davideandClaude Sonnet 5.5
a4b160e240
reconcile_once abandoned a row when the *active* server's history lacked its txid:
after 120s for `building` (which a restart onto a different server makes likely),
after 6h for `pending`, and all at once after a forward clock jump. It re-checked the
status but not the txid, so it raced the bumper, and a `failed` row was never looked at
again.
- The reconciler asks every server (ElectrumListener.get_histories, active + others) for
the history of the row's address and looks for every txid of the row. Present on any
server -> promoted (adopting the version found). Absent is only "no server of the
quorum knows it" and needs the active server plus the quorum minimum of the others to
have answered; even then nothing is released without proof:
(a) an input spent in a block by a transaction that is none of the row's versions,
agreed by a strict majority of a quorum of the other servers (confirmed_spender), or
(b) a rebroadcast of the latest raw tx to every server (rebroadcast_everywhere)
refused by all of them, explicitly, for missing/spent inputs.
Accepted or "already known" by any server means alive; a fee refusal is not proof
(`building` -> `pending` for the bumper, `pending` untouched); too few answers or
anything else leaves the row alone. failure_reason names the proof.
- The write re-reads status *and* current_txid under begin_immediate (TX-26).
- pending_transactions.failed_at (set by _abandon and _release_failed_withdrawal) starts
a 14-day watch: a failed row that a majority of the other servers (at least the quorum
minimum) list in a block becomes `confirmed`, writes pending_tx_resurrected once and
pauses the lottery with paused_reason `resurrected_tx`; linked rows are not corrected.
The confirmation is by quorum of histories for now; merkle proofs come with B-83.
- round_config.paused_reason (migration b7d2e41c9a05, with the failed_at one): `operator`
from POST /admin/pause (which accepts an optional `note` and never overwrites an
automatic reason), cleared by resume, which logs the reason it lifted; exposed on
/admin/config and GET /rounds/current. rounds/pause.py:pause_automatically is the
system's way in.
- PendingTransactionReconciler takes the listener as `network`; with none it can promote
but never abandon.
Tests changed because the spec changed: the three reconciler tests that expect an
abandonment (and the one in test_tx_versions) now supply a network that proves the
transaction is gone.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
28 lines
1.0 KiB
Python
28 lines
1.0 KiB
Python
"""What a question put to every server came back with (B-78).
|
|
|
|
`active` is the answer of the connection the platform is running on, `others` those of
|
|
each other configured server in configuration order; `None` stands for "no usable
|
|
answer" (unreachable, timed out, an error that is not an answer)."""
|
|
|
|
from typing import NamedTuple
|
|
|
|
|
|
class ServerAnswers(NamedTuple):
|
|
active: object | None
|
|
others: tuple
|
|
others_needed: int # how many of `others` must have answered for the network to count
|
|
|
|
@property
|
|
def answered_others(self) -> list:
|
|
return [answer for answer in self.others if answer is not None]
|
|
|
|
@property
|
|
def complete(self) -> bool:
|
|
"""Enough of the network answered for its silence to mean something: the active
|
|
server and at least `others_needed` of the others."""
|
|
return self.active is not None and len(self.answered_others) >= self.others_needed
|
|
|
|
@property
|
|
def all(self) -> list:
|
|
return ([] if self.active is None else [self.active]) + self.answered_others
|