Adopt the splice-time PaymentId when classifying a splice

A user-initiated splice will be keyed by a PaymentId generated at splice
time rather than derived from a candidate's txid, so its retry intent,
funding payment, and candidate history all share one record. Teach the
classifier to find a pre-broadcast splice intent by its channel and reuse
that id, promoting the intent record to a tracked funding payment while
preserving the intent until the splice locks. Splices we did not originate
(counterparty-initiated or V2 dual-funded opens) keep deriving the id from
the first candidate's txid via a fallback.

Also map any candidate txid back to the record in find_payment_by_txid,
since a splice under a generated id is no longer found by the txid-derived
lookup and an earlier RBF candidate may be the one that confirms. If the
intent is already gone when classification runs, the classifier probes
those same lookups for a record any candidate already created before
minting a txid-derived id, so a racing wallet sync and a late
classification converge on one record.

The pending-store write in persist_funding_payment now happens atomically
with reading the entry's prior state, and promotion of a pre-broadcast
intent is gated on the payment still being Pending: a payment that
confirmed through ANTI_REORG_DELAY before classification must not re-enter
the pending store, which graduation and rebroadcast assume holds only
Pending payments.

No splice intents are created yet, so behavior is unchanged; the splice
entry points that persist them follow.

Generated with assistance from Claude Code.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jkczyz

src/payment/pending_payment_store.rs

@@ -169,6 +169,14 @@ impl PendingPaymentDetails {
 		}
 	}
 
+	/// The splice intent this record carries, if it is a splice that has not yet locked.
+	pub(crate) fn splice_intent(&self) -> Option<&SpliceIntent> {
+		match self {
+			Self::PendingSplice { intent, .. } => Some(intent),
+			Self::Tracked { splice_intent, .. } => splice_intent.as_ref(),
+		}
+	}
+
 	/// Returns this node's recorded funding figures for the candidate with the given txid, if any.
 	pub(crate) fn candidate(&self, txid: Txid) -> Option<&FundingTxCandidate> {
 		match self {

src/wallet/mod.rs

@@ -1266,6 +1266,24 @@ impl Wallet {
 		Ok(())
 	}
 
+	/// Returns the `PaymentId` of a user-initiated splice intent for one of the channels in
+	/// `candidate`, if any, so a classified splice adopts the id chosen at splice time rather than
+	/// deriving one from the first candidate's txid. A fee bump reuses the channel's existing intent,
+	/// so at most one in-flight intent matches and the first is unambiguous.
+	fn find_splice_payment_id(&self, candidate: &FundingCandidate) -> Option<PaymentId> {
+		self.pending_payment_store
+			.list_filter(|p| {
+				p.splice_intent().is_some_and(|intent| {
+					candidate.channels.iter().any(|channel| {
+						channel.channel_id == intent.channel_id
+							&& channel.counterparty_node_id == intent.counterparty_node_id
+					})
+				})
+			})
+			.first()
+			.map(|p| p.id())
+	}
+
 	/// Records an interactive-funding broadcast (splice, or a V2 dual-funded open) as a pending
 	/// on-chain payment, tagged with its transaction type. Amount and fee are this node's share,
 	/// derived from the active candidate's contributions; broadcasts we didn't contribute to, or
@@ -1316,9 +1334,18 @@ impl Wallet {
 			return Ok(());
 		}
 
-		// Anchor the `PaymentId` to the first negotiated candidate so the record stays stable
-		// across RBF replacements.
-		let payment_id = PaymentId(first.txid.to_byte_array());
+		// Adopt the `PaymentId` generated when the splice was initiated so its retry intent, funding
+		// payment, and candidate history share one record. If the intent is already gone (e.g. the
+		// splice locked before this classification ran), adopt the id of a record wallet sync
+		// created for any candidate rather than minting a divergent one. Fall back to the first
+		// negotiated candidate's txid for splices we did not originate (counterparty-initiated or
+		// V2 opens), which keeps that id stable across RBF replacements.
+		let payment_id = self
+			.find_splice_payment_id(active)
+			.or_else(|| {
+				candidates.iter().find_map(|candidate| self.find_payment_by_txid(candidate.txid))
+			})
+			.unwrap_or_else(|| PaymentId(first.txid.to_byte_array()));
 
 		// Record every candidate's figures (`None` for any round we didn't contribute to, e.g. a
 		// counterparty-initiated splice our `splice_in` later joined via RBF) so the confirmed
@@ -1411,35 +1438,57 @@ impl Wallet {
 			&candidates,
 			self.payment_store.get(&details.id).as_ref(),
 		);
-		let pending_update = PendingPaymentDetailsUpdate {
-			id: update.id,
-			payment_update: Some(update.clone()),
-			conflicting_txids: None,
-			candidates: candidates.clone(),
-			splice_intent: None,
-		};
-		self.payment_store.update_or_insert(update, details.clone()).await?;
-
-		// The pending index must exist exactly while the authoritative record is Pending:
-		// graduation and rebroadcast read it, and a graduated payment must not be re-indexed.
-		// Deciding by the post-write status rather than by whether the write inserted also
-		// repairs a missing index — a crash or failed write between the two stores leaves a
-		// Pending record with no entry, and a merge alone would never recreate it, leaving the
-		// payment unable to graduate and its txids unmapped.
+		self.payment_store.update_or_insert(update.clone(), details.clone()).await?;
+
+		// The post-write record decides what the pending index may hold: only `Pending` payments
+		// belong in the pending store (graduation and rebroadcast assume it), and a promoted or
+		// (re)created entry must carry the record wallet sync advanced, not the fresh
+		// Unconfirmed details.
 		let recorded = self.payment_store.get(&details.id).unwrap_or(details);
-		if recorded.status == PaymentStatus::Pending {
-			// Wallet sync can still land between the payment-store write above and this one and
-			// mirror an advanced confirmation into the pending store, so this write makes the
-			// same atomic decision: merge narrowly into an entry that appeared, insert otherwise.
-			// The inserted entry embeds the post-write record rather than the fresh details, so a
-			// confirmation wallet sync already recorded keeps driving graduation.
-			let pending = PendingPaymentDetails::new(recorded, Vec::new(), candidates);
-			self.pending_payment_store.update_or_insert(pending_update, pending).await?;
-		} else {
-			// The payment already advanced beyond Pending: the graduation path removed the
-			// entry, and `update`'s no-op on absence must not re-create it.
-			self.pending_payment_store.update(pending_update).await?;
-		}
+		let id = recorded.id;
+		self.pending_payment_store
+			.mutate(&id, |existing| match existing {
+				// First time we record this funding payment — or a crash between the two store
+				// writes left a Pending record with no index entry: (re)create it so the payment
+				// can graduate and its candidate txids stay mapped. A graduated payment is never
+				// `Pending`, so absence with an advanced record means the graduation path removed
+				// the entry and it must not be re-indexed.
+				None => (recorded.status == PaymentStatus::Pending).then(|| {
+					PendingPaymentDetails::tracked(recorded, Vec::new(), candidates, None)
+				}),
+				// A user-initiated splice has a pre-broadcast `PendingSplice` intent under this
+				// id; carry its intent into the `Tracked` record so the retrier can still clear
+				// it once the splice locks. If the payment already advanced beyond `Pending`
+				// (wallet sync confirmed it through `ANTI_REORG_DELAY` first), it must not enter
+				// the pending store; the intent stays for `ChannelReady` or `reconcile` to clear.
+				Some(PendingPaymentDetails::PendingSplice { intent, .. }) => {
+					if recorded.status == PaymentStatus::Pending {
+						Some(PendingPaymentDetails::tracked(
+							recorded,
+							Vec::new(),
+							candidates,
+							Some(intent.clone()),
+						))
+					} else {
+						None
+					}
+				},
+				// An earlier candidate or a racing wallet sync already recorded this payment:
+				// merge only the classification (`tx_type`, candidate history and the figures of
+				// whichever candidate the record's state makes authoritative) into it.
+				Some(tracked @ PendingPaymentDetails::Tracked { .. }) => {
+					let mut updated = tracked.clone();
+					let pending_update = PendingPaymentDetailsUpdate {
+						id,
+						payment_update: Some(update),
+						conflicting_txids: None,
+						candidates,
+						splice_intent: None,
+					};
+					updated.update(pending_update).then_some(updated)
+				},
+			})
+			.await?;
 		Ok(())
 	}
 
@@ -1549,6 +1598,10 @@ impl Wallet {
 				p.details().is_some_and(
 					|d| matches!(d.kind, PaymentKind::Onchain { txid, .. } if txid == target_txid),
 				) || p.conflicting_txids().contains(&target_txid)
+					// A splice keyed by a generated PaymentId is not found by the txid-derived id
+					// above, so map any of its candidate txids (an earlier RBF round may confirm)
+					// back to the record.
+					|| p.candidate(target_txid).is_some()
 			})
 			.first()
 		{