Add splice cleanup invariants#4699
Conversation
|
👋 Thanks for assigning @wpaulino as a reviewer! |
|
No new issues found. Both issues I raised in the prior pass are resolved by this revision:
Additional verification this pass:
Standing cross-cutting notes (non-blocking, already raised previously, not re-posted): the |
After tx_abort or SpliceNegotiationFailed, probe splice_channel to ensure stale queued or active negotiation state does not remain. This lets the chanmon consistency harness catch recoverability gaps where an aborted or failed splice still blocks a fresh attempt.
joostjager
force-pushed
the
splice-assert
branch
from
54f80b2 to
bef13fe
Compare
|
Claude's cross-cutting notes might be worth addressing in a follow up #4699 (comment) |
Expose a fuzz-only read-only splice state probe so chanmon consistency can check cleanup paths that the public splice API does not fully surface. Use it after tx_abort and splice failure events to catch queued or active negotiation state on either side while allowing already-negotiated pending splice state. Treat missing peers or channels as clean probe results. Close-related cleanup events may be handled after the channel has already been removed.
joostjager
force-pushed
the
splice-assert
branch
from
f5485c7 to
7789622
Compare
| let dest_idx = log_peer_message(node_idx, node_id, nodes, out, "tx_abort"); | ||
| nodes[dest_idx].handle_tx_abort(source_node_id, msg); | ||
| if let Err(APIError::APIMisuseError { ref err }) = | ||
| nodes[dest_idx].node.splice_channel(&msg.channel_id, &source_node_id) |
There was a problem hiding this comment.
This is a bit brittle at the moment because it's possible for a queued splice to exist prior to processing this event. It seems the new fuzz-only probe is all we need now if we extend assert_no_stale_splice_negotiation to also consider SpliceProbeState::QueuedAction.
|
Can we make #4687 fit the use case here instead? |
4 participants
After tx_abort or SpliceNegotiationFailed, probe splice_channel to ensure stale queued or active negotiation state does not remain.
This lets the chanmon consistency harness catch recoverability gaps where an aborted or failed splice still blocks a fresh attempt.