fix: bound pending recovery and reclaim rejected settlement state #26

Merged

thesimplekid merged 1 commit from fix/pending-resources into main 2026-10-09 16:38:16 +00:00

Conversation 0 Commits 1 Files changed 16 +963 -68

thesimplekid commented 2026-10-09 16:37:26 +00:00

Owner

Copy link

Distinct unverified Cashu submissions could grow durable pending work without limit, and pre-melt rejection removed only the pending marker while leaving settlement ownership and source-wallet storage behind.

Enforce atomic limits of 1,024 pending submissions globally and eight per intent, preserving existing retries at capacity. Persist a round-robin recovery cursor and bound each Cashu recovery pass to eight attempts and 30 seconds. Durably checkpoint cleanup before deleting rejected source-wallet seeds/databases and atomically removing settlement and unused hold records. Add an idempotent discard hook for caller-owned source wallets.

Retain started melts and change-recovery state. Uncollected Cashu destination quotes keep a bounded cleanup reservation because their invoices may receive late payments; recovery collects those funds without granting a receipt. Cap uncollected receiving-wallet quotes, including orphaned responses, at 1,024.

Depends on #25. Addresses the two Medium resource-exhaustion findings supplied in review; these findings have no separate repository issue.

Validation: admission races and restart, original-token retries at capacity, cleanup interruption, managed/provider file removal, manual hold reuse, orphaned quote capacity, and late-fund collection regressions passed. All 78 tests, formatting, Clippy, docs, cargo-deny, native Nix checks, and real Bitcoin/LDK regtest passed. Custom PaymentStore implementations must add the recovery/cleanup operations, and source providers must implement discard().

Distinct unverified Cashu submissions could grow durable pending work without limit, and pre-melt rejection removed only the pending marker while leaving settlement ownership and source-wallet storage behind. Enforce atomic limits of 1,024 pending submissions globally and eight per intent, preserving existing retries at capacity. Persist a round-robin recovery cursor and bound each Cashu recovery pass to eight attempts and 30 seconds. Durably checkpoint cleanup before deleting rejected source-wallet seeds/databases and atomically removing settlement and unused hold records. Add an idempotent discard hook for caller-owned source wallets. Retain started melts and change-recovery state. Uncollected Cashu destination quotes keep a bounded cleanup reservation because their invoices may receive late payments; recovery collects those funds without granting a receipt. Cap uncollected receiving-wallet quotes, including orphaned responses, at 1,024. Depends on #25. Addresses the two Medium resource-exhaustion findings supplied in review; these findings have no separate repository issue. Validation: admission races and restart, original-token retries at capacity, cleanup interruption, managed/provider file removal, manual hold reuse, orphaned quote capacity, and late-fund collection regressions passed. All 78 tests, formatting, Clippy, docs, cargo-deny, native Nix checks, and real Bitcoin/LDK regtest passed. Custom PaymentStore implementations must add the recovery/cleanup operations, and source providers must implement discard().

thesimplekid added 1 commit 2026-10-09 16:37:26 +00:00

fix: bound pending recovery and reclaim rejected settlement state ... 810eb4cca4

Cap new Cashu reservations globally and per intent, preserving existing retries.
Rotate recovery through a durable cursor with bounded attempts and elapsed time.

Checkpoint pre-melt cleanup before deleting isolated source wallet storage,
then remove settlement ownership and unused hold records atomically. Add an
idempotent cleanup hook for caller-owned wallets. Preserve started melts and
uncollected destination quotes, and bound orphaned receiving-wallet quotes.

Cover admission races, restart, cleanup interruption, provider storage, manual
hold reuse, quote capacity, and collection of late funds without receipts.

thesimplekid changed target branch from feat/mint-l402 to main 2026-10-09 16:38:15 +00:00

thesimplekid merged commit 810eb4cca4 into main 2026-10-09 16:38:16 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

thesimplekid/satsettle!26

No description provided.