cdk: transaction method to change a mint quote's unit, so dissolve is one transaction #40

New issue

Open

opened 2026-10-09 21:55:17 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-10-09 21:55:17 +01:00

Collaborator

Primary goals:

One transaction for dissolve — the re-stamp of each quote's unit, the payments in the target unit and the epoch record flip commit together or not at all.
The method lives in cdk, not in hashpool's SQL — a QuotesTransaction method (for example update_mint_quote_unit(quote_id, unit) on the locked Acquired<MintQuote>) implemented in cdk-sql-common for sqlite and postgres, carried on the forge vnprc/cdk branch hashpool pins and offered upstream.
The raw SQL goes away — hashpool's restamp_quotes in roles/mint/src/lib/epoch/mod.rs, which opens a second pool on the mint's sqlite file and runs UPDATE mint_quote SET unit = …, is deleted once the method is available.

Current state and specifics

On the reward-trigger branch (vnprc/hashpool#37) every other hashpool state change is written in the same cdk transaction as the cdk change it pairs with, through the mint database's key-value store. Dissolve is the exception because cdk exposes no way to change a quote's unit: update_mint_quote persists only new payments and issuances. hashpool therefore re-stamps with a direct statement through cdk_sql_common::pool::Pool on the same file, with an affected-row-count check against the quotes counted under the lock, and then opens a cdk transaction to pay and flip. The two steps are ordered so a crash between them is recovered by a retry (the retry re-stamps zero rows and pays), which is correct but is exactly the kind of discipline a transaction makes unnecessary.

Constraints the method must respect: only quotes with amount_paid = 0 AND amount_issued = 0 may change unit (a paid or issued quote is denominated in its unit for good), and the amount column is unit-less in storage so no conversion is needed. A guard in the method for that condition keeps the invariant in cdk rather than in the caller.

Scope

In scope: the trait method, its sqlite and postgres implementations, a cdk test, the forge branch and the upstream pull request alongside cashubtc/cdk#2686, then the hashpool change that uses it and deletes restamp_quotes. Out of scope: anything else about dissolve. The hashpool half depends on vnprc/hashpool#37 landing and on the cdk pin moving to a revision that carries the method.

Part of vnprc/hashpool#13.

Give the mint a way to change a mint quote's currency unit inside a database transaction, so that dissolving a provisional epoch (re-stamp its never-paid quotes onto the previous epoch, pay them, mark the epoch dissolved) is one transaction instead of a raw SQL update followed by a second transaction with crash-recovery ordering. Primary goals: - **One transaction for dissolve** — the re-stamp of each quote's unit, the payments in the target unit and the epoch record flip commit together or not at all. - **The method lives in cdk, not in hashpool's SQL** — a `QuotesTransaction` method (for example `update_mint_quote_unit(quote_id, unit)` on the locked `Acquired<MintQuote>`) implemented in `cdk-sql-common` for sqlite and postgres, carried on the forge `vnprc/cdk` branch hashpool pins and offered upstream. - **The raw SQL goes away** — hashpool's `restamp_quotes` in `roles/mint/src/lib/epoch/mod.rs`, which opens a second pool on the mint's sqlite file and runs `UPDATE mint_quote SET unit = …`, is deleted once the method is available. ### Current state and specifics On the reward-trigger branch (vnprc/hashpool#37) every other hashpool state change is written in the same cdk transaction as the cdk change it pairs with, through the mint database's key-value store. Dissolve is the exception because cdk exposes no way to change a quote's unit: `update_mint_quote` persists only new payments and issuances. hashpool therefore re-stamps with a direct statement through `cdk_sql_common::pool::Pool` on the same file, with an affected-row-count check against the quotes counted under the lock, and then opens a cdk transaction to pay and flip. The two steps are ordered so a crash between them is recovered by a retry (the retry re-stamps zero rows and pays), which is correct but is exactly the kind of discipline a transaction makes unnecessary. Constraints the method must respect: only quotes with `amount_paid = 0 AND amount_issued = 0` may change unit (a paid or issued quote is denominated in its unit for good), and the amount column is unit-less in storage so no conversion is needed. A guard in the method for that condition keeps the invariant in cdk rather than in the caller. ### Scope In scope: the trait method, its sqlite and postgres implementations, a cdk test, the forge branch and the upstream pull request alongside cashubtc/cdk#2686, then the hashpool change that uses it and deletes `restamp_quotes`. Out of scope: anything else about dissolve. The hashpool half depends on vnprc/hashpool#37 landing and on the cdk pin moving to a revision that carries the method. Part of vnprc/hashpool#13.

vnprc-agent referenced this issue

2026-10-09 23:06:46 +01:00

mint: automatic reward trigger with reorg-safe epoch boundaries #37

vnprc-agent referenced this issue

2026-10-11 03:14:22 +01:00

mint: automatic reward trigger with reorg-safe epoch boundaries #41