fix: credits-first buyer mint choice and private settlement parity

[maxie-agent]

Status

Advisor R2 finding 1 is fixed at 4bb84c81beab40d37c7ff61b9e97019b816ce27f; local verification and all eight CI jobs are complete. Free advisor R3 verdict: Approve, no critical/high/medium findings. This PR remains a draft; no merge is authorized. Bob's credits-first decisions are final; no merge is authorized.

Root cause and change

The source selector followed seller order even when the buyer held enough credits. The hop planner could also choose a credit mint, which cannot issue a Lightning mint quote, so some jobs failed only after delivery. Award filtering planned from the default mint rather than the balance-aware source. Private invoice validation additionally rejected an entire claim when any listed mint was not configured by the checker.

• Prefer covering, configured nostr:// balances, then covering HTTPS balances, preserving seller order within each pass and retaining the real-mint fence.
• Skip credit hop destinations and name the seller list in refusals. Manual and auto award share one balance snapshot with the reservation ceiling under money_lock; selection uses net-available balances (excluding this job’s own hold), while reservation enforcement retains raw balances. Balance-read failure is surfaced before mint filtering.
• Separate private mint well-formedness from checker approval. Retain 1..=32 entries, no duplicates, canonical Nostr/HTTPS checks, and length limits.
• Keep the signed claim mint-set comparison and explicitly guard the derived delivery/receipt mint against that signed list before spend and at receipt construction. The request's misleadingly named realized_mint is the funding source, so checking that field for membership would incorrectly reject hops.
• Preserve the complete stored bind on same-result re-accept, including legacy public binds, keeping funding/delivery mints and payment identity fixed.

Cases

C = seller-listed credits, L = seller-listed Lightning mint, X = buyer-default Lightning mint not listed by seller. Enough means net available after other jobs’ live reservations at one configured mint; payments never split.

Seller lists	Buyer holds	Result	Today
C + L (any order)	enough at C and at L	credits, direct	seller's first mint wins
C + L	enough at C only	credits, direct	same
C + L	enough at L only	sats at L, direct	same
C + L	sats at X (default)	hop X→L, buyer pays the fee	C listed first: hop to C, fails after delivery
C + L	some credits (< price) + sats at X	hop X→L, credits untouched	same bug if C first
C + L	not enough anywhere	refused at award (ceiling)	same
C only	enough at C	credits, direct	same
C only	sats only	refused at award	awarded, fails after delivery
L only	at L / at X	direct / hop X→L	same
L only	credits only	refused at award	same
several L + C	sats at X	hop to first https:// in seller order	could hop to C

Pays-once verification

Before changing production code, a valid signed inline payment was run through unchanged authorize_pay_async at 9ba25cd against a real local credit sidecar. It failed at target mint quote: unsupported, before source quote/melt, budget charge, payment journal, or crossmint journal: 1 passed, 0 failed. The permanent regression also exercises the upgraded HTTPS replan. Same-result re-accept is tested against a local relay with newly arrived credits and unchanged attempt identity.

Review fixes (authorized by bob, 2026-10-05 23:47 / 23:50 UTC)

• Advisor F1 / cashu M1: manual award fetches the relay view before money_lock; attempt resolution stays outside the lock, the pinned-attempt re-check remains, and filter/ceiling/reservation share one snapshot under the guard.
• Cashu M2: the single source selector consumes configured balances minus other jobs’ live reservations at each mint. Filter, ceiling and unpinned accept agree; a pin still wins. Raw balances remain the reservation ceiling, avoiding double subtraction by reserve_at.
• Cashu M3, target boundary only: CdkHopEffects::open refuses nostr:// targets before opening either wallet, mirroring source refusal.
• Cashu L4: both award paths surface the balance-snapshot error before credit-hop filtering; a deadline park names the failed read instead of blaming the seller’s mint list.
• Cashu L5: private invoice dedupe canonicalizes mint URLs, including host case and trailing slash; explicit ports are preserved to match existing wallet/reservation identities (R3 correction below). Seller CREQ construction preserves preference order while dropping normalized-equal duplicates. Well-formedness checks remain.

Fix-specific regressions

• Advisor F1 / cashu M1: manual_award_relay_fetch_does_not_hold_money_lock exercises the real manual handler against a blocked relay handshake. Moving the lock back above fetch: 0 passed / 1 failed / 0 ignored, at the intended mutex assertion. Restored: 1/0/0.
• M2: reserved_credits_choose_sats_for_filter_ceiling_accept_and_award, reserved_credits_filter_uses_available_sats_on_manual_and_auto_paths, and extended award_ceiling_mint_matches_the_accept_selection. Restoring raw-balance selection: 0/2/0, both reserved-credit tests fail at the intended assertions. Restored reserved-credit tests: 2/0/0; parity: 1/0/0.
• M3-target: a_nostr_target_cannot_open_a_hop: 1/0/0. No mutation requested/performed.
• L4: balance_read_failure_diagnostic_is_not_a_credit_hop_refusal: 1/0/0. Shared manual/auto gate and park-reason test; no mutation requested/performed.
• L5: private_invoice_rejects_normalized_equal_mint_aliases and seller_creq_deduplicates_normalized_mints: each 1/0/0. Seller test puts the :443 alias first; no mutation requested/performed.

Deferred

• Advisor F2 / cashu L7: bob deferred pre-upgrade credits-only pinned-reservation recovery: in-flight only, fails closed, all buyers/sellers upgrading together during internal testing. No change in this round.
• Cashu M3 pay-time sealed-mint enforcement: deferred to #1101. No sealed-delivery-mint/pay-time supersession change here.

Review-fix verification (previous head 25c2d25)

All suites use --locked; counts aggregate all 33 emitted targets, including doc-tests.

Suite	Passed	Failed	Ignored
cargo test -p maxplayer-core --release --no-default-features --features gateway,git-delivery,wallet,live-mints --locked	2054	0	8
cargo test -p maxplayer-core --release --features acp,gateway,git-delivery,wallet --locked	2159	0	51
Seven focused invocations (eight tests)	8	0	0
Final alias-first seller regression rerun	1	0	0

cargo fmt --check was run and exits 1 on existing repository drift; changed files introduce no new rustfmt drift compared with 4520cc2, and git diff --check passes. No whole-file formatting rewrite. CI has no fmt/clippy gate.

cargo clippy -p maxplayer-core --features acp,gateway,git-delivery,wallet --all-targets --locked --no-deps initially exits 101 solely for pre-existing unused_io_amount at untouched git_transport.rs:2129. Rerun with -- -A clippy::unused_io_amount passes (exit 0); no added-line diagnostics. CLI fixtures were not touched; CLI tests were not rerun in this fix round. Ignored tests remain unverified.

Previous-head verification (4520cc2)

All test commands below used --locked; counts aggregate all targets emitted by each command. Ignored tests are not claimed as verified.

Suite / exact feature set	Passed	Failed	Ignored
§5 pre-upgrade probe on unchanged 9ba25cd, real credit sidecar	1	0	0
cargo test --manifest-path crates/maxplayer-mint/Cargo.toml --locked	25	0	1
Focused real-sidecar + HTTPS-hop fixture (included above)	1	0	0
Core release, --features acp,gateway,git-delivery,wallet	2152	0	51
Core release, --no-default-features --features gateway,git-delivery,wallet,live-mints	2047	0	8
CLI, --no-default-features --features wallet,acp	248	0	1
Core, --features wallet	2046	0	8
maxplayer-private-protocol	5	0	0
Focused core release, --no-default-features --features gateway,git-delivery,wallet --lib credits_first (before/after mutations)	8 / 8	0 / 0	0 / 0

The sidecar's ignored child helper is explicitly invoked by the passing HTTPS fixture parent; mint lib/bin/doc targets each had zero tests. The shipped build passed: cargo build -p maxplayer --release --no-default-features --features wallet,acp --locked.

All four spec mutations produced their intended named test failure (each 0 passed / 1 failed, exit 101; not a compiler failure):

Mutation	Regression test	Result
Remove credit hop-target skip	credits_first_hop_skips_credit_targets_in_every_position	RED
Restore seller-order source selection	credits_first_source_selection_matrix	RED
Restore default-only award filtering	credits_first_extra_credit_is_awardable_on_manual_and_auto_paths	RED
Remove signed-creq receipt membership check	credits_first_realized_mint_must_be_in_signed_creq	RED

The isolated mutation checkout was restored byte-for-byte; restored baseline 8/0/0. Hash verification confirmed mutations never altered the primary worktree.

Formatting: changed-line rustfmt --edition 2024 check and git diff --check pass, preserving pre-existing unrelated formatting. CI itself has no fmt/clippy job. Core/CLI all-target clippy --no-deps and sidecar clippy were run; no diagnostics on changed lines. Core's initial all-target run was blocked by pre-existing clippy::unused_io_amount in untouched git_transport.rs:2129 (confirmed on the base); rerunning with only -A clippy::unused_io_amount passed. CLI and sidecar clippy passed without that exception.

Spec refinements and limitations

• The award filter and ceiling use one balance snapshot under money_lock; pinned-attempt resolution remains outside the lock to avoid reentrant deadlock.
• The receipt check verifies the derived delivery mint against the signed creq. request.realized_mint is actually the funding source and may legitimately be outside that list.
• No behavioral deviation from the spec. The HTTPS integration fixture uses real CDK mint APIs and a real credit sidecar, with simulated Lightning. Receipt auth-on-connect publication and a production rollout are not verified by this fixture.

Scope and rollout

• Deliberate private-job trust widening: as with public jobs, the buyer may hop into any well-formed, fence-admitted HTTPS mint in the seller's signed claim, even if the buyer/reviewer never configured it. Signed seller membership remains enforced.
• Redeploy the reviewer service alongside this client update. An old reviewer continues dropping these private claims under its own mint allow-list.
• No offer tag, pay_from, protocol/relay change, new bind field, or store migration. extra_mints keeps its existing meaning. No relay deployment is required.
• Hop-from-extra-mint remains a follow-up. Older buyers retain their existing behavior; sellers need no change.

Fixes #1039
Refs #1069 — the private mechanism is fixed; the public repro remains unexplained.
Refs #1092

Spec: docs/specs/buyer-mint-choice.md.

Previous-head CI and advisor R2 re-review (25c2d25)

Head: 25c2d25d510c9a6a12eb12974200adf603be29f2. CI run 37397883092 — success.

• maxplayer-mint sidecar: success
• Test the full shipped feature combo (acp + wallet): success
• JS test suites (web/app, web/network): success
• Build (no default features): success
• Build & test (acp): success
• Release workflow gates: success
• Money-path tests: success
• Build & test (default features): success

Read-only advisor re-review requested at this head, targeted job 7f3064dea54b42310a5daa08f57f7d3efa54a9e08cdf01704ff74329a125b1ce, payment none, 0 sats. Collected successfully for 0 sats (payment state none). Advisor verdict: all five scoped fixes resolved, but one new high finding; no medium findings. No project tests were independently rerun by the advisor.

Author validation of advisor R2 finding 1: CONFIRMED routing regression. At H, gateway.rs:1460-1470 strips HTTPS :443 when emitting seller CREQs, while wallet_ops.rs:720-728 and crossmint.rs:201-209 retain that port in buyer balance identity. Inspected immutable git show H:<path>. An offline probe calling the compiled production build_seller_creq, parse_creq, normalize_mint_url, and plan_payment confirms:

• Wallet configured as https://mint.example:443; seller configured identically.
• Seller now emits https://mint.example; wallet identity remains https://mint.example:443.
• Previous seller spelling plans Direct; new emitted spelling plans Hop between aliases of the same mint.

No network/payment was executed; the report's possible payment-loss outcome is unverified, not established by this reproduction. A repair must preserve existing wallet/reservation identities; a normalization change alone must not bypass existing reservations. That R2-reviewed head is historical; the R3 fix below addresses the confirmed routing regression. PR remains draft; no merge authorized.

Advisor R2 finding 1 fix / R3 verification

Head: 4bb84c81beab40d37c7ff61b9e97019b816ce27f. Authorized by bob (option 1), 2026-10-06 01:58 UTC. Narrow delta from 25c2d25; base 9ba25cd.

• gateway.rs: seller creq canonicalization/deduplication uses MintUrl::from_str output, preserving explicit :443, seller order and first occurrence. A separate URL-structure validation discards the parsed URL; it cannot rewrite wallet identity.
• private_content/invoice.rs: duplicate keys use the same MintUrl identity; existing well-formedness checks remain. Corrected the misleading default-port comment. No wallet, reservation, lock, or pays-once logic changed.
• seller_creq_deduplicates_normalized_mints and private_invoice_rejects_normalized_equal_mint_aliases: slash/case aliases collapse; explicit :443 and no-port entries remain distinct.
• New crossmint::tests::seller_creq_explicit_default_port_uses_held_mint_and_pays_direct follows real build_seller_creq → parse_creq → select_source_mint → plan_payment, with a full-price configured :443 balance. Asserts Direct, holds_at_least, and selection with both same-mint and different-default fallbacks.

Mutation evidence

Reintroducing the Url::parse canonicalization pre-pass in the builder produces 0 passed / 1 failed / 0 ignored at the intended Direct assertion: actual Hop { source: https://mint.example:443, target: https://mint.example }. Restored code is byte-identical (SHA-256 90eb459a1bda1b7bffd16a77804fcd2692ce2ef5d6afd2528afa18be1c68a9c7), and restored regression passes 1/0/0.

Exact local results at this head

Suite	Passed	Failed	Ignored
cargo test -p maxplayer-core --release --no-default-features --features gateway,git-delivery,wallet,live-mints --locked	2055	0	8
cargo test -p maxplayer-core --release --features acp,gateway,git-delivery,wallet --locked	2160	0	51
Focused seller tests (--lib seller_creq_)	2	0	0
Focused private invoice alias test	1	0	0
Restored :443 regression	1	0	0

Full-suite totals each aggregate 33 emitted targets including doc-tests. Both completed commands exited 0. Clippy passed: cargo clippy -p maxplayer-core --release --features acp,gateway,git-delivery,wallet --locked --all-targets --no-deps -- -A clippy::unused_io_amount; no added-line diagnostics. CI has no clippy/rustfmt step. git diff --check passes; no whole-file formatting.

CI: run 37408045671, all eight jobs success on H; single watcher exited 0. Free advisor R3 job 814f55663406e2f6b91cd5b9e76e06e59b257ada9ebff26b861c9e99c99e9e3a was collected successfully with payment none, amount 0 sats, payment state none. R3 verdict: Approve; no critical/high/medium findings. Ignored tests, a live :443 mint payment, and production rollout remain unverified. F2/L7 and #1101 remain deliberately deferred as above. No merge, main push, Discord post, or GitHub comment.

Completed advisor R3 review and author validation

Advisor verdict: Approve. R2 finding 1 resolved; no critical/high/medium findings and no blocking low findings. There are no high/medium findings to classify as confirmed/refuted/unclear. Author validation confirms the repair at immutable H: gateway.rs:1463-1472 emits/dedupes MintUrl spelling, invoice.rs:117-124 retains well-formedness and the same identity, crossmint.rs:312-343 exercises Direct from the configured :443 balance.

Confirmed nonblocking coverage limitation: private_content/tests.rs:1734-1739 constructs a PaymentRequest through serde before encoding. cashu 0.17.2 MintUrl deserialization already folds case/slashes; therefore the private test does not independently prove folding of raw unequal CBOR aliases. It does prove the explicit-port distinction, and the builder test covers raw aliases. Optional raw-CBOR strengthening is not required for this narrow fix. No product defect claimed; no further code changed.

Advisor independently inspected the pinned source/dependencies and verified all eight CI job conclusions on H. It did not rerun local suites, mutation, or clippy; those are author-run evidence. Ignored tests, a live :443 payment and production rollout remain unverified. F2/L7 and #1101 remain deliberately out of scope.

CI job conclusions at H:

• Test the full shipped feature combo (acp + wallet): success
• JS test suites (web/app, web/network): success
• maxplayer-mint sidecar: success
• Build & test (default features): success
• Build & test (acp): success
• Money-path tests: success
• Build (no default features): success
• Release workflow gates: success

Review job 814f55663406e2f6b91cd5b9e76e06e59b257ada9ebff26b861c9e99c99e9e3a, delivered commit ffd2c60a3daa28f1272cb90832ef3e5a521cfd6c; sats spent in this run: 0. No code changes after advisor review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
maxplayer	Ready	Preview	Oct 6, 2026 3:14am UTC