Skip to content

[v0.1.x-branch] Backport #1171: swaps: cover issue 881 settlement replay - #1175

Open
github-actions[bot] wants to merge 3 commits into
v0.1.x-branchfrom
backport-1171-to-v0.1.x-branch
Open

[v0.1.x-branch] Backport #1171: swaps: cover issue 881 settlement replay#1175
github-actions[bot] wants to merge 3 commits into
v0.1.x-branchfrom
backport-1171-to-v0.1.x-branch

Conversation

@github-actions

Copy link
Copy Markdown

Backport of #1171


What this changes

The production bug was fixed by #1061. This PR adds the incident-shaped regression that was still missing.

  • Extends TestPaySessionFundingReplayAfterLostResponse through authoritative claim observation, durable completion, and a second daemon restart.
  • Proves the original payment-scoped OOR funding intent and recovery actor run exactly once.
  • Replays an authoritative funding miss as the failed-payment negative control.
  • Projects the reported payment shape through the real activity store.
  • Replays terminal summaries through the actual startup backfill and proves both COMPLETE and FAILED rows are idempotent.

There is no production-code change.

Incident path

  1. Waved accepted the OOR funding transfer, but Wavelength lost the RPC response before it persisted the funding session and vHTLC outpoint.
  2. After restart, keyed reconciliation recovered the original transfer and advanced the durable pay state to VHTLCFunded.
  3. Before sdk/swaps: prevent duplicate in-swap vHTLC funding #1061, the same FundingInitiated action kept polling after changing its own state. The live-vHTLC lookup then emitted OnVHTLCFunded again.
  4. The duplicate event caused the invalid transition VHTLCFunded -> OnVHTLCFunded, so the pay row became FAILED even though the server later claimed the vHTLC.
  5. sdk/swaps: prevent duplicate in-swap vHTLC funding #1061 returns control to the FSM as soon as replay durably reaches VHTLCFunded. The FSM advances to WaitingForClaim, observes the indexed preimage, and persists Completed.

The attached #881 daemon log records the separate OOR accounting boundary: the 3,000-sat input was spent and replaced by a 1,999-sat live change VTXO for the 1,001-sat send. The activity mismatch came from the pay FSM's incorrect terminal state, not from a missing VTXO debit.

The wallet regression does not feed a fake balance into the assertion. The incident log is the authoritative evidence for the debit; the test covers the activity projection that was wrong.

Tests

  • go test ./sdk/swaps -count=1
  • go test -tags='wavewalletrpc swapruntime' ./swapwallet -count=1
  • Focused SQLite and PostgreSQL wallet regressions
  • Focused race tests for both changed packages
  • make lint-changed-local base=origin/main
  • make fmt-changed-check base=origin/main
  • make tidy-module-check
  • make sqlc-check
  • make doc-check schema-check sample-conf-check
  • make commitmsg-lint range=origin/main..HEAD

Related to #881. Production fix: #1061.

Extend the lost-response regression through authoritative claim
observation and terminal restart. Assert the recovered payment completes
once without duplicate funding or recovery side effects.

Also replay an authoritative funding miss after restart to prove the
negative control remains terminal.

(cherry picked from commit 739de3f)
Project the reported incident shape through the real activity store and
daemon balance adapter. Assert a completed pay produces one terminal
event, the activity amount matches the VTXO debit, and a failed negative
control does not alter balance.

(cherry picked from commit 7687a18)
Exercise activity replay through the startup backfill and remove a fake
balance comparison that only restated its fixture. Bound terminal reload
waits and use txid-shaped identities.

(cherry picked from commit 76e0c14)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant