f - Recreate a missing pending index while the payment is still Pending

Classification treated an absent pending entry as proof the payment had
graduated and only merged into existing entries. But a crash or failed
write between the payment-store and pending-store writes leaves a Pending
record with no index entry, and that state was never repaired: the payment
could no longer graduate (graduation iterates the pending store) and its
candidate txids could no longer be mapped back to the record, which for an
RBF splice invites a duplicate generic payment. Decide by the post-write
payment status instead: while the record is still Pending, insert the
missing entry (embedding the post-write record, so a confirmation wallet
sync already mirrored keeps driving graduation); once it advanced beyond
Pending, keep treating absence as graduated. A graduated payment is never
Pending, so the no-reindex rule is preserved by the status gate itself.

The repaired state is not constructible in a test: it requires a failure
injected between the two store writes, and no such seam exists. The store
primitives the decision rests on are unit-tested.

Generated with assistance from Claude Code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jkczyz

src/wallet/mod.rs

@@ -54,7 +54,6 @@ use lightning_invoice::RawBolt11Invoice;
 use persist::KVStoreWalletPersister;
 
 use crate::config::Config;
-use crate::data_store::DataStoreUpdateOrInsertResult;
 use crate::fee_estimator::{ConfirmationTarget, FeeEstimator, OnchainFeeEstimator};
 use crate::logger::{log_debug, log_error, log_info, log_trace, LdkLogger, Logger};
 use crate::payment::pending_payment_store::PendingPaymentDetailsUpdate;
@@ -1419,24 +1418,27 @@ impl Wallet {
 			conflicting_txids: None,
 			candidates: candidates.clone(),
 		};
-		match self.payment_store.update_or_insert(update, details.clone()).await? {
-			DataStoreUpdateOrInsertResult::Inserted => {
-				// First time we record this funding payment: index it for graduation. Wallet sync
-				// can still land between the payment-store write above and this one and mirror an
-				// advanced confirmation into the pending store, so this write makes the same
-				// atomic decision: merge narrowly into an entry that appeared, insert the fresh
-				// one otherwise.
-				let pending = PendingPaymentDetails::new(details, Vec::new(), candidates);
-				self.pending_payment_store.update_or_insert(pending_update, pending).await?;
-			},
-			DataStoreUpdateOrInsertResult::Updated | DataStoreUpdateOrInsertResult::Unchanged => {
-				// An earlier candidate or a racing wallet sync already recorded this payment.
-				// `update` is a no-op when the pending entry is absent, so the index is not
-				// re-created for a payment the graduation path already removed. (A graduated
-				// payment always has a payment-store record, so it cannot take the `Inserted`
-				// branch above and be re-indexed.)
-				self.pending_payment_store.update(pending_update).await?;
-			},
+		self.payment_store.update_or_insert(update, details.clone()).await?;
+
+		// The pending index must exist exactly while the authoritative record is Pending:
+		// graduation and rebroadcast read it, and a graduated payment must not be re-indexed.
+		// Deciding by the post-write status rather than by whether the write inserted also
+		// repairs a missing index — a crash or failed write between the two stores leaves a
+		// Pending record with no entry, and a merge alone would never recreate it, leaving the
+		// payment unable to graduate and its txids unmapped.
+		let recorded = self.payment_store.get(&details.id).unwrap_or(details);
+		if recorded.status == PaymentStatus::Pending {
+			// Wallet sync can still land between the payment-store write above and this one and
+			// mirror an advanced confirmation into the pending store, so this write makes the
+			// same atomic decision: merge narrowly into an entry that appeared, insert otherwise.
+			// The inserted entry embeds the post-write record rather than the fresh details, so a
+			// confirmation wallet sync already recorded keeps driving graduation.
+			let pending = PendingPaymentDetails::new(recorded, Vec::new(), candidates);
+			self.pending_payment_store.update_or_insert(pending_update, pending).await?;
+		} else {
+			// The payment already advanced beyond Pending: the graduation path removed the
+			// entry, and `update`'s no-op on absence must not re-create it.
+			self.pending_payment_store.update(pending_update).await?;
 		}
 		Ok(())
 	}