker made showed twice once the app opened: the worker's
own ln-send row (merged from the mirror) and the "while closed" note the app
adds from its spend log. The note now stamps the existing row, and
lnFoldedIds hides a twin that still forms. The balance was never counted
twice — it comes from the coins.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

1 files changed, 32 insertions, 0 deletions

diff --git a/src/app.js b/src/app.js
index eb51e2f..ffe9ba8 100644
--- a/src/app.js
+++ b/src/app.js
@@ -585,6 +585,15 @@ let _publicChatMode = false;
 // welcome screen is the one screen that must never be guessed at. The boot
 // shell holds the frame for those few ms instead; see the dispatch below.
 let _bootDeciding = true;
+// Boot phases for the crash-loop guard (build.js BOOT_GUARD counts page
+// starts): the app notes the phase it reaches, and clears the count once it
+// has lived eight seconds or leaves cleanly. A page iOS kills while opening
+// does neither, so the third start in a row opens in safe mode.
+export function bootPhase(p) { try { localStorage.setItem('coinos-boot-phase', p); } catch {} }
+function bootSettled() { try { localStorage.removeItem('coinos-boot'); } catch {} }
+export const safeBoot = () => !!(typeof window !== 'undefined' && window.__safeBoot);
+document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'hidden') bootSettled(); });
+addEventListener('pagehide', bootSettled);
 // Belt and braces: a boot path that returns early (or throws) must not leave
 // the welcome screen held back forever. Nothing legitimate is still deciding
 // four seconds in — the store wait alone caps at 800ms.
@@ -4478,6 +4487,7 @@ function walletScreen() {
     brandHeader(true),
     h('div', { class: 'mt16' }, balanceCard()),
     ui.offlineFallback && wallet.offline ? offlineBanner() : null,
+    safeBootNotice(),
     backupNotice(),
     ...featureAll('walletNotices'),
     tabsBar(),
@@ -4536,6 +4546,24 @@ function backupNotice() {
     } }, t('backupReminderGo')));
 }
 
+// Safe mode (see BOOT_GUARD in build.js): the app crashed on open twice in a
+// row, so this boot made no automatic connections. Say so, name the phase
+// the last boot reached, and offer the way back.
+function safeBootNotice() {
+  if (!safeBoot()) return null;
+  const phase = (typeof window !== 'undefined' && window.__bootPhase) || '?';
+  const report = () => ['Coinos safe mode', 'build ' + (typeof window._v === 'string' ? window._v : '?'),
+    'starts without a clean boot: ' + window.__safeBoot, 'last phase: ' + phase, navigator.userAgent].join('\n');
+  return h('div', { class: 'notice info col', style: 'margin:12px 0 0;gap:8px' },
+    h('b', {}, t('safeBootTitle')),
+    h('span', { class: 'small' }, t('safeBootBody', { n: window.__safeBoot - 1, phase })),
+    h('div', { class: 'row', style: 'gap:8px' },
+      h('button', { class: 'btn-sm', onClick: () => { bootSettled(); location.reload(); } }, t('safeBootOpen')),
+      h('button', { class: 'btn-sm', onClick: (e) => {
+        navigator.clipboard?.writeText(report()).then(() => { e.target.textContent = t('safeBootCopied'); }).catch(() => {});
+      } }, t('safeBootCopy'))));
+}
+
 function offlineBanner() {
   return h(
     'div',
@@ -6824,6 +6852,7 @@ window.addEventListener('load', () => {
   }, 1000);
 });
 loadLocale(getLang()).finally(async () => {
+  bootPhase('boot');
   applyBootAutoLogout(); // clear an overdue session before we read it for claim targets
   // Public read-only community chat: no wallet, no login — the join material
   // ships in the bundle, so the page decrypts client-side (src/public-chat.js).
@@ -6849,6 +6878,7 @@ loadLocale(getLang()).finally(async () => {
   // and a wallet opening in fiat should open with a number in it.
   refreshRates().then(() => { if (unit === 'fiat') render(); }).catch(() => {});
   setInterval(() => { refreshRates().then(() => { if (unit === 'fiat') render(); }).catch(() => {}); }, 10 * 60_000);
+  bootPhase('store');
   const storeReady = featureHook('arkStoreReady');
   // the IndexedDB caches (profiles, reports, …) open alongside: a wallet's
   // caches are read as soon as it opens
@@ -6859,6 +6889,8 @@ loadLocale(getLang()).finally(async () => {
   _bootDeciding = false; // from here on the screen is a decision, not a guess
   const opened = restoreAccountsState();
   if (!opened) render();
+  bootPhase('ui');
+  setTimeout(bootSettled, 8000);
   if (WAKE_PAYLOAD != null) {
     // Nothing opened — a locked vault, or no wallet on this device. There is
     // nothing to answer with, so say so now.