Create a fresh static address for partial-withdrawal change. Keep all
withdrawal outputs in the PSBT without separate signing metadata, while
preserving full-withdrawal behavior.
Create a fresh static change address for fractional loop-ins and persist
its key locator with the selected HTLC outpoint. Recovery reconstructs
the same change output instead of returning funds to the legacy root
address.
Join each selected deposit with its persisted static-address row during
loop-in recovery. Hydrate legacy rows as needed so restored swaps retain
the scripts and key locators required for signing.
Include the derivation key for every withdrawal input in the server
request. This lets the server validate and sign withdrawals that combine
deposits from multiple derived addresses.
Map every selected outpoint to the client key that derived its static
address and include those proofs in loop-in requests. Keep MuSig2
signing indexed by outpoint so request ordering cannot select the wrong
key.
Construct cooperative MuSig2 sessions from the address parameters stored
on each deposit. Loop-ins and withdrawals can therefore combine inputs
owned by different derived static addresses.
Build timeout sweeps from each deposit own script, expiry, and key
locator. Derived-address deposits can now use their unilateral recovery
path without falling back to the legacy root parameters.
Filter wallet UTXOs against every active static-address script and
attach the matching address parameters to new deposits. This makes
deposits to derived receive addresses visible to the deposit manager.
Create receive and change addresses from locally derived client keys
while reusing the server key and expiry from the legacy seed. Import,
persist, and activate each script before returning it to callers.
Associate every deposit with the static address parameters that created
it. This lets restored deposits recover the correct script and signing
keys instead of assuming the legacy root address.
Keep the loop-in monitor in its recoverable state when a required deposit transition or unlock fails. Only advance after every selected deposit reaches the expected state, and retry only deposits that remain pending after a partial transition.
Preserve shutdown semantics when observer cancellation races with a completed deposit update, and add regression coverage for transition, partial-transition, and unlock failures.
Record replayed server risk decisions through the loop-in store,
recover accepted payment-deadline timers using the persisted decision
time, and handle persisted rejections on restart. This lets recovered
static loop-ins keep pending confirmation-risk state instead of
restarting payment timing from scratch.
Track whether the invoice was canceled for non-payment while monitoring
the HTLC. If the HTLC never confirms before timeout, unlock the
deposits; if it did confirm, transition them to the HTLC-timeout sweep
state without issuing duplicate transitions.
Add schema, sqlc queries, store fields, and SqlStore support for
recording server confirmation-risk decisions with static loop-in swaps.
Store the decision timestamp so payment-deadline recovery can
reconstruct elapsed time after restart.
Subscribe to static loop-in confirmation-risk notifications before
starting the payment deadline. Start that deadline only after server
acceptance or the legacy confirmation fallback, and cancel the swap
invoice when the server rejects the risk wait. Refresh selected
deposits before the legacy fallback so recovered monitors use current
confirmation heights.
Check the originally selected deposit outpoints before signing a static
loop-in HTLC transaction. If any selected outpoint is no longer
available, cancel the swap invoice and fail the signing action instead
of producing signatures for stale inputs.
Refresh the active static-address deposit set against lnd's wallet view
before quote, loop-in, withdrawal, channel-open, and autoloop selection
paths. This prevents stale persisted Deposited records from being
selected after replacement, reorg, or an external spend.
Use the shared deposit-expiry helper when building autoloop DP
candidates so unconfirmed deposits do not look like the
earliest-expiring options.
This keeps the no-change selector's expiry tie-break aligned with the
generic loop-in deposit selection rules.
Static address deposits with no confirmation height have not started
their CSV timeout yet, so keep them eligible for loop-in selection
instead of treating them as already near expiry. Prefer confirmed
deposits before unconfirmed ones during automatic selection, and share
the remaining-lifetime calculation used by the selector.
Deposited can now include mempool outputs for static loop-ins, but
withdrawals and static channel opens still require confirmed funding
inputs. Filter automatic channel-open selection to confirmed deposits
and reject explicit unconfirmed selections, including withdraw-all
requests that would otherwise silently include mempool deposits.
Treat lnd's wallet view as the source of spendable static-address
outpoints while keeping historical deposit records in the DB. Reconcile
active FSMs against the current wallet view, reactivate known deposits
that reappear, and hide stale Deposited records from the visible
deposit set.
The first block epoch is consumed before recovered deposit FSMs exist.
Replay that startup height after recovery so already-expired deposits
can run expiry handling immediately after restart.
Retain static-address deposits as soon as lnd reports the UTXO, even
when the output is still unconfirmed. Store the first confirmation
height once the output confirms.
Derive confirmation heights from the current wallet view because lnd
reports confirmation counts instead of first-confirmation heights.
Before we send HTLC signatures to the server, the server cannot publish
the HTLC transaction. After those signatures are handed over, the server
can publish an HTLC that spends the selected deposits even if it never
pays the swap invoice.
Defend against stale local deposit state by checking the wallet's current
txout view immediately before signing. A deposit can have been spent by a
known withdrawal, channel open, timeout sweep, replacement, or another
wallet transaction while the loop-in FSM is recovering or while earlier
state still marked it as selected.
Failing before signing leaves the server without spend authority over an
unavailable input. Include mempool spends in the check so wallet-known
unconfirmed spends are treated as unavailable too.
Recovered loop-ins carry two outpoint views. DepositOutpoints is the
immutable swap input snapshot sent to the server and used to validate
sweep requests. Deposits comes from the store's swap_hash/deposit-id
join and reflects the current deposit rows.
The active-deposit lookup takes a detour through the reconstructed
deposit rows before asking the deposit manager for active deposits.
That keeps recovery from depending on the historical input snapshot.
A future replacement path can RBF a deposit from its original funding
outpoint to a replacement outpoint while the swap still needs to retain
the original input list. Looking up active deposits by DepositOutpoints
would then fail recovery even though the store still maps the correct
deposit IDs to the swap hash.
Keep list responses on the store reconstruction too, so they do not
re-resolve deposits through historical outpoints.
After the client gives the server HTLC signatures, shutdown must not drive the monitor state through the generic error path. That path cancels the invoice and attempts to unlock deposits even though the server can still publish the HTLC.
Return NoOp for monitor-state cancellation races and cover shutdown with a regression test that asserts no invoice cancellation or deposit unlock occurs.
A shutdown while publishing or monitoring the HTLC timeout sweep should not
transition the loop-in to Failed.
Return NoOp on context cancellation in those actions so the persisted
state remains a recovery point. Add focused tests for shutdown during
publication retry and confirmation monitoring.
Document deposit lock ownership for mutable confirmation state and
route production reads through deposit accessors.
Keep store persistence on no-lock helpers while callers hold the
deposit lock, preserving the existing transition behavior without
leaving direct field reads in user-facing paths.
A block notification can queue OnExpiry before a deposit reaches a final
state. If the final transition wins that race first, the stale expiry event
must not overwrite the terminal outcome.
Keep LoopedIn and Withdrawn as self-loops on OnExpiry, matching the other
final states. Add a focused FSM test that sends OnExpiry directly to each
final state and verifies the state is preserved.
Add a duration helper that falls back to the default payment timeout.
Recovered legacy swaps can have a zero persisted timeout, so later
deadline logic can use this without treating zero as immediate expiry.
Reject nil deposits and final-state deposits before sending FSM
events.
This keeps callers from transitioning stale or completed deposits and
uses the no-lock state helper while deposits are already locked.
Guard reconcileDeposits with a dedicated mutex.
Polling and block-driven reconciliation can overlap, so serialize the
path before it updates confirmation data and active FSM state.
Move active-deposit block notification fan-out into a helper.
This keeps the event loop small and gives later startup replay logic
a single path for notifying recovered deposit FSMs.
Document the lock-order invariant between Manager.mu and individual
deposit locks.
Later changes need both locks in the same path, so make the rule
explicit before the locking surface grows.
Add a TxOutChecker interface for checking whether a selected deposit
outpoint is still available before signing the HTLC transaction.
Back the implementation with lnd wallet transaction data so known
confirmed and mempool spends mark the outpoint unavailable.
Store an independent snapshot of the outpoints selected for a
static loop-in.
Recovered swaps remain tied to the original funding outputs even if
deposit records later change confirmation or replacement metadata.
Avoid decoding an empty database outpoint string as a synthetic
outpoint.
Add an explicit Stop method for deposit FSM block-notification
loops.
Call it when the manager removes a finalized active deposit so stale
FSM goroutines stop consuming block updates.
Treat closed invoice update channels as terminal for the monitor loop.
This avoids spinning when lnd closes the subscription after invoice cancellation or shutdown.
Reject duplicate static-address deposit outpoints before creating
withdrawal, loop-in, or channel-open requests.
Use the shared outpoint duplicate helper so each flow reports the
same input validation failure.
Return early when block notifications reach deposits that already
moved into a terminal state.
This prevents final deposits from retrying expiry handling after
recovery or while their FSM is still draining block updates.
Keep deposits locked when the server publishes the loop-in HTLC
without paying the invoice.
This lets the client sweep through the HTLC timeout path instead
of making the same outputs available for another action.
