[ovitrif]

Closes #1806

Stacked on #1697
Twin: synonymdev/bitkit-ios#1217

This PR adds the Spark emergency exit on top of Spark (#1697): if the Spark operators stop working, Spending moves to Savings on-chain without them, which is what Spark's trust model rests on. It was split out of #1697 so that Spark can be reviewed and merged on its own; the code is the same as #1697's head before the split, merged with master.

Description

Screens and flow

• Lightning Connections › Spark shows Emergency exit under Transfer to Savings while Spark holds funds or has recoverable funds, and leads to the exit's progress while one runs or its result is still unseen.
• The flow is an explainer, a quote, fee funding, a confirm swipe and a progress screen:
  • The quote comes from the SDK's prepareRecoverFunds for every leaf at its fastest fee rate to a fresh Savings address: amount to exit, network fees, you receive about, fee funding needed and what stays on Spark. Continue is blocked when nothing can be exited or the fees exceed the value.
  • Fee funding: pay from Savings when it covers the funding and its fee, or fund a shown address from another wallet.
  • The swipe writes the exit record and the transfer before any payment.
  • Progress shows the steps, the timelock countdown, rejections, a top-up address when more fees are needed, and the result.

Driving the exit

• Drives the exit with a state machine that builds once the funding confirms, saves every build before broadcasting, broadcasts ready steps as packages or single transactions (on mainnet to Bitkit's Esplora https://bitkit.to/electrs through /txs/package, then mempool.space through /v1/txs/package and blockstream.info as fallbacks; on regtest to Spark's mempool), reads the chain on mainnet from https://bitkit.to/electrs alone, rebuilds a diverged recovery as a new generation that never sends the old hex again, and ends, done or failed, by sweeping leftover fee funding to Savings. Without the SDK (operators down at connect, or a background start) it still broadcasts the stored, signed steps whose parents confirmed and whose timelock matured.
• Publishes a step without the SDK only once its relative timelock matured from its parent's confirmation, stops resending a step whose input someone else spent (the next check rebuilds it), and never counts a not-yet-final answer as a rejection.
• Rebuilds from the same funding when the exit's fee chain lost a race: when another wallet whose leaves share a tree node gets its package for that node confirmed, our CPFP child for it is dropped and every later step spending its change can never confirm, while the SDK check still answers Valid. The exit detects that child (node confirmed, child unknown to every chain host) before broadcasting and rebuilds, never resending the dead transactions. As a safety net, a step refused 3 times, or whose parents confirmed and that comes back unpaid (min relay fee not met, 0 < …) or with missing inputs 3 times in a row, rebuilds behind the 10-minute gate; unpaid is never a rejection, and without the SDK a step stuck that way lets the deadline alarm fire, since nothing rebuilds it.
• Takes Spark off Lightning during an exit: no sends, receives or deposits on Spark, its balance shows as in transfer to Savings with the countdown on Home and Savings, and Spark reconnects with leaf optimization off until the exit ends, so no optimization swap hands an exiting leaf to someone else.
• Waits, before quoting an exit, until no leaf optimization runs and the counter-swap of one cut short is claimed (the SDK's 300 s grace), then syncs, so value in flight is not left out of the exit; the quote screen says it is waiting. Starting the exit also waits for a running optimization before Spark reconnects. While an exit runs, Progress shows Spark's balance beyond the quote's leaf total as outside the exit.

Background run on Android

• Runs the exit to completion with Bitkit closed, so users need not open it until it finishes. The record (spark-exit.json, the same JSON as iOS, with the recovery in spark-sdk's serde shape) is reloaded on launch and the exit ticks every minute while Bitkit is open. While it is closed, a WorkManager job runs every 15 minutes from a cold process, also after the app is killed or the phone restarts: it publishes the stored steps, connects Spark alone (never the node) to check, sign and rebuild, and saves after each broadcast, so a killed run sends nothing twice. App start, boot and app updates queue the job again when an exit runs.
• Adds the SparkExitWorker WorkManager job and a BOOT_COMPLETED/MY_PACKAGE_REPLACED receiver that queue it again while an exit runs, and hooks the foreground loop to the app's start and stop.

Notifications, funding and the leftover sweep

• Notifies only when the background run falls behind: an alarm 12 blocks into the operators' ~50-block window of the next step, pushed back by every run that keeps up, fires when none did and names why (steps refused again and again, no network, background restriction, battery saver) and the time to open Bitkit by; needing more fee funding is notified at once. The swipe asks for notification permission, and Progress notes background restriction, battery saver, battery optimization and notifications off. The explainer and Progress say the exit runs in the background and Bitkit notifies you if it needs you.
• Pays the exit's CPFP fees from a key on its own account, m/84'/{coin}'/7797'/0/<index>, derived from the wallet seed with bitkit-core, so ldk-node never spends the funding UTXO or the CPFP change chained back to it; only the path index is kept, never the key.
• Asks, when a rebuild needs more fees, for a top-up of only what the SDK's required total lacks beyond what the funding address still holds (adopted inputs and the CPFP change of every generation count as held; several small payments count as new funding), instead of the whole total again.
• Shows Paid from savings, waiting for confirmation, with the funding transaction, on Progress once the app has paid the fee funding, and Payment seen, waiting for confirmation, for a payment from another wallet seen in the mempool, instead of asking for the funding again; it asks only for what is still missing once that confirms, at least the funding output's 294-sat dust limit, also on the first tick after a build ends short, and shows what arrived so far (₿ X of ₿ Y received, send ₿ Z more) on Progress and the funding screen, where Continue waits until the funding is covered.
• Gives each exit its own funding key index, kept in the record and the app cache, so a later exit never reuses an earlier one's funding address or mixes in its leftover; restarts sign with the record's index, and records written with index 0 still load.
• Records the fee funding paid from Savings as an ordinary payment in Activity, not a transfer to Spending, and says the exit takes up to 4 weeks.
• Sweeps fee funding an exit leaves at its funding address (CPFP change after a rebuild, or a branch the operators published) to Savings when it ends, background runs included, signed by the SDK's single-key signer over a PSBT Bitkit builds, at the exit's fee rate once every UTXO there confirmed. It is saved before it is sent and sent again each run until a node accepts it; nothing is sent when what arrives would be under the output's dust limit. Background runs keep going after the exit ends until the sweep is accepted, without starting Spark.
• Keeps a finished exit's result reachable from Emergency exit and the Spark screen until its leftover sweep confirms or is under dust, and shows the sweep's state there: sending, sent with its transaction ID, or kept as dust at the funding address. An exit that failed or lost a leaf stays reachable until its result was opened once. Only then does Emergency exit open a fresh explainer.
• A failed or partly lost exit keeps its result and notifies until the user opens it.

Lost leaves and fee-ladder leaves

• Leaves out a leaf an older owner of these funds already claimed once two rebuilds reproduce its spent refund, says on Progress what can't be recovered and notifies once with the amount, as it does when an exit fails, also while Bitkit is open; a leaf the SDK refuses to exit is left behind and the rest rebuilt.
• Names on the quote what it can't exit: leaves too small to pay their own fees and Spark's balance beyond them.
• Warns 12 blocks after a step matures, inside half the 50-block window on every network.
• Drops a leaf the SDK refuses to exit, such as a fee-ladder leaf whose refund cannot pay its own fee at the rebuild's rate, and prepares the rest again; when the refused leaf can't be told from the error, it prepares the recoverable leaves instead and leaves out the rest. The exit records how many leaves it left behind.

Breez SDK 0.28.0: per-node funding, a higher fee, failed leaves

• Funds each fee-bumped transaction from a UTXO of its own (CpfpFundingStrategy::PerNode), so one lost fee race strands one step's funding instead of the chain after it. New exits keep the strategy in the record and resume with it on every prepare; exits started on 0.27.2 resume per branch. Savings, like another wallet, still pays one amount (single_utxo_sats), which the SDK fans out per step, since ldk-node sends to one address only; the funding screen says it is split into N parts. Each step's change stays at the funding address and the leftover sweep collects it at the end.
• Adds Pay a higher fee on Progress while the exit is underpriced (a step refused under the fee floor, or accepted and unconfirmed for more than 6 blocks) or the network asks more for the next block than the exit's rate, with a one-line hint for the latter. Its screen offers the send flow's Fast and Normal rows, each strictly above the exit's rate, with what it costs from Savings: the exit is built at that rate with the funding it holds, nothing broadcast, and what its funding address still lacks plus one input's fee is the extra. Paying sends the extra from Savings like the first funding; the exit then rebuilds at the new rate, replacing what has not confirmed. The deadline alarm of an underpriced exit names the fee instead of a missed background run.
• Keeps cooperative leaves the operators moved on-chain but could not co-sign part of the exit after a Done verdict: they are retried as a recovery of their own at once, then at doubling gaps from 6 to 144 blocks, and let go after 1,008 blocks (about a week), as Glow does (leftovers.ts). Progress says they wait for the operators; afterwards Done says the amount was moved on-chain by the operators, is not on Spark, and that they can still release it. Done leads with the amount that reached Savings.
• Sweeps each step's change at the network's cheapest rate once it is worth more than its fee, waiting up to about 4 weeks for fees to drop. After a higher fee is paid, Progress shows no low-fee line and nothing asks for funding while the payment confirms.
• The pre-start funding hint adds 68 vB × rate for each payment beyond the first and for the one still to send, as Progress's top-up does. OperatorsUnavailable, new in 0.28.0, waits like FundsNotFound, and a salvaged record that had ended keeps its leftover to sweep.

Independent review addressed

• Pay a higher fee keeps driving the exit while its payment confirms: the live generation is checked and its ready steps sent (without the SDK too), the deadline alarm stays armed, and a payment no host knows for a block, or not adopted within 144 blocks, is forgotten so the ask and its notification come back.
• Cancel only runs while nothing was paid or seen, under the tick lock, after a confirm, and reads the funding address first: an unreadable address refuses ("Couldn't check the funding address. Try again."), and funds already there keep the record as a cancelled exit whose leftover sweep sends them back to Savings.
• Starting holds Spark (no sends, receives or spending balance) in the same step its transfer starts counting, before the optimization wait, then quotes again and takes the new leaves if an optimization swapped them. Start and Pay a higher fee run one at a time, and a higher fee paid for an exit that ended or started rebuilding meanwhile is not applied (the payment goes back with the leftover).
• A tick that fails still runs the alerts, and a failed SDK check falls back to the keyless broadcast.
• The leftover sweep reads the address again when its inputs went elsewhere or no node took it in a day, holds for unconfirmed outputs for at most a day, keeps every input when it replaces a sweep, and keeps as dust at once what even 1 sat/vB can't send.
• Broadcast answers keep only the node's message or RPC code (at most 200 characters), never a host's page.
• Salvage keeps the leftover, the sweep, what landed and the funding txids; the unreadable original is copied aside first. Records and the lost-leaf list are synced to disk before the atomic move, a cold background run reads the wallet index from config, a rebuild short of fees waits for an address reading, and a fee-bump rate the SDK refuses a leaf at is not offered.

Review bots and team review addressed

• Start and cancel can't interleave: after the optimization wait, the start checks under the tick lock that its exit is still the running one, and pays from Savings under that lock. A cancel during the wait ends the exit with nothing paid and the transfer released.
• A Savings funding send with an unknown result counts as paid: cancel stays off, and the exit keeps watching its address, also after it ends, until the payment arrives or is forgotten. Cancel also stays off while a Savings send to the address is unresolved.
• A higher-fee rate at which any leaf can't pay its own exit is not offered. With none left, the screen says the exit confirms once fees drop.
• Balances: the exit's transfer counts only what is still on its way, never funding nobody paid or value Savings already has, and Spending keeps Spark's value outside the exit.
• Deadlines: the alarm stays armed while a higher fee's generation is driven, and it is no longer pushed back while a due step reaches no host.
• Endings: a keyless pass whose every step confirmed ends the exit as done. A first build with only failed cooperative leaves is kept and retried. A wipe closes the record's writes and waits for the tick in flight before deleting.
• Sweeps: a sweep that confirms while more funding is at the address is kept, and the rest goes in a sweep of its own. Sweeps spend only confirmed outputs after the day's wait, and every wait and rebuild keeps looking for versions a node accepted.
• Funding takes the fewest coins that cover the need and never a coin worth less than its input. The funding reminder fires once per exit, and the sweep's activity becomes a transfer even after the transfer settled.

SDK facts this relies on

• prepareRecoverFunds(All), used for the quote, can't abort: leaves that can't pay their own exit are listed under skipped (FeeExceedsValue) and the rest is quoted.
• A Specific rebuild can abort as a whole on an anchorless fee-ladder leaf; the app drops that leaf and retries with the rest.

Glow comparison
Compared against Breez's reference wallet Glow (breez/glow-web src/features/unilateral-exit/) and hardened where Glow is more correct; our own fixes stay where Glow has the bug (it has no detection for a lost CPFP race on a shared node).

• Splits the no-progress detector by cause. Rebuilds over a broken chain (refused, missing-input or unpaid steps, or a dead CPFP child) stop after 3 that confirmed nothing; Progress then says the exit is not moving, and the deadline alarm is no longer pushed back. A step the network accepted but has not confirmed for more than 6 blocks is not rebuilt: Progress says the network is busier than the exit's fee rate and offers Pay a higher fee, and the alarm is no longer pushed back. A refusal for a nonzero fee under a node's or the mempool's floor (min relay fee not met, 5 < 17, mempool min fee not met) shows the same at once; an unpaid step (… 0 < 17) and a lost replacement race stay on the broken-chain path. Mainnet reads stay on bitkit.to/electrs alone; the cap guards against a stale index.
• Never broadcasts a unilateral step the SDK could not read (Unverified). Once no unilateral step is ready, it rebuilds over it once a block at the same rate and funding, as Glow does (rebuild.ts, broadcast.ts). Cooperative Unverified steps still go out. The keyless pass still sends such a step, since only the SDK can rebuild.
• Waits instead of ending when an empty rebuild skipped one of the exit's leaves as Unverified or FundsNotFound, or as NotRecoverable while exitChainState.stoppedLeafIds has listed it for under 6 blocks. It tries again after 6 blocks, at doubling gaps up to 144, and lets the leaf go after 1,008 blocks (about a week), as Glow does (quote.ts, leftovers.ts). Progress shows the wait. OperatorsUnavailable (0.28.0) waits the same way. Only Redo rebuilds strike a lost leaf, and never a stopped leaf still inside its wait.
• Keeps the SPARK_EXIT cloud backup from before the exit while one runs. Before the first build it keeps the SDK's exit data in the record, and imports it before every rebuild (building.ts, rebuild.ts).
• Rebuilds a leftover sweep that was refused for its fee at the next block's rate, and replaces one still unconfirmed after 144 blocks (RBF, at least 1 sat/vB more). Any version it replaced confirming also ends the sweep. A sweep refused for good names the funding address's derivation path.
• Keeps a running exit whose record can't be read, or has an unknown version: the file is set aside unchanged, and the exit rebuilds from the chain with the leaves, rate, funding and exit data it kept. Progress says so, and there is a hook for a future version converter.
• Counts down along the longest path of timelocks and blocks left, so the countdown no longer jumps (model/progress.ts). The Done screen shows the amount received and the sweep's transaction ID. A top-up adds 68 vB × rate for each extra funding coin (exitFee.ts) and keeps the 294-sat floor. The background job reads the active wallet, and tapping an exit notification opens the exit.

Out of Scope

• Emergency exit translations: its strings carry the English text in every locale, as on iOS; the Spark strings in feat: add spark via breez sdk #1697 are translated.
• Funding one Savings payment per step: ldk-node sends to one address only, so the SDK fans out the single payment.

Risks for review

• Emergency exit on mainnet. No exit has run on mainnet. Mainnet leaves carry fee ladders, a different refund path that Spark's hosted regtest and the public operator code used for the local runs do not have, and package relay at bitkit.to/electrs, mempool.space and blockstream.info is untested with a real exit: a refused package keeps its step ready, the next host is tried, and after 3 refusals the exit rebuilds, up to 3 times without progress before Progress says it is not moving. The exit can take up to about 4 weeks (local regtest exits took about 1,900–2,000 blocks from the first broadcast to the sweep, about 13–14 days at mainnet block times), and about 50 blocks after a step matures the operators may publish their own version, paid from the leaf; the 15-minute background work publishes inside that window, with the deadline alarm as fallback when Doze or the standby bucket holds it back. A user who restricted Bitkit's background use, or force-stopped it, gets neither until the next launch (Progress says so), and without notification permission the fallback is silent. At 2 sat/vB, leaves under about 4,096 sats cost more to exit than they hold and stay on Spark, so an exit of a typical balance recovers about 75% of it after fees.

• Per-node change waits for low fees. Each per-node funding entry is its child's fee plus the 294-sat dust limit, and that change stays at the funding address. The leftover sweep runs at the network's cheapest rate (never above the exit's), takes only coins worth more than their 68 vB input fee, and waits while what it would send is dust, checking again about once a day; after about 4 weeks (4,032 blocks) the leftover is kept at the funding key's derivation path, which the result names. Done says the fee change reaches Savings when network fees drop.

Design

N/A — no design yet. The emergency exit screens follow the Transfer to Savings screens; docs/screens-map.md lists them as todo. UI polish is pending design.

Preview

Emergency exit on Spark's regtest: the explainer, quote and Fund from another wallet (1adfc47); Pay from savings, the swipe, Progress waiting for the paid funding and then publishing (3e60f04); and the earlier exit waiting for its timelock with the background notes and the countdown on Savings (3e60f04).

Fund from another wallet	Pay from savings	Running exit
e1-explainer-quote-funding2x.mp4	e2-pay-savings-progress2x.mp4	e3-running-exit2x.mp4

A full exit on a local regtest stack (4771ead, older copy): relaunch after the operators published the refunds first, the rebuild and the sweep to Savings, and the result of the first exit.

Redo and sweep	Exit complete
q3-redo-sweep2x.mp4

Screens

Dark mode, default size.

Spark detail during an exit

Intro	Quote with the can't-exit note	Funding choices	Funding address

Confirm	Notification prompt	Running	Needs funding

Needs funding, partial	Paid from savings	Payment seen	Done

Leftover sending	Leftover swept	Stopped	Stopped, balance stays on Spark

Lost to an older owner

QA Notes

Setup

• A dev build on Spark's regtest chain, set up as in feat: add spark via breez sdk #1697's QA Notes (ESPLORA_URL and the faucet), runs the exit from the explainer to Progress; the timelocks of about 1,900 blocks keep a full exit out of reach there.
• The full exits ran on a local regtest stack: spark-sdk 0.27.2 against the last public Spark operator (1 Oct), patched to accept 0.27.2's status filters and with fee ladders off, since the current operator image is private. Every leaf there is an anchored, pre-ladder leaf.

Journeys

• new transfer/spark-emergency-exit.xml — with a Spark balance, Emergency exit opens the explainer, the quote lists amount, fees and what arrives, and funding shows Pay from savings and a funding address from another wallet; stops before the swipe.

Manual Tests

• 27. Dev on Spark's regtest chain, Spark funded from the faucet → Emergency exit, fund from another wallet with the faucet, swipe → Progress shows fee funding confirmed, then publishing with confirmed steps counting up and Ready in a countdown; kill and reopen the app mid-exit → it continues without sending a step twice; at the end Savings receives about the quoted amount and the transfer settles — hours of regtest blocks.
• 28. Same as 27 with Pay from savings → the funding payment shows as an ordinary payment, not a transfer to Spending, and the exit starts once it confirms — Spark's regtest chain.
• 29. During an exit → Spending shows the Spark balance as in transfer to Savings, Lightning receives and sends do not use Spark, and Transfer to Spending shows the Transfer Unavailable sheet — a running exit.
• 30. Exit started but not funded → Cancel exit on Progress puts Spark back as it was — needs a Spark balance.
• 31. Dev, an exit running → kill Bitkit from the background (not Force stop) → the next background run logs Driving the Spark exit in background, connects Spark and checks the exit with no screen open; with Wi-Fi and data off past the deadline alarm, a notification names the time to open Bitkit by — a running exit.
• 32. Dev on Spark's regtest chain, Emergency exit with Pay from savings → right after the swipe Progress shows Paid from savings, waiting for confirmation, with the transaction ID and no address or QR; with Fund from another wallet, a payment seen in the mempool shows Payment seen, waiting for confirmation — Spark's regtest chain.
• 33. An exit that ends with leftover fee funding (a Redo that needed no funding) → Emergency exit and the Spark screen still open the result, which shows the sweep sending, then sent with its transaction ID, or kept as dust; a fresh explainer shows only after that — needs an exit to end, about 2,000 regtest blocks.
• 34. A second exit on the same wallet → its funding address differs from the first exit's — two exits.
• 35. Relaunch Bitkit with an exit whose refunds wait for their timelock → before Spark reconnects the log shows no non-BIP68-final or missingorspent broadcast — a running exit near its timelock.
• 37. Dev, an exit running and Bitkit closed → a Spark exit notification (deadline alarm, or a lost or failed result) → tapping it opens the exit's Progress inside the Spark screen, and OK goes back to Spark — a running exit, also after the app process was killed.
• 38. An exit that ends Done → Progress shows the amount that reached Savings and the sweep's transaction ID — needs an exit to end, about 2,000 regtest blocks.
• 39. An exit whose step is accepted but unconfirmed for more than 6 blocks, or whose rate the network's next-block rate passed → Progress shows the fee line and Pay a higher fee; its screen lists Fast and Normal above the exit's rate with what each costs from Savings (rows disabled and a note when Savings can't cover them); paying shows Paid from savings, waiting for confirmation, and once it confirms the waiting steps go out again at the new rate — a running exit with fees above its rate.
• 40. An exit whose Done verdict lists cooperative leaves the operators could not co-sign → the exit stays in progress and says they wait for the operators; it retries them, and after 1,008 blocks Done names the amount the operators moved on-chain and still hold — operators that refuse to co-sign.
• 36. Mainnet, a fresh wallet with about 50,000 sats on Spark, in a low-fee week → Emergency exit to the end, with the phone charged and online for about two weeks → each step confirms, none is published by the operators first, and the sweep lands in Savings — mainnet funds, fee-ladder leaves and real block times.

Automated Checks

• added SparkExitRecordTest.kt — the record round trips with every phase and status, the recovery keeps spark-sdk's serde shape, a recovery written by the Breez CLI and a record written by Bitkit iOS are read, an unknown version is refused, and the store saves atomically and sets an unreadable record aside
• added SparkExitDriverTest.kt — waits for confirmed funding, builds and saves before broadcasting, Valid broadcasts ready steps once until due, rejections surface after 3, Done ends with leftover funding, Redo rebuilds as a new generation that never sends the old hex (also without the SDK), a rebuild short of fees asks only for what the SDK's total lacks beyond what the address holds (50 sats on the local regtest run's numbers, 2,000 after a Redo whose input lives on as 13,000 of change) and adopts several small top-ups together, the tick that ends the exit sweeps its leftover until a node accepts it, dust is not swept, a top-up ignores CPFP change, cooperative failures retry, an unverified leaf waits, a restart mid-exit resumes from the file without repeating broadcasts, and the keyless pass broadcasts only steps whose parents confirmed and timelocks matured
• added SparkExitFundingTest.kt — what arrives, the fees and the fee funding of a quote, the uneconomic gate, the funding shortfall, the countdown height, the funding UTXO choice, whether Savings can pay, the ETA per network, the funding path, WIF decoding and CPFP child txids
• added SparkExitChainTest.kt — packages go out as a raw JSON array and single steps as plain hex, the unversioned path and the next host are tried, a node's refusal wins over an unavailable host, tip and UTXOs are read, and node answers are classified
• added SparkExitRepoTest.kt — loading settles exit transfers no running exit owns, including the transfer of a record set aside as unreadable; a background run from a cold start (Spark not connected, no UI) publishes from the stored recovery against a mock regtest mempool, connects Spark and checks, and a restarted process sends nothing twice; runs whose steps keep being refused stop pushing the deadline alarm back; a background run of an ended exit with leftover to sweep keeps going without starting Spark
• added SparkExitSweepTest.kt — bech32, bech32m, P2PKH and P2SH addresses decode to their scripts, dust limits follow Bitcoin Core per output type, a sweep pays its inputs less the fee and skips dust, the signed transaction carries the signer's witnesses and keeps the unsigned txid, and an unsigned input is refused
• added SparkExitAlertsTest.kt — a stalled exit's notification names refused steps, no network, background restriction or battery saver (battery optimization alone names no cause), asks for fee funding, and stays quiet when nothing needs the user
• added SparkExitRegtestTest.kt (unit, opt-in with SPARK_EXIT_REGTEST=1) — Spark's regtest mempool answers the tip and a funding address, and its node's per-transaction answer to a package is read as retry later
• added SparkExitRegtestTest.kt (instrumented, opt-in with -e sparkExitRegtest true) — on a device against Spark's regtest, a new wallet's quote has nothing to exit, the funding key derives with bitkit-core into a working CPFP signer, and a leftover sweep PSBT is signed and finalized by the SDK's singleKeyCpfpSigner
• updated SparkExitDriverTest.kt, SparkExitFundingTest.kt, SparkExitRecordTest.kt, SparkExitRepoTest.kt, SparkExitChainTest.kt (cc2641c) — Done after a Redo that needed no funding sweeps the earlier generation's change in one transaction, an exit that ended while its funding address could not be read ends again once it can, each exit takes a funding key index no earlier exit used and a restart signs with its own record's, without the SDK a refund waits for its CSV from its parent's confirmation and a step whose input someone else spent is not sent again, a refund an older state spent ends the exit after two rebuilds reproduce it, a lost leaf or one recoverFunds refuses is left out and the rest rebuilt, a rebuild whose every leaf cannot be exited fails, Progress waits for a payment from savings or one seen in the mempool and asks only for what is missing, the quote names what it skips, and the deadline warns within half the 50-block window on every network
• updated SparkExitDriverTest.kt, SparkExitChainTest.kt, SparkExitRecordTest.kt, SparkExitRepoTest.kt, SparkExitViewModelTest.kt (2ed4673, f541952, 0baad3f) — two packages for one shared node where theirs confirms and ours is dropped rebuild from the same funding without resending the dead transactions, and wait for the rebuild interval sending nothing meanwhile; a child still in the mempool is not dead; a step unpaid 3 times in a row rebuilds once and then surfaces, and any other answer resets the count; a transaction is unknown only when every host answers 404; only a zero-fee refusal reads as unpaid; the new record fields round trip; a background run whose step keeps going unpaid without Spark lets the deadline alarm fire; a tick that ends short of 68 sats asks for 294 at once, and Progress asks for at least 294 before the funding address was read
• updated SparkExitViewModelTest.kt (4df5c75) — a stopped exit that lost a 32,768-sat leaf and could not exit 1,696 says ₿ 1 696 stays on Spark, from Spark's live balance, and claims nothing when only the lost leaf is left
• added SparkRepoTest.kt case — an exit quote waits for a running leaf optimization and out the counter-swap grace of one cut short before it syncs
• added SparkExitViewModelTest.kt — after Fund from another wallet, Back and Continue offer both funding choices again
• updated LightningConnectionsViewModelTest.kt, AppViewModelSendFlowTest.kt — construct the exit repository
• updated SparkExitDriverTest.kt, SparkExitFundingTest.kt, SparkExitRecordTest.kt, SparkExitRepoTest.kt, SparkExitAlertsTest.kt, SparkRepoTest.kt (Glow comparison) — a refused step rebuilds until 3 rebuilds confirmed nothing, then reads as not moving, and a confirmation starts the count over; an unpaid step rebuilds and never counts as a rejection; a step accepted but unconfirmed for more than 6 blocks, or refused for a nonzero fee under a node's or the mempool's floor, reads as underpriced and does not rebuild, while 0 < and a lost replacement race do not; a unilateral Unverified step is not sent and rebuilds once a block, but waits while another unilateral step is ready, and the keyless pass still sends it; an empty rebuild waits for a FundsNotFound leaf at 6/12/24-block gaps, lets it go after 1,008 blocks, waits 6 blocks for a stopped leaf, ends at once for an unrecoverable leaf that is not stopped, and never strikes a stopped leaf; the first build keeps the SDK's exit data and a rebuild imports it; a sweep refused for its fee is rebuilt at the next block's rate, becomes dust when nothing else is left, stays final for any other refusal, is replaced after 144 blocks unless the replacement would be dust, and ends when a replaced version confirms; an unknown-version record is salvaged with its funding, exit data and transfer, an ended one stays ended, and the repo keeps such an exit running; the critical-path countdown; the amount received over several generations; per-input top-up sizing and pacing; the exit data backup is skipped while an exit runs
• updated SparkExitDriverTest.kt, SparkExitFundingTest.kt, SparkExitRecordTest.kt, SparkExitAlertsTest.kt, SparkExitViewModelTest.kt (SDK 0.28.0) — every prepare passes the exit's funding strategy; fan-out outputs are not new funding; the funding split counts the quote's entries; the pre-start hint adds each payment's input fee; OperatorsUnavailable waits; a higher fee the funding covers needs nothing more, otherwise the SDK's shortfall less what the address holds plus one input's fee, at least dust; a paid higher fee rebuilds at the new rate once its payment confirms, and one with nothing to pay rebuilds on the next tick; the rates offered sit strictly above the exit's; the offer holds only while underpriced or below the network; leaves the operators moved on-chain retry at once and at doubling gaps, are let go after a week, and a co-signed retry becomes the next generation that ends the exit; Done keeps the sweep that landed before the retry; the alarm names a low fee before any missed-run cause; a salvaged ended record keeps its leftover
• updated SparkExitChainTest.kt — mainnet reads only bitkit.to/electrs and broadcasts there first, then mempool.space and blockstream.info; a package on bitkit.to/electrs goes once to /txs/package; reads never reach a broadcast-only host; with one read host a 404 means unknown and a 503 or an unreachable host throws

QA

Breez SDK 0.28.0 rerun on d9d3c87, local Spark regtest plus one exit on Spark's hosted regtest (QA comment):

• 🟢 Pay from savings with per-node funding, the fee-change sweep of all 5 leftover outputs, and the partial top-up with no second round.
• 🟢 Pay a higher fee (paid and covered by the funding), the evicted fee-change sweep retried, a 0.27.2 record resumed to Done.
• 🟢 Lost race on a per-node node, stale state with one notification, the rebuilt-from-chain note, and "not moving" with its notification once.
• 🟢 Hosted regtest: fan-out and the first node packages accepted.
• 🟠 Lone-transaction package retry not reached: the hosted host now answers /tx normally; unit tests cover it.
• ⏭️ The failed cooperative leaf retry and OperatorsUnavailable wait need a watchtower-moved leaf, which neither stack produced in time.

The independent review fixes after it rest on the unit tests below.

Local regtest exits, from the QA write-up (spark-sdk 0.27.2 against the last public operator, Android emulator):

Case	Result
Quote with all 3 operators stopped	✅ 90,112 to exit, 4,537 fees, 5,713 funding, 9,888 staying on Spark
Fee funding from another wallet	✅ exactly 5,713
Kill mid-exit, relaunch	✅ continued without sending a step twice
Full exit to Savings	✅ 91,288 swept, 1,907 blocks from the first broadcast (about 13 days at mainnet block times)
Operators publish the refunds first (Redo)	✅ generation 2, no funding needed, 93,200 swept
Top-up after a short build (on 5edd5a8ce)	✅ asked only for the 68 sats missing, with a notification
Leftover sweep (on 5edd5a8ce)	✅ 1,626 and 626 back to Savings
Pay from savings, then new funding address per exit (on 5edd5a8ce)	✅ paid, waiting for confirmation, with the txid
Partial funding (on f1507f29d)	✅ ₿ 500 of ₿ 1,329 received, send ₿ 829 more; Continue waits
Single leaf lost to an older owner (on f1507f29d)	✅ leaf dropped, 558 swept back, Failed, one notification, result kept until opened

The same write-up's headless runs on the SDK's calls show a stale refund from an older owner winning when the app sleeps past the 100 blocks after a maturity with the operators down, which the lost-leaf handling above now ends with a Failed exit instead of an endless Redo.

🟢 Exit start and funding from another wallet, Pay from savings, Running exit in the background

Exit start and funding from another wallet

On 1adfc47 on Spark's regtest chain (J9's steps by hand): with 79,703 on Spark the quote showed 65,536 to exit, 8,923 network fees, about 56,613 to receive, 9,211 fee funding and 14,167 staying on Spark, and Fund from another wallet showed the funding address and amount. Recording in Preview.

---

Pay from savings

On 3e60f04, a fresh wallet with 69,802 on Spark (part of 32: Pay from savings): the quote named the 12,458 it can't exit, the swipe asked for notification permission, Progress showed Paid from savings, waiting for confirmation, with the transaction ID and no QR until the funding confirmed about a minute later, then published 1 of 23 steps. Recording in Preview.

---

Running exit in the background

On 3e60f04, the 4-leaf exit started on 326a6aa (21 of 30 steps confirmed, waiting for the timelock) loaded on the new build: Progress showed the background, battery optimization and notifications-off notes, and Savings showed From Spending (±4d) 90,400 (part of 29: the countdown). On bd931ac, with Bitkit's process killed, the periodic job published nothing due, connected Spark alone, checked the exit as Valid, saved the record and ended in 9 seconds; after a reboot the job and the deadline alarm came back, and background restriction held both (part of 31: the background run). The 326a6aa run found three bugs, fixed there: the fan-out confirm Spark's regtest mempool never reported, the foreground loop that never started, and the timelock step shown as done too early. Recording in Preview.

---

🟢 Full exit with the operators down, Redo after the operators publish first, Funding short then topped up

Full exit with the operators down

On 4771ead, with a local config patch not in this PR, on a local regtest stack (spark-sdk 0.27.2 against the last public Spark operator, fee ladders off, since the current operator image is private): with the 3 operators stopped the quote showed 90,112 to exit, 4,537 fees and 5,713 funding; funded exactly from another wallet, the exit built 25 transactions, resumed after a force-stop without sending a step twice, published each refund within a minute of maturity, and swept 91,288 to Savings 1,907 blocks after the first broadcast, ending on Exit complete with 18 small amounts left on Spark. Screenshot in Preview.

---

Redo after the operators publish first

On 4771ead, a second exit paid from savings was force-stopped until 2,000 blocks past maturity, the operators' watchtower published all 5 refunds, and the relaunch rebuilt as generation 2 with no funding and swept 93,200 to Savings. It left 3,514 sats of funding change unswept and hidden after Done, on the first exit's funding address, which cc2641c fixes (33, 34). Recording in Preview.

---

Funding short then topped up

On the same stack, a harness making Bitkit's SDK calls showed a rebuild needing 9,085 sats with 9,035 held over 5 UTXOs, then reaching Done after a 1,000 sat top-up; Bitkit asked for the whole total instead of the 50 missing, fixed in aec3163.

---

🟢 Pay from savings after viewing the funding address

Pay from savings after viewing the funding address

On 1adfc47, after Fund from another wallet, Back and Continue reopened the funding address with no Pay from savings button. Fixed in b4ec299, which resets the choice on Back; SparkExitViewModelTest.kt covers it, not rerun on a device.

🟠 Exit end and notifications on the new build

Exit end and notifications on the new build

Not run: on Spark's regtest the running exits wait for timelocks of about 1,900 blocks, so the result kept reachable with its sweep state (33), a second exit's new funding address (34) and the relaunch without early refunds (35) rest on the unit tests; the deadline and funding notifications (rest of 31) are covered by SparkExitAlertsTest.kt, and Payment seen for an outside payment (rest of 32) by SparkExitFundingTest.kt.

---

Mainnet read-only check (30f87e5): a local build with debug-only logging, which also shows the Emergency exit entry at a zero balance. On a fresh mainnet wallet with nothing funded, Spark connected and synced on https://bitkit.to/electrs with a balance of 0. Opening Emergency exit up to the quote read the SDK's fee estimate from https://bitkit.to/electrs/fee-estimates, and the quote showed Nothing can be exited right now. The exit's own reads (/blocks/tip/height, /tx/{txid}/hex), run from a debug hook at launch, went to https://bitkit.to/electrs only. Nothing was broadcast.

Open

• Hosted-regtest exit: running; the fan-out and first node packages were accepted, and it takes more than a day of timelocks to finish.
• Mainnet exit (Manual Test 36): not run yet. It needs a fresh wallet with about 50,000 sats on Spark, a low-fee week and the phone online for about two weeks.
• Fee-ladder leaves: mainnet leaves carry fee ladders, and both Spark's regtest and the public operator used for the local runs are pre-ladder, so the ladder refund path runs only in unit tests.
• Translations: the emergency exit strings are English in every locale.

Models used

• Planning/scoping: claude-opus-5-5 (reasoning: low)
• Implementation: claude-opus-5-5 (reasoning: low)
• Review: Unknown (reasoning: Not exposed)
• Metadata note: an independent review of this PR was run in a separate session whose model was not recorded here.

[github-actions]

Regtest APK

Built from 3425c85 (run).

Download bitkit-dev-debug universal APK (expires in 30 days).

[ovitrif]

QA on a92ee43: dev build on an Android 15 emulator, Spark on its hosted regtest, Savings funded with 200,000 sats on staging regtest.

• 🟢 J1 spark-transfer-to-spending.xml from feat: add spark via breez sdk #1697, to check the exit's gating leaves the transfer flow alone: every step held, with the same figures as on feat: add spark via breez sdk #1697 (Max 199,635, up to 696 Instant, ≈ 99 Later), and Savings › Transfer To Spending opened the amount screen with no intro.
• 🟠 spark-emergency-exit.xml: stopped at step 6. With a ₿ 0 Spark balance the Spark screen hides Emergency exit and disables Transfer to Savings, as designed; the rest needs a Spark balance from Lightspark's regtest faucet.

J1 on this PR, and the exit journey up to the Spark screen with no balance (2x speed).

J1 flow	No intro on the second entry	Exit journey, ₿ 0 on Spark
j1-exit-a2x.mp4	j1-exit-b2x.mp4	exit-journey2x.mp4

[ovitrif]

QA on 4df5c75f4: dev build on an Android 15 emulator, against a local Spark regtest stack with the operators stopped, so every exit is unilateral.

• 🟢 Lost race on a shared tree node: another owner's CPFP child replaced this wallet's child on the node cad843ee (the competing child spends the node's anchor at a higher fee). The exit carried on by itself: its next node 2fe35690 was accepted 9.7 min after the loss, and the exit swept 66,775 sats to savings (689d3b9d).
• 🟢 Stale state (an older owner publishes its refund first): the exit ends Failed with exactly one notification, "₿ 65 536 of your exit can't be recovered".
• 🟢 The stopped screen now says "Nothing could be recovered. ₿ 3 392 stays on Spark." It stays until it's seen, and reopening Emergency exit shows the intro.
• 🔴 A leaf lost to an older state comes back in the next exit, on iOS too (feat: spark emergency exit bitkit-ios#1217):
  • The operators still list it as ON_CHAIN under this wallet, so the next quote counted it: ₿ 131 072 over 2 leaves instead of ₿ 65 536.
  • Its refund fails with "inputs missing" on every tick, and the driver logs "diverged on-chain" and rebuilds after each confirmation, about 10 min per rebuild.
  • It then drops the leaf again as "claimed by an older state" and sends a second "can't be recovered" notification for a loss the user was already told about.
  • The exit itself finished Done. Leaves already reported as lost should be left out of later quotes and exits.

Stale-state result, kept until seen:

[ovitrif]

Fix for the lost leaf that came back in the next exit (QA comment), in 8eac6db.

Why: after an older state claims a leaf on-chain, the operators keep listing it as ON_CHAIN under the wallet. The lost leaves lived only on the exit record, so the next exit quoted the leaf again, rebuilt around its spent refund, and reported the same loss a second time.

What changed:

• Leaves lost to an older state are now kept per wallet and network, next to the exit record, and outlive it. They're cleared only when the wallet is wiped. They aren't in the backup: a restored wallet finds the loss again in one rebuild.
• The quote leaves them out. When prepareRecoverFunds(All) lists one, the rest are prepared again with Specific, so the amount, leaf count, fees and funding come from the SDK without it. When every listed leaf is lost, the quote shows the existing "nothing to exit" state and no exit can start.
• When an exit's unexitable-leaf fallback (RecoverableOnly) lists a leaf outside the exit, a lost one included, only the exit's own leaves are prepared and built.
• The "can't be recovered" notification posts only for a leaf not already reported lost.

The leaf id the app logs for a dropped leaf is the refund's node_id, which spark-sdk 0.27.2 sets to the leaf id, and the app logs it only for leaves of its own quote. In the regtest operator DB, case 5's older owner is a third wallet that sent one of the two leaves to each app wallet. The two ids differ in one hex digit (01a1aa9e-4d2a-…, 01a1aa9e-4d2d-…), so the crossed reading is most likely a misread, not an app bug.

Unit tests cover the store outliving a new exit record, the lost leaf left out of the quote and the selection, an all-lost quote with nothing to exit, and no second notification. Not rerun on a device yet.

[ovitrif]

QA on 8eac6db67: dev build on an Android 15 emulator, against a local Spark regtest stack with the operators stopped. I installed it over the previous build, keeping the wallet.

• 🟢 Case 5 again (an older owner claims the leaf first): the exit ends Failed with exactly one notification, and spark-exit-lost-leaves.json records the leaf.
• 🟢 With only lost leaves left, the quote shows ₿ 0 and "Nothing can be exited right now.", and Continue is disabled.
• 🟢 A new exit after that quotes only the live leaf (₿ 65 536 over 1 leaf). It logs no "diverged" or "inputs missing", sends no second notification, and swept 65,830 sats to Done (dd202b0c).
• 🟢 A leaf lost before this update was already in the file at the first quote after the update, so it never came back.

The 🔴 lost-leaf bug from my QA comment on 4df5c75 is fixed. Not covered: the later commits that move the mainnet chain service to Bitkit's electrs. This regtest build points the chain service at the local stack.

[ovitrif]

QA of Breez SDK 0.28.0 on d9d3c873d: dev build on an Android 15 emulator, against a local Spark regtest stack, plus one exit on Spark's hosted regtest. The commits since then up to ec38baa change no exit code.

• 🟢 Pay from savings with per-node funding: one funding payment fanned out per node, Done, and the fee-change sweep spent all 5 leftover outputs.
• 🟢 Partial top-up: "₿ 2 851 of ₿ 3 919 received, send ₿ 1 068 more" at 1 sat/vB, and paying that started the exit with no second round.
• 🟢 Pay a higher fee: with the steps held out of blocks for more than 6 blocks, "Pay a higher fee" at Fast 2 sat/vB paid 3,263 and the replacements were accepted. Once the payment confirmed, no fee-low line or notification remained.
• 🟢 Fee bump the funding already covers: "Use this fee", 0 sats paid, generation 2 rebuilt.
• 🟢 Evicted fee-change sweep (on 41dbb0d3b): after the relay floor rose, the sweep waited, then retried at 3 sat/vB and was accepted.
• 🟢 A record written by 145da4651 (0.27.2) resumed on 0.28 and reached Done.
• 🟢 Lost race on a per-node funded node: no stall and no rebuild needed.
• 🟢 Stale state: three Redo(ON_CHAIN_STATE_DIVERGED) rebuilds, then the claimed leaf is dropped with exactly one "₿ 65 536 of your exit can't be recovered". The live leaf carried on to Done.
• 🟢 Rebuilt-from-chain note: shown, and cleared once the rebuilt steps confirmed.
• 🟢 Not moving: with the refund's child replaced by a higher-fee rival and nothing mined, three rebuilds were refused. On the third, Progress said "The exit is not moving: rejected: insufficient fee, rejecting replacement …" and the notification "Some of your emergency exit's transactions were refused…" was requested on the same tick, once. On 41dbb0d3b none came in 12 min.
• 🟢 Hosted regtest: fan-out and the first node packages were accepted, with the fees funded by a cooperative withdrawal.
• 🟠 Lone-transaction package retry: not reached. The hosted host now answers 200 to a valid lone transaction on /tx (the fan-out went out that way, no package call) and a real code to a refused one (-26 for a not-final refund), not the bare -1 it gave on 4–5 Nov. The unit tests cover the retry.
• ⏭️ Not covered:
  • Failed cooperative leaf retry and its release copy, and the OperatorsUnavailable wait: both need a leaf the watchtower moved on-chain. No node on the local stack has a direct_tx, so its watchtower can't do that, and on hosted it takes more than a day of timelocks.
  • The leftover_waiting line from high network fees: while connected the app takes the SDK's recommended fees, so the wait was staged with the relay floor instead.

[ovitrif]

Triage: in 3.2.0. This PR closed no issue, so I filed #1806 to carry the milestone and added Closes at the top of the body; the issue is on the project at 📋 To do while this PR is a draft. Twin: synonymdev/bitkit-ios#1217 (issue synonymdev/bitkit-ios#1242).

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-07T00:44:07.425251Z	9ec9307	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ovitrif]

Ready for review: the emergency exit for Spark funds. It's stacked on #1697, which is also in review. Before marking it ready:

• moved to Breez SDK 0.28.0: per-node funding, Pay a higher fee, retry of failed cooperative leaves;
• passed the regtest rerun of every exit case (see the QA comment);
• addressed an independent review's findings (64004d7);
• matched the iOS twin's review fixes (9ec9307).

QA notes list each case with its revision and what is unit-tested only. The exit UI polish is pending design and is not part of this PR.

[greptile-apps]

Confidence Score: 0/5

[Critical impact] The PR adds an on-chain recovery path that moves users’ Spark funds into Savings.

Fix the exit lifecycle, funding, and deadline failures before merging.

Findings

1.  Higher fees leave funds behind ▶
2.  Funding waits silence deadline warnings ▶
3.  Sweeps include unconfirmed funding ▶
4.  Deleted exits can come back ▶
5.  Confirmed exits never finish ▶
6.  Exit totals count extra funds ▶
7.  Funding reminders keep repeating ▶

Summary

Adds Spark emergency exits with quotes, fee funding, saved signed steps, background driving, deadline notifications, fee increases, and leftover sweeps.

• Spark owners can review, fund, and follow an emergency exit to Savings.
• Bitkit saves and drives signed recovery steps until Spark funds reach Savings.
• Android keeps an exit moving in the background and alerts owners when it falls behind.
• Spark stops serving Lightning activity while its funds are moving to Savings.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  Quote[Quote exit] --> Funding[Wait for fee funding]
  Funding --> Build[Build and save signed recovery]
  Build --> Drive[Check chain and send ready steps]
  Drive --> Wait[Wait for parents and timelocks]
  Wait --> Drive
  Drive --> Rebuild[Rebuild changed recovery]
  Rebuild --> Funding
  Drive --> End[End exit]
  End --> Sweep[Sweep leftover funding to Savings]
  Background[Foreground loop or background work] --> Drive
  Alarm[Deadline alarm] --> Warn[Notify user and queue catch-up]

Loading

_{Reviews (1) · Last reviewed commit: "fix: spark exit bot review findings" · Reviewed by Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ec930731c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[talosmachina]

No findings. Adds a unilateral exit for the Spark balance. It quotes every leaf through the Breez SDK, funds the CPFP fees from a dedicated BIP84 account (from savings or another wallet), and drives the exit through restarts, WorkManager and boot. When the exit ends, a hand-built PSBT sweeps the leftover fee funding back to savings. Stacked on #1697 and reviewed as the delta against feat/breez-spark-lightning. Reviewed 9ec93073, oversized tier (78 files, +13,579): the key, signing, transaction-building, broadcast and lifecycle paths read in full, the rest not read. Not built here: the sandboxed runner refused this PR, because it could not read the author's permission with the token it uses on this org. CI is the gate.

What I checked, and 6 candidates I ruled out

Read in full: SparkExitRepo.kt, SparkExitChain.kt, SparkExitSweep.kt, SparkExitFundingKey and SparkExitQuote in SparkExitFunding.kt, the manifest receiver, SparkExitReceiver, and the App.kt, CacheStore.kt, Env.kt, TransferDao.kt and TransferType.kt hunks.
Read in part: SparkExitDriver.kt: tick, build, prepare, withExitState, the funding and own-payment paths, and the whole leftover sweep (sweepLeftover through sendSweep).
Not read: SparkExitRecord.kt, most of SparkExitWorker.kt, the driver's check/rebuild/broadcastWithoutSdk section, the Compose screens and view model, and the tests.
CI: build, build-and-test, build-local, compose-ui / ui-tests, lint, detekt and Greptile pass. The e2e-tests-local shards were still pending when I read them.

Ruled out

• Funding key colliding with the wallet's own keys: m/84'/{0|1}'/7797'/0/n is a hardened account of its own. It is derived through bitkit-core from the same mnemonic and passphrase, so a restore recovers it.
• Funding index reused across exits: nextFundingIndex takes the larger of the cached counter and one past the stored record's highest index. startLocked saves the record before bumping the counter, so a crash between the two still moves the next quote past it.
• Sweep PSBT malformed or overpaying: the unsigned transaction carries empty scriptSigs and a witness_utxo per input. signedTxHex re-serializes the same body with marker, flag and each final_scriptwitness in input order. plan returns null when the total does not cover the fee plus the destination's dust limit.
• Double payment from savings: start and payHigherFee share paymentMutex via tryLock. startLocked refuses while an exit is active, and a fee bump landing after the exit ended or started rebuilding goes to the leftover sweep and is not applied.
• Broadcast misread as success: only success, already-known/in-chain messages and RPC -27 count as accepted. A child's missing-inputs error on a package is retried, never taken as a verdict on the parent, and a node's rejection outranks an unreachable host.
• Boot receiver: it is not exported, the system still delivers BOOT_COMPLETED and MY_PACKAGE_REPLACED to it, and its handler only re-queues the work. This is the same pattern as AppWidgetRefreshReceiver.

Merge confidence: 3/5, the oversized-tier ceiling: the record model, the worker, the UI and the tests were not read, and the e2e shards had not finished on this head.

Reviewer model: claude-opus-5-5
Reasoning effort: Not exposed (the runtime does not report a reasoning setting for this session)