The third custody tier keeps exits cheap by depth, not by date: "Keep my exit cheap" renews a coin once its history is four hops deep

Why: a unilateral exit publishes one on-chain transaction per off-chain hop, so depth — not age — is what makes an exit expensive, and a renewal a week before expiry flattens exactly the same history a renewal in the last hours does. The week-ahead "early" tier only guarded against the server being unreachable at the very end, which is not the case worth selling. (Adam, 2026-10-23.)

exit = self (last-hours renewal, free bracket + base, the same grid-snapped backstop) plus: any coin whose genesis chain is 4+ hops deep is renewed in the next round the app runs, paying the top bracket + base — but only when that fee is under a tenth of the coin (flattening a 21-sat coin for 300 sats helps nobody; its exit is uneconomic anyway). Deep coins ride along with an expiry renewal when one is due, or get a round of their own. The server-side backstop stays near-expiry only: depth changes only while the wallet transacts, i.e. while the app is open. A stored 'early' reads as 'exit'. Card copy says what the hop count means and what the two prices are for.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

1 files changed, 34 insertions, 9 deletions

diff --git a/src/features/ark.js b/src/features/ark.js
index 7a77d2f..984c6a2 100644
--- a/src/features/ark.js
+++ b/src/features/ark.js
@@ -2602,8 +2602,9 @@ export function arkFeature(ctx) {
   // default is coinos: most people come from v2, where coinos held
   // everything, and the server honors a coin past its timelock anyway. The
   // two renewing tiers are the opt-ins, for those who want the exit kept
-  // (self) or kept with a week's margin (early). Only shown on a server that
-  // honors expired coins; elsewhere renewal is the only way to keep money.
+  // (self) or kept cheap by flattening deep histories early (exit). Only
+  // shown on a server that honors expired coins; elsewhere renewal is the
+  // only way to keep money.
   function custodyCard() {
     if (!arkAvailable() || wallet.watchOnly) return null;
     const cfg = getArkConfig();
@@ -2615,11 +2616,13 @@ export function arkFeature(ctx) {
     const ppmAt = (blocks) => (table.filter((e) => e.thresholdBlocks <= blocks).pop()?.ppm) ?? 0;
     const lifeDays = Math.max(1, Math.round(((info && info.vtxoExpiryDelta) || 8640) / 144));
     const baseCost = base ? fmtSats(base) + ' sats' : t('arkDepthFree');
-    const earlyPct = pct(ppmAt(1008));
+    // an early renewal pays the bracket a fresh coin sits in (the top one)
+    const earlyPct = pct(ppmAt(((info && info.vtxoExpiryDelta) || 8640) - 1));
+    const hops = (renewPolicy('exit', getNetwork()) || {}).maxDepth || 4;
     const tiers = [
       { id: 'custodial', label: t('arkCustodyCustodial'), desc: t('arkCustodyCustodialDesc'), cost: t('arkCustodyCostNone') },
       { id: 'self', label: t('arkCustodySelf'), desc: t('arkCustodySelfDesc', { days: lifeDays }), cost: t('arkCustodyCostSelf', { base: baseCost }) },
-      { id: 'early', label: t('arkCustodyEarly'), desc: t('arkCustodyEarlyDesc'), cost: t('arkCustodyCostEarly', { pct: earlyPct, base: baseCost }) },
+      { id: 'exit', label: t('arkCustodyExit'), desc: t('arkCustodyExitDesc', { hops }), cost: t('arkCustodyCostExit', { pct: earlyPct, base: baseCost }) },
     ].filter((x) => honors || x.id !== 'custodial');
     return h('div', { class: 'card col ark-custody', style: 'gap:10px' },
       h('h3', { style: 'margin:0' }, t('arkCustodyTitle')),
@@ -3260,8 +3263,10 @@ export function arkFeature(ctx) {
   //     one did, and no renewal fee is ever paid. The holder trusts coinos.
   //   self — renew in the last hours before expiry, the free ppm bracket, one
   //     base fee per round (~300 sats): a unilateral exit is always possible.
-  //   early — renew a week ahead at 0.1% + base, for whoever wants a margin
-  //     against coinos being unreachable right at the end.
+  //   exit — the same, plus a coin is renewed as soon as its history is four
+  //     hops deep: an exit pays one on-chain transaction per hop, so this
+  //     keeps the exit price of every coin near a fresh coin's. Costs the
+  //     top bracket + base each time, so only for coins worth it.
   // The policy's window is when THIS app renews a coin (blocks of life left);
   // margin/grid aim the SERVER's own backstop order — a participation the ASP
   // runs on its own, registered far in advance, snapped to a grid so every
@@ -3275,7 +3280,8 @@ export function arkFeature(ctx) {
   // request.
   const CUSTODY_DEFAULT = 'custodial';
   function getCustody() {
-    const v = wallet.loadFeatureState ? wallet.loadFeatureState('arkCustody', null) : null;
+    let v = wallet.loadFeatureState ? wallet.loadFeatureState('arkCustody', null) : null;
+    if (v === 'early') v = 'exit'; // the third tier's first name (one day in October 2026)
     return CUSTODY_TIERS.includes(v) ? v : CUSTODY_DEFAULT;
   }
   function setCustody(tier) { if (wallet.saveFeatureState) wallet.saveFeatureState('arkCustody', tier); }
@@ -3354,7 +3360,26 @@ export function arkFeature(ctx) {
     try {
       const tip = await mgr.chain.tipHeight();
       const expiringCoins = spendables.filter((v) => v.expiryHeight && v.expiryHeight - tip < policy.window);
-      if (!expiringCoins.length) { arkRenewWarn = null; return; }
+      // The exit tier also renews a coin whose history has grown deep — each
+      // hop is one more on-chain transaction in a unilateral exit — but only
+      // a coin worth it: never more than a tenth of the coin on its renewal
+      // (300 sats to flatten a 21-sat coin's history would be absurd, and
+      // such a coin's exit is uneconomic whatever its depth).
+      const depthOf = (v) => { try { return mgr._decoded(v).genesis.length; } catch { return 0; } };
+      const deepCoins = !policy.maxDepth ? [] : spendables.filter((v) =>
+        !expiringCoins.includes(v) && depthOf(v) >= policy.maxDepth && mgr.refreshFee([v], tip) * 10 <= v.amountSat);
+      if (!expiringCoins.length && !deepCoins.length) { arkRenewWarn = null; return; }
+      if (!expiringCoins.length) {
+        // nothing is expiring: this round is for the deep coins alone, and
+        // they pay for it — the floor logic below still applies
+        arkRenewWarn = null;
+        let renewSet = [...deepCoins, ...spendables.filter((v) => !deepCoins.includes(v) && v.amountSat < 1000)];
+        const netSat = (set) => set.reduce((n, v) => n + v.amountSat, 0) - mgr.refreshFee(set, tip);
+        if (netSat(renewSet) < 330) return;
+        await mgr.refresh(renewSet.map((v) => v.id));
+        render();
+        return;
+      }
       const totalSat = spendables.reduce((n, v) => n + v.amountSat, 0);
       const renewable = totalSat - mgr.refreshFee(spendables, tip) >= 330;
       if (!renewable) {
@@ -3373,7 +3398,7 @@ export function arkFeature(ctx) {
       // Small change rides along, though: a coin under 1,000 sats costs at
       // most 2 sats of ppm in this round, and folding it in now spares it a
       // whole base fee's worth of round of its own when its turn comes.
-      let renewSet = [...expiringCoins, ...spendables.filter((v) => !expiringCoins.includes(v) && v.amountSat < 1000)];
+      let renewSet = [...expiringCoins, ...deepCoins, ...spendables.filter((v) => !expiringCoins.includes(v) && !deepCoins.includes(v) && v.amountSat < 1000)];
       // The set must clear the server's 330-sat output floor BY ITSELF — the
       // renewable check above prices the whole balance. Two dust coins at
       // expiry (133 sats between them) failed their renewal round silently