Custody is a choice, and coinos holding the coins is the default: nothing renews on its own and no renewal fee is paid unless the user opts in

Why: renewal fees were "money passively draining" to people who thought they had a custodial wallet (Stacker News, 2026-10-22). Measured over Sep–Oct: 84% of what users paid came from the client's own consolidation round at 20 coins (0.2% + 300 on every fresh coin), the rest from 300-sat rounds that each cohort of Lightning-received coins (30-day pool lifetime) triggered on its own schedule. The ASP itself honors a coin past its timelock — rounds and offboards never checked expiry, and captaind's allow_expired_arkoor (now on at ark.coinos.io) lets arkoor spends through too — so expiry only ever meant "the exit is gone", which most people coming from v2 never had.

Settings → Spending gets a Custody card with three tiers:
- coinos holds my coins (default): no renewals, no fees; a coin past its timelock shows as "held by coinos", stays spendable and receivable, and is left out of a unilateral exit (there is nothing on-chain for it to take).
- Keep my own exit: renew in the last hours (free bracket + base), the server backstop registered 36 blocks out and snapped to a 48-block grid so every wallet's orders share one round.
- Renew a week early: 1008 blocks out on a 144-block grid (0.1% + base).
renewPolicy() in ark/manager.js is the one table; the app, the service worker (the mirror carries the tier) and the Manage page all read it. Only shown on servers that honor expired coins (presets carry honorsExpired); elsewhere renewal stays automatic.

Manager: honorsExpired makes a past-timelock coin ordinary money (balance, selection, receive validation via acceptExpired) while a server refusal (expiryRejected) still excludes it; such coins spend LAST so an older build on the receiving side almost never meets one. A once-per-wallet rescan re-reads the mailbox and adopts coins older builds refused as expired, un-forgets expired dust, and clears stale refusals. The refresh gate that retired a renewal of expired inputs is gone (the server accepts them; the Manage page's Renew of exactly those coins was failing silently). Automatic consolidation is gone; the send cap goes 24 → 48 coins; small change (<1,000 sats) folds into a renewal that happens anyway.

Server (cs:~/ark/captaind-main.toml, restarted): allow_expired_arkoor = true; pool vtxo_lifetime 4320 → 8640 so Lightning-received coins live as long as the rest.

Tests: tools/ark/custody-test.js (policies, honoring, ordering, grid snap, validator), tools/ark/custody-ui-test.js (the card, held coins, exit count, switching), nwc-sw-test updated for the tier the worker reads.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

1 files changed, 16 insertions, 0 deletions

diff --git a/src/i18n.js b/src/i18n.js
index a07cba4..6d36f49 100644
--- a/src/i18n.js
+++ b/src/i18n.js
@@ -777,6 +777,22 @@ const STR = {
     arkFeeChain: 'On-chain fee',
     arkFeeService: 'Service fee',
     arkCoinsExpired: 'expired',
+    arkCoinsHeld: 'held by coinos',
+    arkCustodyTitle: 'Custody',
+    arkCustodyDesc: 'Each Spending coin carries a timelock of about {days} days. Renewing a coin before it runs out keeps your right to bring it on-chain without coinos, and costs a share of a round’s mining fee. coinos keeps honoring coins past their timelock, so renewing is a choice:',
+    arkCustodyCustodial: 'coinos holds my coins',
+    arkCustodyCustodialDesc: 'Nothing renews and no renewal fees are paid. Past its timelock a coin is held by coinos, like a balance on the old coinos: paying, receiving and withdrawing keep working, but bringing it on-chain needs coinos’s cooperation.',
+    arkCustodySelf: 'Keep my own exit',
+    arkCustodySelfDesc: 'Coins renew in the last hours before their timelock ends — the cheapest moment — so you can always exit on your own. Roughly once every {days} days per coin.',
+    arkCustodyEarly: 'Renew a week early',
+    arkCustodyEarlyDesc: 'Coins renew about a week before their timelock ends, a margin in case coinos is unreachable right at the end.',
+    arkCustodyCostNone: 'no fees',
+    arkCustodyCostSelf: '{base} per renewal',
+    arkCustodyCostEarly: '{pct} + {base} per renewal',
+    arkCustodySaved: 'Custody choice saved',
+    arkCustodyNotHere: 'This server does not honor coins past their timelock, so they renew automatically here.',
+    arkExitNoneExitable: 'Every coin has passed its timelock, so there is nothing a unilateral exit can take on-chain: coinos holds them now. Renewing restores your own exit; withdrawing with coinos’s cooperation works as before.',
+    arkCoinsRenewDescCustodial: 'With “coinos holds my coins”, nothing renews on its own. A renewal replaces the selected coins with a single fresh one in the next round ({every}) and restores your own exit for them. Every renewal costs a flat {base} toward the round’s on-chain fee, plus a share that depends on how close each coin is to its timelock. The closer, the cheaper:',
     noteForeignKind: 'A kind {kind} event this app doesn’t show.',
     zapRowText: 'zapped {n} sats',
     pollVoter: '{n} vote',