5 files changed, 297 insertions, 26 deletions
diff --git a/tools/ark/cooperative-exit-ui-test.js b/tools/ark/cooperative-exit-ui-test.js
index 506bca6..03e65d5 100644
--- a/tools/ark/cooperative-exit-ui-test.js
+++ b/tools/ark/cooperative-exit-ui-test.js
@@ -66,10 +66,9 @@ try {
     });
     await page.waitForSelector('.coin-table');
   };
-  const coopButton = () => page.evaluate(() => [...document.querySelectorAll('.card')]
-    .find((c) => c.querySelector('h4')?.textContent === 'Co-operative exit').querySelector('button').click());
+  const coopButton = () => page.evaluate(() => document.querySelector('.ark-coop-go').click());
   const send = () => page.evaluate(() => [...document.querySelectorAll('.card')]
-    .find((c) => c.querySelector('h3')?.textContent === 'Co-operative exit').querySelector('.btn-primary').click());
+    .find((c) => c.querySelector('h3')?.textContent === 'Withdraw').querySelector('.btn-primary').click());
   const edit = (selector, value) => page.$eval(selector, (e, value) => { e.value = value; e.dispatchEvent(new Event('input', { bubbles: true })); }, value);
   // The balance card's gear is the way in: Spending's settings lead with
   // its coins and carry what a unilateral exit costs; the home screen no
@@ -114,13 +113,16 @@ try {
   await page.evaluate(() => { window.forceArkReady = false; coopApp.wallet.saveFeatureState('arkDepth', null); coopApp.ui.screen = 'wallet'; coopApp.render(); });
 
   await manage();
-  assert.deepEqual(await page.$$eval('.card h4', (es) => es.map((e) => e.textContent)), ['Renewal', 'Co-operative exit', 'Unilateral exit']);
+  // the three actions sit right under the table, named for the ticked total; no explainer cards
+  assert.deepEqual(await page.$$eval('.ark-coin-actions button', (es) => es.map((e) => e.textContent)), ['Renew now', 'Withdraw 20,000 sats', 'Exit 20,000 sats']);
+  assert.deepEqual(await page.$$eval('.card h4', (es) => es.map((e) => e.textContent)), []);
   await coopButton();
   await page.waitForSelector('input.mono-input');
   const savings = await page.evaluate(() => coopApp.wallet.freshReceive().address);
   assert.equal(await page.$eval('input.mono-input', (e) => e.value), savings);
   assert.equal(await page.$eval('input[type="number"]', (e) => e.value), '20000');
   assert.equal(await page.$eval('.card .btn-primary', (e) => e.textContent), 'Send');
+  assert.match(await page.evaluate(() => document.body.innerText), /one transaction into Savings, ready after a single confirmation/, 'the withdraw explainer is on the form');
   assert.deepEqual(await page.evaluate(() => coopCalls), [], 'opening the form never starts an exit');
   await page.evaluate(() => [...document.querySelectorAll('.card button')].find((b) => b.textContent.includes('Back')).click());
   await page.waitForSelector('.coin-table');
@@ -165,7 +167,7 @@ try {
   // ticking a subset on Manage: exactly those coins go, no split, the amount is theirs and not a field
   await manage();
   await page.evaluate(() => { coopApp.ui.arkCoinsSel = new Set(['coin-b']); coopApp.render(); });
-  assert.match(await page.evaluate(() => [...document.querySelectorAll('.card')].find((c) => c.querySelector('h4')?.textContent === 'Co-operative exit').innerText), /Only the coin ticked above will move[\s\S]*Move 8,000 sats to Savings/);
+  assert.deepEqual(await page.$$eval('.ark-coin-actions button', (es) => es.map((e) => e.textContent)), ['Renew 1 selected for free', 'Withdraw 8,000 sats', 'Exit 8,000 sats'], 'the buttons name the ticked total');
   await coopButton();
   await page.waitForSelector('.ark-coop-chosen');
   assert.match(await page.$eval('.ark-coop-chosen', (e) => e.textContent), /1 selected coin · 8,000 sats/);
@@ -180,7 +182,7 @@ try {
   assert.equal(await page.evaluate(() => coopApp.ui.arkOffboardSend), null);
   await manage();
   await page.evaluate(() => { coopManager.state.vtxos.forEach((v) => v.state = 'pending'); coopManager.state.actions = [{ type: 'refresh', step: 'submitted', inputIds: ['coin-a', 'coin-b'], inAmountSat: 20000 }]; coopApp.render(); });
-  assert(await page.evaluate(() => [...document.querySelectorAll('.card')].find((c) => c.querySelector('h4')?.textContent === 'Co-operative exit').querySelector('button').disabled));
+  assert(await page.evaluate(() => document.querySelector('.ark-coop-go').disabled));
   await page.evaluate(() => {
     const { ui, render } = coopApp;
     ui.arkCoinsPage = null; ui.tab = 'send';
diff --git a/tools/ark/custody-foreign-test.js b/tools/ark/custody-foreign-test.js
new file mode 100644
index 0000000..148622d
--- /dev/null
+++ b/tools/ark/custody-foreign-test.js
@@ -0,0 +1,102 @@
+// On a server that does not honor a coin past its timelock (Second, a custom
+// captaind) "coinos holds my coins" is not a tier: whatever is stored, the
+// tier in force is "self" (or "exit" when chosen), the card offers only those
+// two, and the renewal pass registers backstops and renews what is due.
+// Real app with a local Ark manager stub; nothing is sent anywhere.
+// Run: bun tools/ark/custody-foreign-test.js
+import assert from 'node:assert/strict';
+import puppeteer from '../puppeteer.js';
+import { generateMnemonic } from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english';
+
+const bundle = await Bun.build({ entrypoints: ['src/app.js'], target: 'browser', minify: true,
+  plugins: [{ name: 'custody-foreign-test', setup(build) {
+    build.onLoad({ filter: /src\/app\.js$/ }, async ({ path }) => ({ loader: 'js', contents: await Bun.file(path).text() + `
+window.coopApp = { ui, wallet, ctx, render, enterWallet, openWalletSettings, get ready() { return !_bootDeciding; },
+  setSpending: (on = true) => { const a = activeAccount(); if (a) { if (on) a.kind = 'spending'; else delete a.kind; } } };
+` }));
+    build.onLoad({ filter: /src\/features\/ark\.js$/ }, async ({ path }) => ({ loader: 'js', contents:
+      (await Bun.file(path).text()).replace("  return {\n    id: 'ark',", `
+  window.coopFeature = { setManager: (mgr) => { ark = mgr; }, getCustody, applyCustody, maybeAutoRefresh, autoRefreshCalls: [] };
+  return {\n    id: 'ark',`) }));
+    build.onLoad({ filter: /src\/video-compress\.js$/ }, () => ({ loader: 'js', contents: 'export async function compressVideo(f) { return f; }' }));
+  } }] });
+assert(bundle.success, bundle.logs.join('\n'));
+const html = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><style>${await Bun.file('src/style.css').text()}</style><div id="app"></div><script type="module">${await bundle.outputs[0].text()}</script>`;
+const server = Bun.serve({ port: 0, fetch: (req) => new URL(req.url).pathname === '/'
+  ? new Response(html, { headers: { 'Content-Type': 'text/html' } }) : new Response(null, { status: 404 }) });
+const browser = await puppeteer.launch({ executablePath: '/usr/bin/google-chrome', headless: true, args: ['--no-sandbox'] });
+try {
+  const page = await browser.newPage(), errors = [];
+  page.on('pageerror', (e) => errors.push(e.message));
+  await page.setViewport({ width: 390, height: 844 });
+  const cdp = await page.createCDPSession();
+  await cdp.send('Network.enable');
+  await cdp.send('Network.setBlockedURLs', { urls: ['wss://*', 'ws://*'] });
+  await page.setRequestInterception(true);
+  page.on('request', (r) => r.url().startsWith(server.url.origin) || r.url().startsWith('data:') ? r.continue() : r.abort());
+  await page.evaluateOnNewDocument(() => {
+    localStorage.setItem('btc-wallet-network', 'regtest');
+    // a custom server: no honorsExpired on its record, like Second's preset
+    localStorage.setItem('btc-wallet-ark-provider:regtest', 'custom');
+    localStorage.setItem('btc-wallet-ark-custom:regtest', JSON.stringify({ ark: 'http://localhost:3535', esplora: 'http://localhost:30002' }));
+  });
+  await page.goto(server.url.href, { waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(() => window.coopApp?.ready);
+  await page.evaluate(async (mn) => {
+    await coopApp.enterWallet(mn, '', { fresh: true, generated: true });
+    coopApp.ui.onb = null; localStorage.removeItem('btc-wallet-onb-step');
+    coopApp.wallet.scan = async () => {};
+    const table = [{ thresholdBlocks: 0, ppm: 0 }, { thresholdBlocks: 288, ppm: 2000 }, { thresholdBlocks: 1008, ppm: 4000 }, { thresholdBlocks: 2016, ppm: 5000 }];
+    window.coopManager = {
+      honorsExpired: false,
+      state: { vtxos: [
+        { id: 'coin-0', amountSat: 20000, state: 'spendable', expiryHeight: 973921, depth: 2 }, // weeks left
+        { id: 'coin-1', amountSat: 5000, state: 'spendable', expiryHeight: 969760, depth: 1 }, // 9 blocks from its timelock
+      ], actions: [], movements: [], scheduled: [] },
+      info: { network: 'regtest', vtxoExpiryDelta: 4032, roundIntervalSecs: 3600, refreshFees: { baseFeeSat: 0, ppmExpiryTable: table } }, _tipH: 969751,
+      chain: { tipHeight: async () => 969751 },
+      vtxos() { return this.state.vtxos; },
+      _decoded(v) { return { genesis: new Array(v.depth || 1).fill({}), policy: { type: 'pubkey' } }; },
+      balance() { return { spendableSat: 25000, pendingSat: 0, boardingSat: 0, expiredSat: 0 }; },
+      refreshFee(inputs, tip) {
+        let u = 0;
+        for (const v of inputs) u += v.amountSat * (table.filter((e) => e.thresholdBlocks <= v.expiryHeight - tip).pop()?.ppm ?? 0);
+        return Math.ceil(u / 1e6);
+      },
+      async ensureScheduledRefreshes(margin, max, grid) { coopFeature.autoRefreshCalls.push(['ensure', margin, max, grid]); return 0; },
+      async refresh(ids) { coopFeature.autoRefreshCalls.push(['refresh', ids]); return 'refresh-1'; },
+      unseenReceives() { return []; }, ackReceives() {},
+      address() { return 'test-ark-address'; },
+    };
+    coopFeature.setManager(coopManager);
+    coopApp.setSpending(true);
+    coopApp.openWalletSettings('spending');
+  }, generateMnemonic(wordlist));
+  await page.waitForSelector('.ark-custody');
+
+  // nothing stored: the tier in force is "self", and the card offers no custodial option
+  assert.equal(await page.evaluate(() => coopFeature.getCustody()), 'self');
+  assert.equal(await page.evaluate(() => coopApp.wallet.loadFeatureState('arkCustody', null)), null, 'nothing was written to the record');
+  const opts = await page.$$eval('#ark-custody-select option', (os) => os.map((o) => [o.value, o.selected]));
+  assert.deepEqual(opts, [['self', true], ['exit', false]]);
+  console.log('✓ a server that does not honor expired coins has no "coinos holds my coins" tier; "self" is in force');
+
+  // the stored default from a coinos wallet does not switch renewals off here
+  await page.evaluate(() => coopApp.wallet.saveFeatureState('arkCustody', 'custodial'));
+  assert.equal(await page.evaluate(() => coopFeature.getCustody()), 'self');
+  console.log('✓ a stored "custodial" choice reads as "self" on such a server');
+
+  // the renewal pass runs: backstop orders are registered and the coin at its timelock renews now
+  const calls = await page.evaluate(async () => { coopFeature.autoRefreshCalls.length = 0; await coopFeature.maybeAutoRefresh(coopManager); return coopFeature.autoRefreshCalls; });
+  assert.deepEqual(calls[0], ['ensure', 6, 8, 1], 'backstop orders registered (regtest margin 6)');
+  assert.deepEqual(calls[1], ['refresh', ['coin-1']], 'the coin close to its timelock is renewed now');
+  console.log('✓ automatic renewal runs on such a server with nothing opted into');
+
+  // the exit tier can still be chosen, and is kept
+  await page.evaluate(() => coopFeature.applyCustody('exit'));
+  assert.equal(await page.evaluate(() => coopFeature.getCustody()), 'exit');
+  assert.equal(await page.evaluate(() => coopApp.wallet.loadFeatureState('arkCustody', null)), 'exit');
+  console.log('✓ "exit" can be chosen there and is saved');
+  assert.deepEqual(errors, [], 'no page errors');
+} finally { await browser.close(); server.stop(true); }
diff --git a/tools/ark/custody-test.js b/tools/ark/custody-test.js
index f8106b7..214ab45 100644
--- a/tools/ark/custody-test.js
+++ b/tools/ark/custody-test.js
@@ -93,4 +93,38 @@ const coin = (id, amountSat, expiryHeight, extra = {}) => ({ id, amountSat, expi
   await assert.rejects(validateVtxo(v, { serverPubkey: serverPub, chain, acceptExpired: true }), (e) => e instanceof VtxoValidationError && /not confirmed/.test(e.message), 'past the expiry check, on to the anchor');
   console.log('✓ validateVtxo: acceptExpired lets a coin past its timelock through the expiry check');
 }
+
+// deep coins: the server's depth cap and its base-fee waiver, mirrored
+{
+  const m = mk(true);
+  m.info.refreshFees.deepWaiverDepth = 60;
+  m.info.maxVtxoExitDepth = 100;
+  m.exitDepth = (v) => v.depth || 0;
+  m._tipMemo = async () => 1000;
+  const shallow = coin('s', 5000, 2000, { depth: 7 }), deep = coin('d', 4000, 2000, { depth: 60 });
+  const capped = coin('x', 3000, 2000, { depth: 100 }), near = coin('n', 2500, 2000, { depth: 92 });
+  const expiredDeep = coin('e', 6000, 900, { depth: 70 });
+  m.state.vtxos = [shallow, deep, capped, near, expiredDeep];
+  assert.equal(m.refreshFee([deep], 1000), 0, 'a refresh of deep coins alone pays no base fee');
+  assert.equal(m.refreshFee([deep, expiredDeep], 1000), 0);
+  assert.equal(m.refreshFee([deep, shallow], 1000), 300, '…one shallow coin in the set and it pays');
+  assert.equal(m.refreshFee([shallow], 1000), 300);
+  assert.deepEqual(m.deepCoins().map((v) => v.id).sort(), ['d', 'e', 'n', 'x'], 'deep = at the waiver depth or within 8 hops of the cap, expired or not');
+  assert.deepEqual(m._selectInputs(2900).map((v) => v.id), ['d'], 'a coin at the cap is never an input (the cosign would be refused)');
+  m.state.vtxos = [capped];
+  assert.throws(() => m._selectInputs(1000), /waiting to be renewed/, 'and the shortfall says why');
+  m.state.vtxos = [shallow, deep, capped, near, expiredDeep];
+  // the worker's orders: one per deep coin still inside its timelock, two blocks out
+  const orders = [];
+  m.scheduleRefresh = async (ids, h) => { orders.push([ids.join(), h]); (m.state.scheduled ||= []).push({ inputIds: ids, unlockHash: 'u' + ids }); };
+  assert.equal(await m.ensureDeepRefreshes(3), 3);
+  assert.deepEqual(orders, [['x', 1002], ['n', 1002], ['d', 1002]], 'deepest first, at tip + 2; the expired one waits for the app');
+  assert.equal(await m.ensureDeepRefreshes(3), 0, 'covered coins are not ordered twice');
+  // no waiver and no cap advertised: nothing is deep
+  const plain = mk(true); plain.exitDepth = () => 999; plain.state.vtxos = [coin('p', 5000, 2000)];
+  assert.deepEqual(plain.deepCoins(), []);
+  assert.equal(plain.refreshFee(plain.state.vtxos, 1000), 300, 'no waiver advertised: the base fee stands however deep');
+  console.log('✓ deep coins: no base fee for a refresh of deep coins alone, a capped coin is never spent, the worker orders them flattened');
+}
+
 console.log('\n✅ custody tiers behave');
diff --git a/tools/ark/custody-ui-test.js b/tools/ark/custody-ui-test.js
index 7ebc2ea..9c238f5 100644
--- a/tools/ark/custody-ui-test.js
+++ b/tools/ark/custody-ui-test.js
@@ -77,39 +77,43 @@ try {
 
   let tx = await text();
   assert.match(tx, /Custody/);
-  assert.match(tx, /Allow coins to expire[\s\S]*no fees/);
-  assert.match(tx, /keeps its own exit until it expires/);
-  assert.doesNotMatch(tx, /timelock|Spending coin carries|old Coinos/, 'no jargon on the card');
-  assert.match(tx, /Minimize renewal cost[\s\S]*300 sats per renewal/);
-  assert.match(tx, /Minimize exit cost[\s\S]*300 sats near expiry, 0\.2% \+ 300 sats when early/);
-  assert.match(tx, /4 hops deep/);
-  const checked = await page.$$eval('.ark-custody input[type=radio]', (els) => els.filter((e) => e.checked).map((e) => e.value));
-  assert.deepEqual(checked, ['custodial'], 'coinos holds the coins by default');
+  const opts = await page.$$eval('.ark-custody option', (es) => es.map((e) => e.value + '=' + e.textContent));
+  assert.deepEqual(opts, ['custodial=Allow coins to expire', 'self=Minimize renewal cost', 'exit=Minimize exit cost']);
+  assert.equal(await page.$eval('.ark-custody-cost', (e) => e.textContent), 'no fees');
+  assert.equal(await page.$eval('#ark-custody-select', (e) => e.value), 'custodial', 'coins expire by default');
   assert.equal(await page.evaluate(() => coopFeature.getCustody()), 'custodial');
+  assert.match(await page.$eval('.ark-custody-desc', (e) => e.textContent), /keeps its own exit until it expires/);
+  assert.doesNotMatch(tx, /Coins renew in the last hours|Every transfer adds a hop/, 'only the chosen strategy is described');
+  assert.doesNotMatch(tx, /timelock|Spending coin carries|old Coinos/, 'no jargon on the card');
+  const order = await page.$$eval('.card h4, .card h3', (es) => es.map((e) => e.textContent).filter((x) => /Spending coins|Custody strategy|Renewal/.test(x)));
+  assert.deepEqual(order, ['Spending coins', 'Custody strategy'], 'coins first, then the strategy; no explainer cards');
   assert.match(tx, /held by Coinos/, 'the coin past its timelock is held, not "expired"');
   assert.doesNotMatch(tx, /5,000 sats\s+expired/, 'the row never says "expired"');
-  assert.match(tx, /With “Allow coins to expire”, nothing renews on its own/);
+  assert.doesNotMatch(tx, /nothing renews on its own/, 'the renewal explainer is not on the page…');
+  const renewSheet = async () => { await page.click('.ark-renew-ask'); await sleep(200); const t = await text(); await page.evaluate(() => [...document.querySelectorAll('.ark-renew-confirm button')].find((b) => b.textContent === 'Cancel').click()); await sleep(200); return t; };
+  assert.match(await renewSheet(), /With “Allow coins to expire”, nothing renews on its own[\s\S]*more than 15 days left/, '…it is on the Renew confirmation, with the fee schedule');
   if (process.env.SHOT) await page.screenshot({ path: process.env.SHOT, fullPage: true });
-  console.log('✓ the custody card: three tiers with their prices, coinos holding by default, a past-timelock coin shown as held');
+  console.log('✓ the custody card: a drop-down of three strategies with their prices, coins expire by default, one description, a past-timelock coin shown as held');
 
   // the unilateral exit only counts the coin still inside its timelock
-  assert.match(tx, /Exit now/);
-  const exitBtn = await page.$$eval('button', (bs) => bs.filter((b) => b.textContent === 'Exit now').map((b) => b.disabled));
-  assert.deepEqual(exitBtn, [false]);
-  await page.evaluate(() => [...document.querySelectorAll('button')].find((b) => b.textContent === 'Exit now').click()); await sleep(200);
+  assert.equal(await page.$eval('.ark-exit-ask', (b) => b.textContent), 'Exit 20,800 sats', 'the exit button names the ticked coins still inside their timelock');
+  assert.equal(await page.$eval('.ark-exit-ask', (b) => b.disabled), false);
+  await page.click('.ark-exit-ask'); await sleep(200);
   tx = await text();
   assert.match(tx, /Coins\s*2/); assert.match(tx, /Amount\s*20,800 sats/);
+  assert.match(tx, /If the server vanished today/, 'the exit explainer is on the confirmation');
   await page.evaluate(() => [...document.querySelectorAll('button')].find((b) => b.textContent === 'Cancel').click()); await sleep(200);
   console.log('✓ a unilateral exit counts only the coin still inside its timelock');
 
   // opt into keeping the exit: persisted, the page reprices, renewal starts covering
-  await page.click('.ark-custody-opt[data-tier=self] input'); await sleep(400);
+  await page.select('#ark-custody-select', 'self'); await sleep(400);
   assert.equal(await page.evaluate(() => coopFeature.getCustody()), 'self');
   assert.equal(await page.evaluate(() => coopApp.wallet.loadFeatureState('arkCustody')), 'self', 'saved with the wallet');
   tx = await text();
   assert.match(tx, /Custody choice saved/);
-  assert.doesNotMatch(tx, /nothing renews on its own/);
-  assert.match(tx, /renews coins automatically once they are close to expiring/);
+  assert.match(await renewSheet(), /renews coins automatically once they are close to expiring/);
+  assert.match(await page.$eval('.ark-custody-desc', (e) => e.textContent), /Coins renew in the last hours/);
+  assert.equal(await page.$eval('.ark-custody-cost', (e) => e.textContent), '300 sats per renewal');
   const calls = await page.evaluate(() => coopFeature.autoRefreshCalls);
   assert.deepEqual(calls[0], ['ensure', 6, 8, 1], 'backstop orders registered at once (regtest margin 6)');
   assert.deepEqual(calls[1], ['refresh', ['coin-1', 'coin-2']], 'the coin past its timelock is renewed now with the small change; the deep healthy one is left alone');
@@ -117,14 +121,15 @@ try {
 
   // the exit tier also flattens the deep coin — but not the deep 800-sat one on its own merits
   await page.evaluate(() => { coopFeature.autoRefreshCalls.length = 0; });
-  await page.click('.ark-custody-opt[data-tier=exit] input'); await sleep(400);
+  await page.select('#ark-custody-select', 'exit'); await sleep(400);
   assert.equal(await page.evaluate(() => coopFeature.getCustody()), 'exit');
+  assert.equal(await page.$eval('.ark-custody-cost', (e) => e.textContent), '300 sats near expiry, 0.2% + 300 sats when early');
   const calls2 = await page.evaluate(() => coopFeature.autoRefreshCalls);
   assert.deepEqual(calls2[1], ['refresh', ['coin-1', 'coin-0', 'coin-2']], 'expired + deep (worth it) + small change ride one round');
   console.log('✓ "Keep my exit cheap" renews the deep coin too, when the fee is under a tenth of it');
-  await page.click('.ark-custody-opt[data-tier=custodial] input'); await sleep(300);
+  await page.select('#ark-custody-select', 'custodial'); await sleep(300);
   assert.equal(await page.evaluate(() => coopFeature.getCustody()), 'custodial');
-  assert.match(await text(), /nothing renews on its own/);
+  assert.match(await renewSheet(), /nothing renews on its own/);
   console.log('✓ the other tiers switch the same way, and back');
   assert.deepEqual(errors, [], 'no page errors');
   console.log('\n✅ custody is a choice, made on the Spending page');
diff --git a/tools/ark/offboard-split-test.js b/tools/ark/offboard-split-test.js
new file mode 100644
index 0000000..561ee2b
--- /dev/null
+++ b/tools/ark/offboard-split-test.js
@@ -0,0 +1,128 @@
+// A partial on-chain send from Spending moves whole coins: the amount is
+// covered by coins that already add up to it, else split off via a self-send
+// that lands as one coin per input — all of them go, not one of the exact
+// size (Jarryd, 2026-10-23: three splits, no send). Local manager stub.
+// Run: bun tools/ark/offboard-split-test.js
+import assert from 'node:assert/strict';
+import puppeteer from '../puppeteer.js';
+import { generateMnemonic } from '@scure/bip39';
+import { wordlist } from '@scure/bip39/wordlists/english';
+
+const bundle = await Bun.build({ entrypoints: ['src/app.js'], target: 'browser', minify: true,
+  plugins: [{ name: 'offboard-split-test', setup(build) {
+    build.onLoad({ filter: /src\/app\.js$/ }, async ({ path }) => ({ loader: 'js', contents: await Bun.file(path).text() + `
+window.coopApp = { ui, wallet, ctx, render, enterWallet, get ready() { return !_bootDeciding; } };
+` }));
+    build.onLoad({ filter: /src\/features\/ark\.js$/ }, async ({ path }) => ({ loader: 'js', contents:
+      (await Bun.file(path).text()).replace("  return {\n    id: 'ark',", `
+  window.coopFeature = { setManager: (mgr) => { ark = mgr; }, offboard: doArkOffboard, exactCoins };
+  return {\n    id: 'ark',`) }));
+    build.onLoad({ filter: /src\/video-compress\.js$/ }, () => ({ loader: 'js', contents: 'export async function compressVideo(f) { return f; }' }));
+  } }] });
+assert(bundle.success, bundle.logs.join('\n'));
+const html = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><style>${await Bun.file('src/style.css').text()}</style><div id="app"></div><script type="module">${await bundle.outputs[0].text()}</script>`;
+const server = Bun.serve({ port: 0, fetch: (req) => new URL(req.url).pathname === '/'
+  ? new Response(html, { headers: { 'Content-Type': 'text/html' } }) : new Response(null, { status: 404 }) });
+const browser = await puppeteer.launch({ executablePath: '/usr/bin/google-chrome', headless: true, args: ['--no-sandbox'] });
+try {
+  const page = await browser.newPage(), errors = [];
+  page.on('pageerror', (e) => errors.push(e.message));
+  await page.setViewport({ width: 390, height: 844 });
+  const cdp = await page.createCDPSession();
+  await cdp.send('Network.enable');
+  await cdp.send('Network.setBlockedURLs', { urls: ['wss://*', 'ws://*'] });
+  await page.setRequestInterception(true);
+  page.on('request', (r) => r.url().startsWith(server.url.origin) || r.url().startsWith('data:') ? r.continue() : r.abort());
+  await page.evaluateOnNewDocument(() => {
+    localStorage.setItem('btc-wallet-network', 'regtest');
+    localStorage.setItem('btc-wallet-ark-provider:regtest', 'off');
+  });
+  await page.goto(server.url.href, { waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(() => window.coopApp?.ready);
+  await page.evaluate(async (mn) => {
+    await coopApp.enterWallet(mn, '', { fresh: true, generated: true });
+    coopApp.ui.onb = null; localStorage.removeItem('btc-wallet-onb-step');
+    coopApp.wallet.scan = async () => {};
+    window.coopCalls = [];
+    window.coopManager = {
+      state: { vtxos: [], actions: [], movements: [], nextKeyIndex: 5 },
+      async offboardQuote() { return { chainSat: 736, serviceSat: 204, totalSat: 940, minSat: 1270 }; },
+      info: { network: 'regtest' }, _tipH: 100,
+      vtxos() { return this.state.vtxos; },
+      refreshFee() { return 0; }, unseenReceives() { return []; }, ackReceives() {},
+      address() { return 'test-ark-address'; },
+      // the real thing: largest inputs first until covered, one destination
+      // coin per input (the last carries the remainder), change on a new key;
+      // the destination coins land on the receive key at the next sync
+      async send(address, amount) {
+        coopCalls.push({ type: 'split', address, amount });
+        const free = this.state.vtxos.filter((v) => v.state === 'spendable').sort((a, b) => b.amountSat - a.amountSat);
+        const inputs = []; let sum = 0;
+        for (const v of free) { inputs.push(v); sum += v.amountSat; if (sum >= amount) break; }
+        let remaining = amount; const landing = [];
+        for (const v of inputs) {
+          const dest = Math.min(remaining, v.amountSat); remaining -= dest;
+          landing.push({ id: `dest-${v.id}`, amountSat: dest, state: 'spendable', keyIndex: 0 });
+          if (v.amountSat > dest) this.state.vtxos.push({ id: `change-${v.id}`, amountSat: v.amountSat - dest, state: 'spendable', keyIndex: this.state.nextKeyIndex++ });
+          v.state = 'spent';
+        }
+        this.pendingLanding = landing;
+        return 'send-1';
+      },
+      async sync() { if (this.pendingLanding) { this.state.vtxos.push(...this.pendingLanding); this.pendingLanding = null; } },
+      async startOffboard(spk, address, ids) {
+        coopCalls.push({ type: 'offboard', address, ids: ids || null });
+        return { txid: 'ab'.repeat(32), netSat: 1, feeSat: 1 };
+      },
+    };
+    coopFeature.setManager(coopManager);
+    coopApp.ui.screen = 'wallet'; coopApp.ui.tab = 'send'; coopApp.render();
+  }, generateMnemonic(wordlist));
+  const run = (coins, amount) => page.evaluate(async (coins, amount) => {
+    coopManager.state.vtxos = coins.map((c) => ({ state: 'spendable', keyIndex: 0, ...c }));
+    coopCalls.length = 0;
+    coopApp.ui.arkError = ''; coopApp.ui.arkOffboarded = null;
+    await coopFeature.offboard(amount, coopApp.wallet.derive(0, 1).address);
+    return { calls: coopCalls, err: coopApp.ui.arkError, done: !!coopApp.ui.arkOffboarded };
+  }, coins, amount);
+
+  // Jarryd's balance after one split: the halves add up, so nothing is split again
+  let r = await run([{ id: 'a', amountSat: 109958 }, { id: 'b', amountSat: 75042 }, { id: 'c', amountSat: 24958, keyIndex: 2 }], 185000);
+  assert.equal(r.err, '');
+  assert(r.done);
+  assert.deepEqual(r.calls.map((c) => c.type), ['offboard']);
+  assert.deepEqual([...r.calls[0].ids].sort(), ['a', 'b']);
+  console.log('✓ coins that already add up to the amount go as they are, no split');
+
+  // one coin of the exact size
+  r = await run([{ id: 'a', amountSat: 109958 }, { id: 'c', amountSat: 24958 }], 24958);
+  assert.deepEqual(r.calls, [{ type: 'offboard', address: r.calls[0].address, ids: ['c'] }]);
+  console.log('✓ a single coin of the exact size is the one that goes');
+
+  // Jarryd's first attempt: 185,000 out of 100,000 + 109,958 — nothing adds
+  // up, so a self-send splits it off and lands as two coins; both go
+  r = await run([{ id: 'a', amountSat: 100000 }, { id: 'b', amountSat: 109958 }], 185000);
+  assert.equal(r.err, '');
+  assert(r.done);
+  assert.deepEqual(r.calls.map((c) => c.type), ['split', 'offboard']);
+  assert.equal(r.calls[0].amount, 185000);
+  assert.deepEqual([...r.calls[1].ids].sort(), ['dest-a', 'dest-b']);
+  const left = await page.evaluate(() => coopManager.state.vtxos.filter((v) => v.state === 'spendable').map((v) => [v.id, v.amountSat, v.keyIndex]));
+  assert.deepEqual(left.filter(([id]) => id.startsWith('change')), [['change-a', 24958, 5]]);
+  console.log('✓ a split that lands as two coins sends both; the change stays behind');
+
+  // everything: no carving at all
+  r = await run([{ id: 'a', amountSat: 100000 }, { id: 'b', amountSat: 109958 }], 0);
+  assert.deepEqual(r.calls, [{ type: 'offboard', address: r.calls[0].address, ids: null }]);
+  console.log('✓ the whole balance goes without a split');
+
+  // the subset search: prefers few large coins, gives up on no fit
+  const sub = await page.evaluate(() => {
+    const coins = (a) => a.map((amountSat, i) => ({ id: 'c' + i, amountSat }));
+    const pick = (a, n) => { const r = coopFeature.exactCoins(coins(a), n); return r && r.map((v) => v.amountSat).sort((x, y) => y - x); };
+    return [pick([5000, 3000, 2000, 1000, 1000], 6000), pick([5000, 3000], 7000), pick([5000, 3000, 2000], 5000), pick([7000, 3000], 3000)];
+  });
+  assert.deepEqual(sub, [[5000, 1000], null, [5000], [3000]]);
+  console.log('✓ exactCoins finds a subset, the single coin, or nothing');
+  assert.deepEqual(errors, []);
+} finally { await browser.close(); server.stop(true); }