1 files changed, 42 insertions, 3 deletions
diff --git a/src/nwc-bg.js b/src/nwc-bg.js
index 2c73206..9e7a303 100644
--- a/src/nwc-bg.js
+++ b/src/nwc-bg.js
@@ -81,6 +81,38 @@ export async function readBgLog() {
 export async function clearBgLog() {
   return tx('readwrite', (s) => { s.delete(LOG_KEY); });
 }
+// A lease on the worker's wallet work, kept in this store. Two pushes seconds
+// apart ran side by side on iOS, each in its own worker (two "worker started"
+// lines), and nothing kept them apart: both finished one send, and the
+// second, over a stale copy, marked a paid send 'revoking'. The store is
+// the one thing both see, and a readwrite transaction is atomic across them.
+// A lease outlives a stopped worker only for its ttl.
+export async function takeLease(name, { ttl = 12_000, wait = 5_000 } = {}) {
+  const key = '__lease:' + name;
+  const me = Math.random().toString(36).slice(2);
+  const start = Date.now();
+  for (;;) {
+    let got = false;
+    try {
+      got = await tx('readwrite', async (s) => {
+        const cur = await get(s, key);
+        if (cur && cur.until > Date.now() && cur.owner !== me) return false;
+        s.put({ owner: me, until: Date.now() + ttl }, key);
+        return true;
+      });
+    } catch { got = true; } // no store, no lease: run
+    if (got) break;
+    if (Date.now() - start > wait) break; // a holder that overstays: go anyway
+    await new Promise((r) => setTimeout(r, 250));
+  }
+  const waited = Date.now() - start;
+  const release = () => tx('readwrite', async (s) => {
+    const cur = await get(s, key);
+    if (cur && cur.owner === me) s.delete(key);
+  }).catch(() => {});
+  return { waited, release };
+}
+
 // The service worker doesn't know wallet cache keys — it finds the right
 // record by the connection's service pubkey across all of them.
 export async function allBgs() {
@@ -101,8 +133,15 @@ export async function allBgs() {
 }
 
 // How many upcoming change/refund indices travel with the record: the worker
-// cannot derive keys, so its allocations must land inside this window.
-export const BG_KEY_LOOKAHEAD = 25;
+// cannot derive keys, so its allocations must land inside this window. Each
+// Lightning send burns a change and an HTLC index, so 25 keys lasted PullCap
+// about 19 hourly payments (2026-10-26, "key window exhausted" after a day
+// with the app closed). 250 keys are 16 KB in the record and cover weeks of
+// hourly payments, or years of monthly ones; the app tops the window up
+// every time it writes the mirror.
+export const BG_KEY_LOOKAHEAD = 250;
+// ...and the receive preimages a closed wallet can mint invoices with
+export const BG_RECV_LOOKAHEAD = 60;
 
 // { ark } endpoints, the manager state to mirror, and a keyFor(chain, index)
 // derive function (the caller owns the account node — it never enters this
@@ -121,7 +160,7 @@ export function buildBg({ ark, mgrState, keyFor, connections, offer, autowithdra
   idx.add(0); // the receive-address key: mailbox/refund defaults land on it
   for (const i of idx) keys[String(i)] = keyFor(3, i);
   const keys5 = {};
-  for (let i = 0; i < 15; i++) {
+  for (let i = 0; i < BG_RECV_LOOKAHEAD; i++) {
     const n = (mgrState.nextLnRecvIndex || 0) + i;
     keys5[String(n)] = keyFor(5, n);
   }