1 files changed, 69 insertions, 3 deletions

diff --git a/src/features/ark.js b/src/features/ark.js
index 6952fc0..b155d17 100644
--- a/src/features/ark.js
+++ b/src/features/ark.js
@@ -24,6 +24,11 @@ function freeCoins(st) {
 function exitableCoins(st, tip) {
   return freeCoins(st).filter((v) => !(tip && v.expiryHeight && v.expiryHeight <= tip));
 }
+// The crash-loop guard's phase notes (build.js BOOT_GUARD, app.js bootPhase):
+// a boot iOS killed shows the last one it reached, and three in a row open
+// the app in safe mode, where nothing connects on its own.
+const bootPhase = (p) => { try { localStorage.setItem('coinos-boot-phase', p); } catch {} };
+const safeBoot = () => !!(typeof window !== 'undefined' && window.__safeBoot);
 import { loadBg, saveBg, buildBg, disarmSiblingRecords } from '../nwc-bg.js';
 import { boardFee, p2trAddress } from '../ark/board.js';
 import { maybeBolt11, maybeLnInvoice, lnSendFee, lnShortfall } from '../ark/lightning.js';
@@ -494,6 +499,7 @@ export function arkFeature(ctx) {
   }
   let arkTimer = null;
   let arkConnectPromise = null;
+  let arkInitPromise = null; // the manager's own init, apart from the snapshot gate
   let arkInitGen = 0; // guards against a stale init() resolving after a wallet switch
 
   function stopArk() {
@@ -514,6 +520,7 @@ export function arkFeature(ctx) {
     ark = null;
     arkInited = null;
     arkConnectPromise = null;
+    arkInitPromise = null;
     // The renewal warning describes the coins of the wallet we're leaving.
     // Switching accounts used to carry it onto the next one — with the old
     // wallet's amount and deadline, over the new wallet's balance — and the
@@ -545,9 +552,11 @@ export function arkFeature(ctx) {
     // holds is on screen the moment it can be.
     const store = wallet._arkStore;
     if (store && !store.ready) {
+      bootPhase('ark-store');
       store.open().then(() => { ctx.forgetAmountAnim && ctx.forgetAmountAnim(); render(); initArk(); }).catch(() => {});
       return;
     }
+    if (safeBoot()) return; // safe mode: the coins show from the store; nothing dials out unasked
     if (arkAvailable() && arkWanted()) { lastAutoInit = Date.now(); connectArk().then(() => rescueOtherServers()).catch(() => {}); }
   }
 
@@ -594,7 +603,7 @@ export function arkFeature(ctx) {
     }
   }
   function maybeInitArk() {
-    if (ark || arkConnectPromise) return;
+    if (ark || arkConnectPromise || safeBoot()) return;
     if (Date.now() - lastAutoInit < 20000) return;
     // A fresh snapshot may be held under its server pubkey, so arkWanted()
     // cannot see it until the handshake identifies the server and adopts it.
@@ -663,6 +672,9 @@ export function arkFeature(ctx) {
       esploraUrl: cfg.esplora,
       network: getNetwork(),
       honorsExpired: !!cfg.honorsExpired,
+      // the server's last published info: the wallet opens on it when the
+      // server is gone, so coins can still be read and exited
+      infoHint: (cachedArkInfo(cfg.ark) || {}).info || null,
       // the wallet's own tx table as a second witness for confirmations —
       // its data source is user-configurable and often healthier than the
       // ark preset's esplora from this device
@@ -676,12 +688,15 @@ export function arkFeature(ctx) {
     // Open the server connection while Nostr restores, but do not replay the
     // mailbox before the snapshot's history and cursor have arrived.
     const restored = Promise.resolve(wallet.nostrRestoreReady || wallet.syncFromNostr?.()).catch(() => false);
+    bootPhase('ark-init');
     const inited = mgr.init().then(() => {
       if (gen !== arkInitGen) return;
+      bootPhase('ark-inited');
       arkInited = mgr; // readable now; `ark` (and the mailbox) wait for the snapshot
-      rememberArkInfo(cfg.ark, mgr.info, mgr._tipH);
+      if (!mgr.offline) rememberArkInfo(cfg.ark, mgr.info, mgr._tipH);
       render();
     });
+    arkInitPromise = inited;
     // The tip: expiries and exit costs are judged against it, and init alone
     // never asks for it (the first sync does, after the snapshot gate). Ask
     // now, off the connect path, and remember it for the next refresh.
@@ -693,6 +708,7 @@ export function arkFeature(ctx) {
     arkConnectPromise = Promise.all([inited, restored]).then(() => {
       if (gen !== arkInitGen) throw new Error('superseded'); // wallet switched mid-connect
       ark = mgr;
+      bootPhase('ark-adopt');
       // Sync may have arrived while init awaited the server handshake.
       adoptArkSnapshot(mgr, wallet.loadArkState(cfg.ark));
       // Boards that died before funding (a failed tx build, a closed tab)
@@ -733,12 +749,14 @@ export function arkFeature(ctx) {
       // sync() already reconciles on its first pass. Start the live stream
       // afterwards, at the caught-up cursor: running both together replayed
       // the backlog one message/render at a time alongside the batch read.
+      bootPhase('ark-sync');
       tick().finally(() => { if (ark === mgr) mgr.startMailboxStream(); });
       mergeBgWorkerState(mgr).catch(() => {}); // absorb what the SW did while we were closed
       // Receives arrive in real time over the mailbox stream; the poll is the
       // fallback and what drives in-flight boards/refreshes forward.
       scheduleLnTag(mgr); // receives that landed while this device was closed
       arkTimer = setInterval(() => { if (ark === mgr) tick(); }, getNetwork() === 'regtest' ? 5000 : 30000);
+      bootPhase('ark-ready');
       render();
       return mgr;
     }).catch((e) => {
@@ -1012,6 +1030,7 @@ export function arkFeature(ctx) {
       return;
     }
     if (!rec.mgr) return;
+    bootPhase('ark-merge');
     const merged = mergeArkStates(mgr.state, rec.mgr);
     // the worker's view of OUR vtxos is newer for anything it spent
     const workerState = new Map((rec.mgr.vtxos || []).map((v) => [v.id, v.state]));
@@ -1021,8 +1040,11 @@ export function arkFeature(ctx) {
     merged.nextKeyIndex = Math.max(merged.nextKeyIndex || 1, rec.mgr.nextKeyIndex || 1);
     mgr.state = merged;
     mgr._save();
+    bootPhase('ark-merged');
     await mgr.reconcile().catch(() => {});
+    bootPhase('ark-reconciled');
     await mgr.resumePending().catch(() => {});
+    bootPhase('ark-resumed');
   }
 
   // A leftover chain-6 pouch from before whole-balance background spending:
@@ -2938,7 +2960,17 @@ export function arkFeature(ctx) {
   async function doArkExit(ids = null) {
     ui.arkBusy = 'exit'; ui.arkError = ''; render();
     try {
-      const mgr = await connectArk();
+      // The manager's own init is enough for an exit — the server may be
+      // gone (that is what a unilateral exit is for), and the snapshot gate
+      // the full connect also waits on may never clear without the relays.
+      let mgr = arkView();
+      if (!mgr) {
+        connectArk().catch(() => {});
+        for (let i = 0; i < 50 && !arkInitPromise; i++) await new Promise((r) => setTimeout(r, 100));
+        try { await arkInitPromise; } catch {}
+        mgr = arkView();
+      }
+      if (!mgr) throw new Error(t('arkNotConnected'));
       const spendables = exitableCoins(mgr.state, mgr._tipH || 0).filter((v) => !ids || ids.includes(v.id));
       if (!spendables.length) throw new Error(freeCoins(mgr.state).length ? t('arkExitNoneExitable') : t('arkNotConnected'));
       // Fees are paid hop by hop from Savings as the exit unrolls — an exit
@@ -3399,10 +3431,32 @@ export function arkFeature(ctx) {
     return true;
   }
 
+  // Whatever the tier, a coin whose history has run very deep is renewed:
+  // the server stops cosigning spends of a coin at its depth cap, so this is
+  // what keeps such a coin spendable, and it waives the base fee for a
+  // refresh of deep coins alone — so they go in a round of their own, never
+  // mixed with coins that would make it pay. A wallet paying hourly from one
+  // change chain (a subscription) is the usual way to get here.
+  async function flattenDeepCoins(mgr, tip) {
+    const deep = mgr.deepCoins ? mgr.deepCoins() : [];
+    if (!deep.length) return false;
+    if ((mgr.state.actions || []).some((a) => !['done', 'failed'].includes(a.step))) return false;
+    const feeSat = mgr.refreshFee(deep, tip);
+    const totalSat = deep.reduce((n, v) => n + v.amountSat, 0);
+    if (totalSat - feeSat < 330 || feeSat * 10 > totalSat) return false; // dust, or a server charging full price: left alone
+    await mgr.refresh(deep.map((v) => v.id));
+    render();
+    return true;
+  }
+
   async function maybeAutoRefresh(mgr) {
     if (wallet.watchOnly || !mgr || !mgr.state) return;
     if (Date.now() - arkAutoRefreshAt < 30 * 60_000) return;
     const policy = custodyPolicy();
+    if (mgr.deepCoins && mgr.deepCoins().length) {
+      arkAutoRefreshAt = Date.now();
+      try { if (await flattenDeepCoins(mgr, await mgr.chain.tipHeight())) return; } catch {}
+    }
     // "coinos holds my coins": nothing renews on its own and nothing warns.
     // The server honors a coin past its timelock, and the holder chose this.
     if (!policy) { arkRenewWarn = null; return; }
@@ -4012,9 +4066,21 @@ export function arkFeature(ctx) {
     async arkBgNoteSpends(spends) {
       const mgr = await connectArk();
       for (const sp of spends) {
+        // The worker's own manager wrote this payment's row into the mirror,
+        // and the merge on connect brings it over: a second row here showed
+        // every closed-app payment twice (PullCap, 2026-10-23). Stamp the
+        // row that exists instead; lnFoldedIds hides a twin that still
+        // forms when the merge lands after this note.
+        const twin = (mgr.state.movements || []).find((m) => m.type === 'ln-send'
+          && ((sp.preimage && m.preimage === sp.preimage) || (sp.paymentHash && m.paymentHash === sp.paymentHash)));
+        if (twin) {
+          if (!/while closed/.test(twin.detail || '')) twin.detail = `while closed · fee ${sp.feeSat || 0} sat`;
+          continue;
+        }
         mgr._movement({
           type: 'ln-send', amountSat: sp.amountSat, status: 'complete',
           detail: `while closed · fee ${sp.feeSat || 0} sat`, invoice: sp.invoice || '', preimage: sp.preimage || '',
+          paymentHash: sp.paymentHash || undefined,
         });
       }
       mgr._save();