user may lose funds in a submarine swap, if their channel is force closed.

Scenario:

• Alice has a channel with Bob
• Alice initiates a normal swap with Carol.
• Alice receives a HTLC from Carol, through Bob
• Alice sends on-chain funds to the swap funding address
• Alice goes offline.
• The swap funding transaction gets confirmed.
• Carol publishes the claim transaction, with the preimage.
• Time passes, and the HTLC between Alice and Bob expires. Bob force closes the channel.
• More time passes, and the CSV delay expires, Bob now redeems the HTLC.

I do not think this is fixable; this is a consequence of the new protocol. (note: In the old protocol, Alice sends on-chain funds before she receives the HTLC. She has the preimage and settles the HTLC instantly).

Note that the GUI currently shows a dialog instructing the user to stay online until the funding transaction is confirmed.
However, that dialog is shown when the user initiates the swap, and the risk might not be understood.
I think we should also show a dialog when the GUI is closed.

If Alice shuts down her client while a swap is ongoing, the GUI could show a dialog offering several choices:

• cancel the swap (using a double spend)
• run the risk (promise to come back online soon)

edit: cancelling the swap does not guarantee that the swap funding transaction will not be mined

Start by tracing the GUI shutdown path for an ongoing submarine swap and the existing dialog shown when the swap is initiated. Decide how the close-time choices should be presented, including the caveat that cancellation does not guarantee the funding transaction will not be mined. Done means the shutdown flow clearly warns about the risk and offers the agreed behavior; the issue names no files or tests.