Unlock lost splice inputs at startup

LDK only persists a splice once its negotiation reaches
AwaitingSignatures, so a splice in flight when the node stops can leave
no trace in LDK's channel state, and no event of LDK's ever returns what
the wallet reserved for it — today the addresses its outputs pay; once
#1037 locks a contribution's inputs in the wallet, those too, forever.
At startup, reconcile each persisted splice intent against live channel
state: release the reservations of a splice LDK no longer holds and drop
its record, re-anchor a queued splice whose predecessor locked while the
node was down, and keep — minus any inputs no surviving round still
claims — those LDK resumes on its own. A splice whose channel closed
meanwhile is released only if no round of it reached signing: a signed
round is one the channel's monitor watches until the close matures, and
what it reserved is spent by it or returned through DiscardFunding then.
Reconciliation holds the lock that serializes splice submissions, as
the event handlers settling intents do.

Recovery fabricates no failure event for a splice lost this way: the
initiating call already returned, and the channel simply no longer
shows a pending splice. LDK itself reports the loss of a contribution
it was still queueing or negotiating when it was last persisted — it
fails the contribution as it is written and replays the failure at
startup. The replay runs after reconciliation, so that report carries
the splice's parameters only where reconciliation kept the intent: for
a splice queued behind a pending one of ours, or a fee bump of one, but
not for a channel's only splice, whose intent reconciliation settled.

Reconciliation runs before background syncing and broadcasting start,
so nothing can act on the stale reservations first. Events LDK replays
from its last persisted state (e.g. a DiscardFunding for a splice that
died before the node stopped) are likewise consumed before the node is
running, so they cannot act on state a new user operation set up since.

Developed with assistance from Claude Code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: jkczyz

src/channel/mod.rs

@@ -17,13 +17,13 @@ use bitcoin::transaction::Version;
 use bitcoin::{OutPoint, ScriptBuf, Transaction, TxIn, TxOut, Txid};
 use lightning::chain::chaininterface::FundingCandidate;
 use lightning::chain::transaction::OutPoint as LdkOutPoint;
-use lightning::ln::channel_state::{ChannelDetails, SpliceCandidateDetails};
+use lightning::ln::channel_state::{ChannelDetails, SpliceCandidateDetails, SpliceCandidateStatus};
 use lightning::ln::channelmanager::PaymentId;
 use lightning::ln::funding::FundingContribution;
 use lightning::ln::types::ChannelId;
 
 use crate::data_store::StorableObject;
-use crate::logger::{log_error, LdkLogger, Logger};
+use crate::logger::{log_error, log_info, LdkLogger, Logger};
 use crate::payment::pending_payment_store::{
 	PendingPaymentDetails, PendingPaymentDetailsUpdate, SpliceIntent, SpliceKind,
 };
@@ -56,21 +56,23 @@ pub(crate) fn is_same_splice(a: &FundingContribution, b: &FundingContribution) -
 ///
 /// The intent is written before the contribution is handed to LDK, undone when LDK rejects the
 /// hand-off synchronously, and cleared once the splice locks, its failure is surfaced, or its
-/// channel closes. The record exists for recovery, not retry: a splice still recorded at the
-/// next startup identifies one that was in flight when the node stopped, so anything it reserved
-/// can be released, and events about the splice can be described in terms of the original
-/// request. Each splice has a record of its own — a channel may carry several, a pending splice
-/// and the splices queued behind it — so that each is recognized and described whatever became
-/// of the others; only a fee bump joins the record of the round it replaces.
+/// channel closes. The record exists for recovery, not retry: a splice still recorded at the next
+/// startup identifies one that was in flight when the node stopped, so [`Self::reconcile`] can
+/// release what it still reserves where nothing else will, and events about the splice can be
+/// described in terms of the original request. Each splice has a record of its own — a channel may
+/// carry several, a pending splice and the splices queued behind it — so that each is recognized
+/// and described whatever became of the others; only a fee bump joins the record of the round it
+/// replaces.
 pub(crate) struct SpliceTracker {
 	channel_manager: Arc<ChannelManager>,
 	wallet: Arc<Wallet>,
 	pending_payment_store: Arc<PendingPaymentStore>,
 	/// Serializes everything that reads or settles a channel's intent records against
 	/// [`Self::submit`]'s read-funding, persist and hand-off sequence: the settling of intents by
 	/// [`Self::on_negotiation_failed`], [`Self::on_channel_ready`] and
-	/// [`Self::on_channel_closed`], and the funding record [`Self::on_funding_ready_for_signing`]
-	/// files under an intent's id. Without it, the failure event of a synchronously rejected
+	/// [`Self::on_channel_closed`], the funding record [`Self::on_funding_ready_for_signing`]
+	/// files under an intent's id, and the startup pass of [`Self::reconcile`]. Without it, the
+	/// failure event of a synchronously rejected
 	/// hand-off could settle the just-written intent while `submit` is still deciding whether to
 	/// keep it, and a lock event handled between `submit`'s funding read and its persist could
 	/// leave the new intent anchored at a funding the channel has moved past, which nothing would
@@ -96,6 +98,127 @@ impl SpliceTracker {
 		}
 	}
 
+	/// Reconciles the persisted splice intents against live channel state, releasing whatever the
+	/// wallet still holds for a splice that did not survive the restart and nothing else will
+	/// release. LDK only persists a splice once its negotiation reaches `AwaitingSignatures`, so a
+	/// splice lost earlier leaves no trace in LDK's channel state — the intent record is what
+	/// recognizes the loss. A round LDK did write is another matter: LDK either still holds it, or
+	/// failed it as it was last written — the failure is replayed at startup — and returns what it
+	/// reserved through `DiscardFunding`; a round of a channel that closed meanwhile is watched by
+	/// the channel's monitor until the close matures. Such rounds are left to those events. Run
+	/// once at startup, before background chain syncing and event processing start, so nothing can
+	/// act on the stale reservations first. Holds the submit lock throughout, as the event handlers
+	/// do.
+	///
+	/// Recovery fabricates no failure event for a splice lost this way: the initiating call
+	/// already returned and the channel simply shows no pending splice anymore. LDK itself may
+	/// report the loss — a contribution it was still queueing or negotiating when it was last
+	/// persisted is failed as it is written, and the failure replayed at startup. That replay
+	/// runs after this reconciliation, so the report carries the splice's parameters only if
+	/// `decide_reconcile` kept the intent: a splice queued behind a pending one of ours, or a fee
+	/// bump of one, is reported with its parameters; a channel's only splice, whose intent
+	/// settled here, without them.
+	pub(crate) async fn reconcile(&self) {
+		let guard = self.submit_lock.lock().await;
+		let records = self.pending_payment_store.list_filter(|p| p.splice_intent().is_some()).await;
+		for record in records {
+			let payment_id = record.id();
+			let Some(intent) = record.splice_intent().cloned() else {
+				continue;
+			};
+
+			let channel = self.channel(intent.counterparty_node_id, intent.channel_id);
+			let Some(channel) = channel else {
+				// The channel is gone; there is nothing to splice anymore. What the wallet holds
+				// for the intent is released only while no recorded round exists: a round the
+				// closed channel's monitor watches is either spent by the close or returned through
+				// the `DiscardFunding` event the monitor queues once the close matures, and a
+				// recorded round the monitor never watched — the counterparty's `commitment_signed`
+				// never arrived before the node stopped — is released by neither, as at
+				// `ChannelClosed`. A bare intent has no such round — LDK never wrote the splice —
+				// so nothing else would release it.
+				log_info!(
+					self.logger,
+					"Dropping the recorded splice of closed channel {} with counterparty {}",
+					intent.channel_id,
+					intent.counterparty_node_id,
+				);
+				if record.candidates().is_empty() {
+					self.release_contribution(intent.channel_id, &intent.contribution, &[], None)
+						.await;
+				}
+				// TODO(#1037): once inputs are locked at coin selection, the parts of the
+				// contribution no recorded round uses stay locked with no record to release them
+				// from after the intent is cleared here: release them before clearing. And
+				// `release_contribution` swallows a failed release, which then leaves locks no
+				// record names either: keep the intent when the release fails. The same holds for a
+				// recorded round the monitor never watched: nothing releases its inputs once the
+				// intent is cleared here.
+				self.clear_persisted_intent(payment_id, |i| *i == intent).await;
+				continue;
+			};
+
+			if channel.funding_txo != Some(intent.pre_splice_funding_txo) {
+				// The funding moved on while the node was down: the recorded splice, a
+				// replacement, or a counterparty splice locked — the same situation a live lock
+				// event resolves, so resolve it the same way.
+				if let Some(funding_txo) = channel.funding_txo {
+					self.settle_superseded_intents_locked(
+						&guard,
+						intent.counterparty_node_id,
+						intent.channel_id,
+						funding_txo.into_bitcoin_outpoint(),
+						Some(&channel),
+					)
+					.await;
+				}
+				continue;
+			}
+
+			let candidates = channel
+				.splice_details
+				.as_ref()
+				.map(|details| details.candidates.as_slice())
+				.unwrap_or(&[]);
+			match decide_reconcile(candidates) {
+				ReconcileDecision::Keep => {
+					// A kept record may still reserve more than LDK's surviving rounds use —
+					// extras a fee bump lost with the restart had reserved. Release the
+					// difference.
+					let extras = unclaimed_inputs(&intent.contribution, candidates);
+					if let Err(e) = self.wallet.unlock_outpoints(&extras).await {
+						log_error!(
+							self.logger,
+							"Failed to release unused splice inputs on channel {}: {}",
+							intent.channel_id,
+							e,
+						);
+					}
+				},
+				ReconcileDecision::Lost => {
+					log_info!(
+						self.logger,
+						"Dropping a splice on channel {} with counterparty {} that did not survive \
+						the restart",
+						intent.channel_id,
+						intent.counterparty_node_id,
+					);
+					self.release_contribution(
+						intent.channel_id,
+						&intent.contribution,
+						candidates,
+						None,
+					)
+					.await;
+					// TODO(#1037): `release_contribution` swallows a failed release. Once inputs
+					// are locked at coin selection, a failure here leaves locks no record names
+					// after the intent is cleared: keep the intent when the release fails.
+					self.clear_persisted_intent(payment_id, |i| *i == intent).await;
+				},
+			}
+		}
+	}
+
 	/// Persists a user-initiated splice as an intent and hands its contribution to
 	/// [`ChannelManager::funding_contributed`]. The intent — and any wallet state staged on the
 	/// splice's behalf — is durable before the hand-off, so no splice is ever in flight without a
@@ -478,8 +601,10 @@ impl SpliceTracker {
 	}
 
 	/// Settles any persisted intent made obsolete by the channel's funding having moved on to
-	/// `funding_txo`: the funding a `ChannelReady` event reports as locked, or the one a new
-	/// splice builds on ([`Self::submit`]). Each of the channel's intents is decided on its own
+	/// `funding_txo`: the funding a `ChannelReady` event reports as locked, the one a new splice
+	/// builds on ([`Self::submit`]), or the one [`Self::reconcile`] finds the channel at after a
+	/// funding moved while the node was down — the same situation, minus the event. Each of the
+	/// channel's intents is decided on its own
 	/// ([`decide_on_lock`]), against the splice candidates LDK holds for the channel (`channel`,
 	/// as the caller listed it): one whose pre-splice outpoint is that funding was created after
 	/// the lock and stays; one LDK still holds as a queued splice candidate is re-anchored to the
@@ -890,6 +1015,52 @@ fn record_with_intent_cleared(existing: &PendingPaymentDetails) -> Option<Pendin
 	}
 }
 
+/// What [`SpliceTracker::reconcile`] should do with a persisted intent whose channel and funding
+/// are unchanged, decided from the splice rounds LDK reports on the channel.
+#[derive(Debug, PartialEq, Eq)]
+enum ReconcileDecision {
+	/// LDK still holds a splice of ours; leave the intent in place until the splice settles.
+	Keep,
+	/// LDK holds no splice of ours: the recorded splice died with the restart, so whatever was
+	/// reserved for it is released and the intent dropped.
+	Lost,
+}
+
+/// Decides the startup action for a persisted intent from the channel's [`SpliceDetails`]
+/// candidates.
+///
+/// [`SpliceDetails`]: lightning::ln::channel_state::SpliceDetails
+fn decide_reconcile(candidates: &[SpliceCandidateDetails]) -> ReconcileDecision {
+	// A round short of `Negotiated` is one LDK still drives on its own: only `AwaitingSignatures`
+	// survives a restart, and LDK resumes the signature exchange itself on reconnect.
+	let in_flight = candidates
+		.iter()
+		.any(|candidate| !matches!(candidate.status, SpliceCandidateStatus::Negotiated { .. }));
+	if in_flight {
+		return ReconcileDecision::Keep;
+	}
+
+	// LDK persists a splice once negotiated, so a negotiated candidate carrying a local
+	// contribution is a splice of ours LDK sees through to lock — even one negotiated at a
+	// different feerate than a recorded fee bump asked for. Without one, only counterparty
+	// rounds (or nothing) survived: the recorded splice is gone.
+	if candidates.iter().any(|candidate| candidate.contribution.is_some()) {
+		ReconcileDecision::Keep
+	} else {
+		ReconcileDecision::Lost
+	}
+}
+
+/// The inputs `contribution` reserved that no candidate's own contribution still claims — extras
+/// a splice attempt lost with the restart had reserved. A counterparty-only round carries no
+/// contribution and claims nothing.
+fn unclaimed_inputs(
+	contribution: &FundingContribution, candidates: &[SpliceCandidateDetails],
+) -> Vec<OutPoint> {
+	let claimants = candidates.iter().filter_map(|candidate| candidate.contribution.as_ref());
+	unclaimed_parts(contribution, claimants).0
+}
+
 #[cfg(test)]
 mod tests {
 	use std::str::FromStr;
@@ -900,8 +1071,8 @@ mod tests {
 	use super::*;
 	use crate::payment::pending_payment_store::{
 		test_funding_contribution, test_funding_contribution_with_feerate,
-		test_funding_contribution_with_outputs, test_funding_contribution_with_parts,
-		FundingTxCandidate,
+		test_funding_contribution_with_inputs, test_funding_contribution_with_outputs,
+		test_funding_contribution_with_parts, FundingTxCandidate,
 	};
 	use crate::payment::store::{ConfirmationStatus, PaymentDetails, PaymentKind};
 	use crate::payment::{PaymentDirection, PaymentStatus};
@@ -1333,4 +1504,77 @@ mod tests {
 			(prevtxs.iter().map(outpoint).collect(), vec![splice_out, change(20_000)])
 		);
 	}
+
+	/// While any round is short of `Negotiated`, LDK drives the splice itself; the intent stays
+	/// in place until the splice settles.
+	#[test]
+	fn reconcile_keeps_the_intent_while_ldk_drives_a_round() {
+		let in_flight = SpliceCandidateDetails {
+			contribution: Some(test_funding_contribution()),
+			status: SpliceCandidateStatus::AwaitingSignatures {
+				is_initiator: true,
+				funding_feerate_sat_per_1000_weight: 253,
+				new_channel_value_satoshis: 100_000,
+				txid: Txid::from_byte_array([9u8; 32]),
+			},
+		};
+		assert_eq!(decide_reconcile(&[in_flight]), ReconcileDecision::Keep);
+	}
+
+	/// A negotiated candidate carrying a local contribution is a splice LDK sees through to lock;
+	/// nothing was lost. This holds on zero-conf channels too, where the pre-splice funding
+	/// outpoint has not moved on yet.
+	#[test]
+	fn reconcile_trusts_a_negotiated_contribution() {
+		let negotiated = [negotiated_candidate(Some(test_funding_contribution()))];
+		assert_eq!(decide_reconcile(&negotiated), ReconcileDecision::Keep);
+	}
+
+	/// A fee bump that only survives as a candidate negotiated at a lower feerate than requested
+	/// is not lost: the recorded bump is moot, but the splice lives on and locks. The old
+	/// higher-feerate attempt's extra reservations are released through the input difference, not
+	/// by dropping the record.
+	#[test]
+	fn reconcile_keeps_a_bump_negotiated_at_a_lower_feerate() {
+		let lower = [negotiated_candidate(Some(test_funding_contribution_with_feerate(253)))];
+		assert_eq!(decide_reconcile(&lower), ReconcileDecision::Keep);
+	}
+
+	/// With no contribution of ours in LDK — no splice at all, or only a counterparty round — the
+	/// recorded splice died with the restart.
+	#[test]
+	fn reconcile_finds_the_splice_lost_when_ldk_holds_no_contribution() {
+		assert_eq!(decide_reconcile(&[]), ReconcileDecision::Lost);
+		let counterparty_only = [negotiated_candidate(None)];
+		assert_eq!(decide_reconcile(&counterparty_only), ReconcileDecision::Lost);
+	}
+
+	/// The inputs a kept record reserves beyond what LDK's candidates still claim are identified
+	/// for release; a counterparty-only round claims nothing and must not suppress the
+	/// difference.
+	#[test]
+	fn unclaimed_inputs_are_those_no_candidate_contribution_uses() {
+		let prevtxs: Vec<Transaction> = (1u8..=3).map(test_prevtx).collect();
+		let outpoint = |tx: &Transaction| OutPoint { txid: tx.compute_txid(), vout: 0 };
+		let recorded = test_funding_contribution_with_inputs(253, &prevtxs);
+
+		// Every input still claimed by a surviving candidate: nothing to release.
+		let all =
+			[negotiated_candidate(Some(test_funding_contribution_with_inputs(253, &prevtxs)))];
+		assert!(unclaimed_inputs(&recorded, &all).is_empty());
+
+		// A candidate claiming two of the three inputs: the third is released, even with a
+		// counterparty-only round alongside.
+		let partial = [
+			negotiated_candidate(None),
+			negotiated_candidate(Some(test_funding_contribution_with_inputs(253, &prevtxs[..2]))),
+		];
+		assert_eq!(unclaimed_inputs(&recorded, &partial), vec![outpoint(&prevtxs[2])]);
+
+		// No candidates at all: everything is released.
+		assert_eq!(
+			unclaimed_inputs(&recorded, &[]),
+			prevtxs.iter().map(outpoint).collect::<Vec<_>>()
+		);
+	}
 }