A preemptive swap or online send swap that failed after its request may have
reached the mint (timeout, dropped connection, 5xx, or a local error while
handling the response) was rolled back: inputs back to UNSPENT although the mint
may have spent them, and its outputs lost. Such failures now hold the
reservation and queue the interrupted-operation resolver, which asks the mint and
restores the outputs from the recorded counter range. A definitive mint rejection,
or a request that never left, still rolls back as before.
The SEND in-flight replay is removed: every SEND record comes from an online send
swap, which the resolver now owns.
Each lifecycle phase now has exactly one owner:
In-flight replay: a lost response for RECEIVE, TOPUP or TOPUP_ONCHAIN, where no reservation exists.
Resolver: any swap or melt with an unknown outcome, whether the app is still running or was killed.
PENDING sync, refresh() and the pending queue: settlement after the mint has accepted the request.
Startup: rollback of safe reservation types, and revertAbandonedDrafts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
minibits-cashandClaude Opus 5.5
fd68398f3c