Therefore, as long as the client-side wallet app behaves properly, nearly complete self-custody can be guaranteed for nearly everyone. In particular, for people whose usage pattern is occasionally receiving large sums and spending them in small amounts, it can guarantee almost total ownership, provided the wallet app pairs a sensible refresh strategy with coin control. And that is not difficult at all, because it requires no cooperation from the ASP; it is entirely up to the client. Receiving a substantial amount on Layer 2 while knowing it could still be double-spent may be hard to accept. But this, too, is the kind of problem that can be managed with the right mental model. The answer is simply to refresh right away and not count the funds as received until the refresh is done. In other words, they should be treated the same as zero-confirmation funds onchain. Having explained this far, I expect the following objection: "The whole point of a Layer 2 is that onchain is slow and expensive. If certainty requires a refresh, and a refresh is an onchain transaction, then why bother using it at all? Doesn't that mean waiting for onchain block confirmations anyway? Besides, the reason Lightning isn't a complete solution is that even though channels can be used freely once opened, the chain could never handle it if every person made even a single onchain transaction. Isn't this the same thing? In fact, unlike Lightning, where a channel can be reused indefinitely once opened, this has to be done every time a lump sum comes in, so doesn't it require even more onchain transactions?"