1 files changed, 29 insertions, 1 deletions

diff --git a/src/features/ark.js b/src/features/ark.js
index 94dfc09..5a8dc61 100644
--- a/src/features/ark.js
+++ b/src/features/ark.js
@@ -24,6 +24,11 @@ function freeCoins(st) {
 function exitableCoins(st, tip) {
   return freeCoins(st).filter((v) => !(tip && v.expiryHeight && v.expiryHeight <= tip));
 }
+// The crash-loop guard's phase notes (build.js BOOT_GUARD, app.js bootPhase):
+// a boot iOS killed shows the last one it reached, and three in a row open
+// the app in safe mode, where nothing connects on its own.
+const bootPhase = (p) => { try { localStorage.setItem('coinos-boot-phase', p); } catch {} };
+const safeBoot = () => !!(typeof window !== 'undefined' && window.__safeBoot);
 import { loadBg, saveBg, buildBg, disarmSiblingRecords } from '../nwc-bg.js';
 import { boardFee, p2trAddress } from '../ark/board.js';
 import { maybeBolt11, maybeLnInvoice, lnSendFee, lnShortfall } from '../ark/lightning.js';
@@ -547,9 +552,11 @@ export function arkFeature(ctx) {
     // holds is on screen the moment it can be.
     const store = wallet._arkStore;
     if (store && !store.ready) {
+      bootPhase('ark-store');
       store.open().then(() => { ctx.forgetAmountAnim && ctx.forgetAmountAnim(); render(); initArk(); }).catch(() => {});
       return;
     }
+    if (safeBoot()) return; // safe mode: the coins show from the store; nothing dials out unasked
     if (arkAvailable() && arkWanted()) { lastAutoInit = Date.now(); connectArk().then(() => rescueOtherServers()).catch(() => {}); }
   }
 
@@ -596,7 +603,7 @@ export function arkFeature(ctx) {
     }
   }
   function maybeInitArk() {
-    if (ark || arkConnectPromise) return;
+    if (ark || arkConnectPromise || safeBoot()) return;
     if (Date.now() - lastAutoInit < 20000) return;
     // A fresh snapshot may be held under its server pubkey, so arkWanted()
     // cannot see it until the handshake identifies the server and adopts it.
@@ -681,8 +688,10 @@ export function arkFeature(ctx) {
     // Open the server connection while Nostr restores, but do not replay the
     // mailbox before the snapshot's history and cursor have arrived.
     const restored = Promise.resolve(wallet.nostrRestoreReady || wallet.syncFromNostr?.()).catch(() => false);
+    bootPhase('ark-init');
     const inited = mgr.init().then(() => {
       if (gen !== arkInitGen) return;
+      bootPhase('ark-inited');
       arkInited = mgr; // readable now; `ark` (and the mailbox) wait for the snapshot
       if (!mgr.offline) rememberArkInfo(cfg.ark, mgr.info, mgr._tipH);
       render();
@@ -699,6 +708,7 @@ export function arkFeature(ctx) {
     arkConnectPromise = Promise.all([inited, restored]).then(() => {
       if (gen !== arkInitGen) throw new Error('superseded'); // wallet switched mid-connect
       ark = mgr;
+      bootPhase('ark-adopt');
       // Sync may have arrived while init awaited the server handshake.
       adoptArkSnapshot(mgr, wallet.loadArkState(cfg.ark));
       // Boards that died before funding (a failed tx build, a closed tab)
@@ -739,12 +749,14 @@ export function arkFeature(ctx) {
       // sync() already reconciles on its first pass. Start the live stream
       // afterwards, at the caught-up cursor: running both together replayed
       // the backlog one message/render at a time alongside the batch read.
+      bootPhase('ark-sync');
       tick().finally(() => { if (ark === mgr) mgr.startMailboxStream(); });
       mergeBgWorkerState(mgr).catch(() => {}); // absorb what the SW did while we were closed
       // Receives arrive in real time over the mailbox stream; the poll is the
       // fallback and what drives in-flight boards/refreshes forward.
       scheduleLnTag(mgr); // receives that landed while this device was closed
       arkTimer = setInterval(() => { if (ark === mgr) tick(); }, getNetwork() === 'regtest' ? 5000 : 30000);
+      bootPhase('ark-ready');
       render();
       return mgr;
     }).catch((e) => {
@@ -1018,6 +1030,7 @@ export function arkFeature(ctx) {
       return;
     }
     if (!rec.mgr) return;
+    bootPhase('ark-merge');
     const merged = mergeArkStates(mgr.state, rec.mgr);
     // the worker's view of OUR vtxos is newer for anything it spent
     const workerState = new Map((rec.mgr.vtxos || []).map((v) => [v.id, v.state]));
@@ -1027,8 +1040,11 @@ export function arkFeature(ctx) {
     merged.nextKeyIndex = Math.max(merged.nextKeyIndex || 1, rec.mgr.nextKeyIndex || 1);
     mgr.state = merged;
     mgr._save();
+    bootPhase('ark-merged');
     await mgr.reconcile().catch(() => {});
+    bootPhase('ark-reconciled');
     await mgr.resumePending().catch(() => {});
+    bootPhase('ark-resumed');
   }
 
   // A leftover chain-6 pouch from before whole-balance background spending:
@@ -4028,9 +4044,21 @@ export function arkFeature(ctx) {
     async arkBgNoteSpends(spends) {
       const mgr = await connectArk();
       for (const sp of spends) {
+        // The worker's own manager wrote this payment's row into the mirror,
+        // and the merge on connect brings it over: a second row here showed
+        // every closed-app payment twice (PullCap, 2026-10-23). Stamp the
+        // row that exists instead; lnFoldedIds hides a twin that still
+        // forms when the merge lands after this note.
+        const twin = (mgr.state.movements || []).find((m) => m.type === 'ln-send'
+          && ((sp.preimage && m.preimage === sp.preimage) || (sp.paymentHash && m.paymentHash === sp.paymentHash)));
+        if (twin) {
+          if (!/while closed/.test(twin.detail || '')) twin.detail = `while closed · fee ${sp.feeSat || 0} sat`;
+          continue;
+        }
         mgr._movement({
           type: 'ln-send', amountSat: sp.amountSat, status: 'complete',
           detail: `while closed · fee ${sp.feeSat || 0} sat`, invoice: sp.invoice || '', preimage: sp.preimage || '',
+          paymentHash: sp.paymentHash || undefined,
         });
       }
       mgr._save();