fix: wait for on-chain broadcast results

[ovitrif]

Closes#112

Summary

• Wait for the configured backend result before explicit on-chain sends report acceptance.
• Return transaction-keyed rejected, not-dispatched, acceptance-unknown failure, and acceptance-unknown timeout errors through Rust, Swift, Kotlin, and Python.
• Persist every possibly dispatched transaction and its complete RBF lineage before broadcast, reserve its inputs across restart, expose pending transaction IDs, and support exact-byte rebroadcast or explicit abandonment after external reconciliation.
• Derive abandonment timestamps inside the aggregate wallet from wall time and tracked observation/eviction state; overflow fails before mutation.
• Keep LDK-managed broadcasts fire-and-forget on a dedicated priority queue.
• Require backend evidence before reconciliation, preserve only the canonical payment record, and make confirmation cleanup crash-safe across BDK, payment-store, and intent-store persistence failures.
• Classify Bitcoin Core, Electrum, and Esplora responses conservatively, including already-known acceptance and returned-txid mismatch rejection.
• Publish the breaking binding contract as 0.7.0-rc.67; PR fix: sigabrt runtime teardown #111 reserves rc.66.

Preview

N/A — no user-visible changes.

QA Notes

• A deterministic backend rejection does not reach the consumer success path and does not create sent activity.
• A timeout or operational failure after dispatch carries the original transaction ID. Consumers must reconcile or call rebroadcast_transaction for that exact ID; they must not create a second payment.
• list_pending_broadcasts enumerates unresolved IDs. abandon_pending_broadcast is valid only after the caller proves the entire payment lineage absent from mempool and chain.
• Swift unit NodeError cases no longer carry the legacy generated message value. The four broadcast-result cases carry txid.
• Kotlin unit NodeException cases now have empty generated messages. The four broadcast-result cases carry txid.

Validation

• Exact PR head: 550b99177102ba1bc5d01f9c41160765993a3520; local HEAD and upstream match; worktree clean.
• cargo fmt --check and git diff --check: passed.
• cargo build --all-targets --locked: passed. Existing target-name, unused-import, and unused-variable warnings remain outside this change.
• cargo test --lib: 131 passed.
• cargo test --features uniffi --lib: 141 passed; only the repository's existing UniFFI warnings were emitted.
• cargo test --doc: 13 passed.
• cargo test --features uniffi --doc: 13 passed.
• cargo test --test multi_address_types_tests rbf::test_rbf_cross_wallet_transaction -- --exact --nocapture: passed against real bitcoind and electrs.
• onchain_transaction_evicted_event: accepted-send indexing and pending-intent assertions passed; the final eviction injection is guarded and skipped because the bundled Bitcoin Core lacks removetx.
• The dedicated splice integration test reaches the same pre-existing On-chain transaction signing failed path and wait on both base 03ccac798aeb907c6dda367fa4c8af6e3eaa54fa and this branch.
• ./bindgen.sh: passed the JVM build/publish graph, Python generation, Swift XCFramework assembly, Android three-ABI build, DWARF/strip validation, 16 KiB alignment validation, native-debug-symbol packaging, and Maven Local publication.
• Generated Swift archive SHA256: d6ccac3a6a013fbb5313d49faf4d3373b14053ede91923e9a1cd4f3230c6848c; Package.swift matches.
• Generated Android AAR SHA256: 36ce1902372a5e6be38b93debce365445c878efa646c7ffc0697150648ad2f63; Maven Local and the bindgen output match byte-for-byte.
• Kotlin Android/JVM common bindings match; Python generated sources compile; Swift and Android archives pass integrity checks.

Consumer validation

• iOS branch e72a87566f672c14f4b7b5a32f72cb6615262270 compiled against the rc.67 API-equivalent XCFramework before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Swift unchanged. After the expected enum-payload compatibility adaptation, Accepted, rejected, failed, timed-out, not-dispatched, maximum-send, and wrapped-error tests passed: 7 passed, 0 failed, 0 skipped.
• Android branch e733f9c4ed4dbed701a640fe58c3799717c77b0b compiled against the rc.67 API-equivalent Maven AAR before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Kotlin unchanged. Repository and UI accepted/rejected send-path tests passed: 5 passed.
• Earlier live consumer journeys proved the product behavior end to end: accepted iOS tx 24b2dd80ebdca0610fdc2e90b589b810bd9fd2781cc33de8a55b63e6020b44f9 and Android tx bd2fb7e01eb49fefc70fc46be9466d3f209999c1668cdd9ec2aeaac1dfab703a reached mempool/activity/success; rejected iOS tx feeb000e379dc52d1c140f3fd8a01edfa7dfb29f12a8e670ab1b99a7a33f7b7a and Android tx 481280340d1e5507079c771de07ab8d0c13ace14203f6e0d508c9250ab09726b propagated RPC -26, stayed absent from mempool/chain/activity, and did not show success.
• Both consumer worktrees were restored to their committed production rc.63 wiring and are clean. No consumer branch or artifact was published.

Release

• No tag or release was created. rc.67 may be released from the fully pushed PR head only after a non-author approval, all required checks, and PR fix: sigabrt runtime teardown #111's rc.66 ordering are resolved. Add the release link here before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed2026-09-02T13:21:31.826968Z	550b991	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:92486e5695

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:431c6f9f29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit:550b991771

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ben-kaufman]

Reminder to run ./bindgen.sh before merge. The UDL now returns PendingBroadcastInfo, but the checked-in Swift, Kotlin, and Python bindings still return Txid, so they need to be regenerated together with the native artifacts and the Package.swift checksum.

[ben-kaufman]

note_locally_applied_unconfirmed runs before backend dispatch, but these markers are emitted unconditionally. In particular, reject_rbf_broadcast does not remove the rejected replacement marker, and a transaction confirmed before the first sync can emit Confirmed followed by Received. Could we clear the marker on RBF rejection and skip absent or already-confirmed transactions here?

[ben-kaufman]

write_broadcast_intent runs before next_broadcast_timestamp. If an existing lineage contains u64::MAX - 1, the timestamp call fails after the new active replacement has been persisted but before BDK records it. Restart then fails while reapplying the missing active transaction. Could we calculate the timestamp before persisting the replacement, or roll the intent back, and add an RBF restart test for this boundary?

[ovitrif]

Closes#112

Summary

• Wait for the configured backend result before explicit on-chain sends report acceptance.
• Return transaction-keyed rejected, not-dispatched, acceptance-unknown failure, and acceptance-unknown timeout errors through Rust, Swift, Kotlin, and Python.
• Persist every possibly dispatched transaction and its complete RBF lineage before broadcast, reserve its inputs across restart, expose pending transaction IDs, and support exact-byte rebroadcast or explicit abandonment after external reconciliation.
• Derive abandonment timestamps inside the aggregate wallet from wall time and tracked observation/eviction state; overflow fails before mutation.
• Keep LDK-managed broadcasts fire-and-forget on a dedicated priority queue.
• Require backend evidence before reconciliation, preserve only the canonical payment record, and make confirmation cleanup crash-safe across BDK, payment-store, and intent-store persistence failures.
• Classify Bitcoin Core, Electrum, and Esplora responses conservatively, including already-known acceptance and returned-txid mismatch rejection.
• Publish the breaking binding contract as 0.7.0-rc.67; PR fix: sigabrt runtime teardown #111 reserves rc.66.

Preview

N/A — no user-visible changes.

QA Notes

• A deterministic backend rejection does not reach the consumer success path and does not create sent activity.
• A timeout or operational failure after dispatch carries the original transaction ID. Consumers must reconcile or call rebroadcast_transaction for that exact ID; they must not create a second payment.
• list_pending_broadcasts enumerates unresolved IDs. abandon_pending_broadcast is valid only after the caller proves the entire payment lineage absent from mempool and chain.
• Swift unit NodeError cases no longer carry the legacy generated message value. The four broadcast-result cases carry txid.
• Kotlin unit NodeException cases now have empty generated messages. The four broadcast-result cases carry txid.

Validation

• Exact PR head: 550b99177102ba1bc5d01f9c41160765993a3520; local HEAD and upstream match; worktree clean.
• cargo fmt --check and git diff --check: passed.
• cargo build --all-targets --locked: passed. Existing target-name, unused-import, and unused-variable warnings remain outside this change.
• cargo test --lib: 131 passed.
• cargo test --features uniffi --lib: 141 passed; only the repository's existing UniFFI warnings were emitted.
• cargo test --doc: 13 passed.
• cargo test --features uniffi --doc: 13 passed.
• cargo test --test multi_address_types_tests rbf::test_rbf_cross_wallet_transaction -- --exact --nocapture: passed against real bitcoind and electrs.
• onchain_transaction_evicted_event: accepted-send indexing and pending-intent assertions passed; the final eviction injection is guarded and skipped because the bundled Bitcoin Core lacks removetx.
• The dedicated splice integration test reaches the same pre-existing On-chain transaction signing failed path and wait on both base 03ccac798aeb907c6dda367fa4c8af6e3eaa54fa and this branch.
• ./bindgen.sh: passed the JVM build/publish graph, Python generation, Swift XCFramework assembly, Android three-ABI build, DWARF/strip validation, 16 KiB alignment validation, native-debug-symbol packaging, and Maven Local publication.
• Generated Swift archive SHA256: d6ccac3a6a013fbb5313d49faf4d3373b14053ede91923e9a1cd4f3230c6848c; Package.swift matches.
• Generated Android AAR SHA256: 36ce1902372a5e6be38b93debce365445c878efa646c7ffc0697150648ad2f63; Maven Local and the bindgen output match byte-for-byte.
• Kotlin Android/JVM common bindings match; Python generated sources compile; Swift and Android archives pass integrity checks.

Consumer validation

• iOS branch e72a87566f672c14f4b7b5a32f72cb6615262270 compiled against the rc.67 API-equivalent XCFramework before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Swift unchanged. After the expected enum-payload compatibility adaptation, Accepted, rejected, failed, timed-out, not-dispatched, maximum-send, and wrapped-error tests passed: 7 passed, 0 failed, 0 skipped.
• Android branch e733f9c4ed4dbed701a640fe58c3799717c77b0b compiled against the rc.67 API-equivalent Maven AAR before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Kotlin unchanged. Repository and UI accepted/rejected send-path tests passed: 5 passed.
• Earlier live consumer journeys proved the product behavior end to end: accepted iOS tx 24b2dd80ebdca0610fdc2e90b589b810bd9fd2781cc33de8a55b63e6020b44f9 and Android tx bd2fb7e01eb49fefc70fc46be9466d3f209999c1668cdd9ec2aeaac1dfab703a reached mempool/activity/success; rejected iOS tx feeb000e379dc52d1c140f3fd8a01edfa7dfb29f12a8e670ab1b99a7a33f7b7a and Android tx 481280340d1e5507079c771de07ab8d0c13ace14203f6e0d508c9250ab09726b propagated RPC -26, stayed absent from mempool/chain/activity, and did not show success.
• Both consumer worktrees were restored to their committed production rc.63 wiring and are clean. No consumer branch or artifact was published.

Release

• No tag or release was created. rc.67 may be released from the fully pushed PR head only after a non-author approval, all required checks, and PR fix: sigabrt runtime teardown #111's rc.66 ordering are resolved. Add the release link here before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed2026-09-02T13:21:31.826968Z	550b991	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:92486e5695

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:431c6f9f29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit:550b991771

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ben-kaufman]

Reminder to run ./bindgen.sh before merge. The UDL now returns PendingBroadcastInfo, but the checked-in Swift, Kotlin, and Python bindings still return Txid, so they need to be regenerated together with the native artifacts and the Package.swift checksum.

[ben-kaufman]

note_locally_applied_unconfirmed runs before backend dispatch, but these markers are emitted unconditionally. In particular, reject_rbf_broadcast does not remove the rejected replacement marker, and a transaction confirmed before the first sync can emit Confirmed followed by Received. Could we clear the marker on RBF rejection and skip absent or already-confirmed transactions here?

[ben-kaufman]

write_broadcast_intent runs before next_broadcast_timestamp. If an existing lineage contains u64::MAX - 1, the timestamp call fails after the new active replacement has been persisted but before BDK records it. Restart then fails while reapplying the missing active transaction. Could we calculate the timestamp before persisting the replacement, or roll the intent back, and add an RBF restart test for this boundary?

[ovitrif]

Closes#112

Summary

• Wait for the configured backend result before explicit on-chain sends report acceptance.
• Return transaction-keyed rejected, not-dispatched, acceptance-unknown failure, and acceptance-unknown timeout errors through Rust, Swift, Kotlin, and Python.
• Persist every possibly dispatched transaction and its complete RBF lineage before broadcast, reserve its inputs across restart, expose pending transaction IDs, and support exact-byte rebroadcast or explicit abandonment after external reconciliation.
• Derive abandonment timestamps inside the aggregate wallet from wall time and tracked observation/eviction state; overflow fails before mutation.
• Keep LDK-managed broadcasts fire-and-forget on a dedicated priority queue.
• Require backend evidence before reconciliation, preserve only the canonical payment record, and make confirmation cleanup crash-safe across BDK, payment-store, and intent-store persistence failures.
• Classify Bitcoin Core, Electrum, and Esplora responses conservatively, including already-known acceptance and returned-txid mismatch rejection.
• Publish the breaking binding contract as 0.7.0-rc.67; PR fix: sigabrt runtime teardown #111 reserves rc.66.

Preview

N/A — no user-visible changes.

QA Notes

• A deterministic backend rejection does not reach the consumer success path and does not create sent activity.
• A timeout or operational failure after dispatch carries the original transaction ID. Consumers must reconcile or call rebroadcast_transaction for that exact ID; they must not create a second payment.
• list_pending_broadcasts enumerates unresolved IDs. abandon_pending_broadcast is valid only after the caller proves the entire payment lineage absent from mempool and chain.
• Swift unit NodeError cases no longer carry the legacy generated message value. The four broadcast-result cases carry txid.
• Kotlin unit NodeException cases now have empty generated messages. The four broadcast-result cases carry txid.

Validation

• Exact PR head: 550b99177102ba1bc5d01f9c41160765993a3520; local HEAD and upstream match; worktree clean.
• cargo fmt --check and git diff --check: passed.
• cargo build --all-targets --locked: passed. Existing target-name, unused-import, and unused-variable warnings remain outside this change.
• cargo test --lib: 131 passed.
• cargo test --features uniffi --lib: 141 passed; only the repository's existing UniFFI warnings were emitted.
• cargo test --doc: 13 passed.
• cargo test --features uniffi --doc: 13 passed.
• cargo test --test multi_address_types_tests rbf::test_rbf_cross_wallet_transaction -- --exact --nocapture: passed against real bitcoind and electrs.
• onchain_transaction_evicted_event: accepted-send indexing and pending-intent assertions passed; the final eviction injection is guarded and skipped because the bundled Bitcoin Core lacks removetx.
• The dedicated splice integration test reaches the same pre-existing On-chain transaction signing failed path and wait on both base 03ccac798aeb907c6dda367fa4c8af6e3eaa54fa and this branch.
• ./bindgen.sh: passed the JVM build/publish graph, Python generation, Swift XCFramework assembly, Android three-ABI build, DWARF/strip validation, 16 KiB alignment validation, native-debug-symbol packaging, and Maven Local publication.
• Generated Swift archive SHA256: d6ccac3a6a013fbb5313d49faf4d3373b14053ede91923e9a1cd4f3230c6848c; Package.swift matches.
• Generated Android AAR SHA256: 36ce1902372a5e6be38b93debce365445c878efa646c7ffc0697150648ad2f63; Maven Local and the bindgen output match byte-for-byte.
• Kotlin Android/JVM common bindings match; Python generated sources compile; Swift and Android archives pass integrity checks.

Consumer validation

• iOS branch e72a87566f672c14f4b7b5a32f72cb6615262270 compiled against the rc.67 API-equivalent XCFramework before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Swift unchanged. After the expected enum-payload compatibility adaptation, Accepted, rejected, failed, timed-out, not-dispatched, maximum-send, and wrapped-error tests passed: 7 passed, 0 failed, 0 skipped.
• Android branch e733f9c4ed4dbed701a640fe58c3799717c77b0b compiled against the rc.67 API-equivalent Maven AAR before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Kotlin unchanged. Repository and UI accepted/rejected send-path tests passed: 5 passed.
• Earlier live consumer journeys proved the product behavior end to end: accepted iOS tx 24b2dd80ebdca0610fdc2e90b589b810bd9fd2781cc33de8a55b63e6020b44f9 and Android tx bd2fb7e01eb49fefc70fc46be9466d3f209999c1668cdd9ec2aeaac1dfab703a reached mempool/activity/success; rejected iOS tx feeb000e379dc52d1c140f3fd8a01edfa7dfb29f12a8e670ab1b99a7a33f7b7a and Android tx 481280340d1e5507079c771de07ab8d0c13ace14203f6e0d508c9250ab09726b propagated RPC -26, stayed absent from mempool/chain/activity, and did not show success.
• Both consumer worktrees were restored to their committed production rc.63 wiring and are clean. No consumer branch or artifact was published.

Release

• No tag or release was created. rc.67 may be released from the fully pushed PR head only after a non-author approval, all required checks, and PR fix: sigabrt runtime teardown #111's rc.66 ordering are resolved. Add the release link here before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed2026-09-02T13:21:31.826968Z	550b991	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:92486e5695

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:431c6f9f29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit:550b991771

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ben-kaufman]

Reminder to run ./bindgen.sh before merge. The UDL now returns PendingBroadcastInfo, but the checked-in Swift, Kotlin, and Python bindings still return Txid, so they need to be regenerated together with the native artifacts and the Package.swift checksum.

[ben-kaufman]

note_locally_applied_unconfirmed runs before backend dispatch, but these markers are emitted unconditionally. In particular, reject_rbf_broadcast does not remove the rejected replacement marker, and a transaction confirmed before the first sync can emit Confirmed followed by Received. Could we clear the marker on RBF rejection and skip absent or already-confirmed transactions here?

[ben-kaufman]

write_broadcast_intent runs before next_broadcast_timestamp. If an existing lineage contains u64::MAX - 1, the timestamp call fails after the new active replacement has been persisted but before BDK records it. Restart then fails while reapplying the missing active transaction. Could we calculate the timestamp before persisting the replacement, or roll the intent back, and add an RBF restart test for this boundary?

[ovitrif]

Closes#112

Summary

• Wait for the configured backend result before explicit on-chain sends report acceptance.
• Return transaction-keyed rejected, not-dispatched, acceptance-unknown failure, and acceptance-unknown timeout errors through Rust, Swift, Kotlin, and Python.
• Persist every possibly dispatched transaction and its complete RBF lineage before broadcast, reserve its inputs across restart, expose pending transaction IDs, and support exact-byte rebroadcast or explicit abandonment after external reconciliation.
• Derive abandonment timestamps inside the aggregate wallet from wall time and tracked observation/eviction state; overflow fails before mutation.
• Keep LDK-managed broadcasts fire-and-forget on a dedicated priority queue.
• Require backend evidence before reconciliation, preserve only the canonical payment record, and make confirmation cleanup crash-safe across BDK, payment-store, and intent-store persistence failures.
• Classify Bitcoin Core, Electrum, and Esplora responses conservatively, including already-known acceptance and returned-txid mismatch rejection.
• Publish the breaking binding contract as 0.7.0-rc.67; PR fix: sigabrt runtime teardown #111 reserves rc.66.

Preview

N/A — no user-visible changes.

QA Notes

• A deterministic backend rejection does not reach the consumer success path and does not create sent activity.
• A timeout or operational failure after dispatch carries the original transaction ID. Consumers must reconcile or call rebroadcast_transaction for that exact ID; they must not create a second payment.
• list_pending_broadcasts enumerates unresolved IDs. abandon_pending_broadcast is valid only after the caller proves the entire payment lineage absent from mempool and chain.
• Swift unit NodeError cases no longer carry the legacy generated message value. The four broadcast-result cases carry txid.
• Kotlin unit NodeException cases now have empty generated messages. The four broadcast-result cases carry txid.

Validation

• Exact PR head: 550b99177102ba1bc5d01f9c41160765993a3520; local HEAD and upstream match; worktree clean.
• cargo fmt --check and git diff --check: passed.
• cargo build --all-targets --locked: passed. Existing target-name, unused-import, and unused-variable warnings remain outside this change.
• cargo test --lib: 131 passed.
• cargo test --features uniffi --lib: 141 passed; only the repository's existing UniFFI warnings were emitted.
• cargo test --doc: 13 passed.
• cargo test --features uniffi --doc: 13 passed.
• cargo test --test multi_address_types_tests rbf::test_rbf_cross_wallet_transaction -- --exact --nocapture: passed against real bitcoind and electrs.
• onchain_transaction_evicted_event: accepted-send indexing and pending-intent assertions passed; the final eviction injection is guarded and skipped because the bundled Bitcoin Core lacks removetx.
• The dedicated splice integration test reaches the same pre-existing On-chain transaction signing failed path and wait on both base 03ccac798aeb907c6dda367fa4c8af6e3eaa54fa and this branch.
• ./bindgen.sh: passed the JVM build/publish graph, Python generation, Swift XCFramework assembly, Android three-ABI build, DWARF/strip validation, 16 KiB alignment validation, native-debug-symbol packaging, and Maven Local publication.
• Generated Swift archive SHA256: d6ccac3a6a013fbb5313d49faf4d3373b14053ede91923e9a1cd4f3230c6848c; Package.swift matches.
• Generated Android AAR SHA256: 36ce1902372a5e6be38b93debce365445c878efa646c7ffc0697150648ad2f63; Maven Local and the bindgen output match byte-for-byte.
• Kotlin Android/JVM common bindings match; Python generated sources compile; Swift and Android archives pass integrity checks.

Consumer validation

• iOS branch e72a87566f672c14f4b7b5a32f72cb6615262270 compiled against the rc.67 API-equivalent XCFramework before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Swift unchanged. After the expected enum-payload compatibility adaptation, Accepted, rejected, failed, timed-out, not-dispatched, maximum-send, and wrapped-error tests passed: 7 passed, 0 failed, 0 skipped.
• Android branch e733f9c4ed4dbed701a640fe58c3799717c77b0b compiled against the rc.67 API-equivalent Maven AAR before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Kotlin unchanged. Repository and UI accepted/rejected send-path tests passed: 5 passed.
• Earlier live consumer journeys proved the product behavior end to end: accepted iOS tx 24b2dd80ebdca0610fdc2e90b589b810bd9fd2781cc33de8a55b63e6020b44f9 and Android tx bd2fb7e01eb49fefc70fc46be9466d3f209999c1668cdd9ec2aeaac1dfab703a reached mempool/activity/success; rejected iOS tx feeb000e379dc52d1c140f3fd8a01edfa7dfb29f12a8e670ab1b99a7a33f7b7a and Android tx 481280340d1e5507079c771de07ab8d0c13ace14203f6e0d508c9250ab09726b propagated RPC -26, stayed absent from mempool/chain/activity, and did not show success.
• Both consumer worktrees were restored to their committed production rc.63 wiring and are clean. No consumer branch or artifact was published.

Release

• No tag or release was created. rc.67 may be released from the fully pushed PR head only after a non-author approval, all required checks, and PR fix: sigabrt runtime teardown #111's rc.66 ordering are resolved. Add the release link here before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed2026-09-02T13:21:31.826968Z	550b991	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:92486e5695

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:431c6f9f29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit:550b991771

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ben-kaufman]

Reminder to run ./bindgen.sh before merge. The UDL now returns PendingBroadcastInfo, but the checked-in Swift, Kotlin, and Python bindings still return Txid, so they need to be regenerated together with the native artifacts and the Package.swift checksum.

[ben-kaufman]

note_locally_applied_unconfirmed runs before backend dispatch, but these markers are emitted unconditionally. In particular, reject_rbf_broadcast does not remove the rejected replacement marker, and a transaction confirmed before the first sync can emit Confirmed followed by Received. Could we clear the marker on RBF rejection and skip absent or already-confirmed transactions here?

[ben-kaufman]

write_broadcast_intent runs before next_broadcast_timestamp. If an existing lineage contains u64::MAX - 1, the timestamp call fails after the new active replacement has been persisted but before BDK records it. Restart then fails while reapplying the missing active transaction. Could we calculate the timestamp before persisting the replacement, or roll the intent back, and add an RBF restart test for this boundary?

[ovitrif]

Closes#112

Summary

• Wait for the configured backend result before explicit on-chain sends report acceptance.
• Return transaction-keyed rejected, not-dispatched, acceptance-unknown failure, and acceptance-unknown timeout errors through Rust, Swift, Kotlin, and Python.
• Persist every possibly dispatched transaction and its complete RBF lineage before broadcast, reserve its inputs across restart, expose pending transaction IDs, and support exact-byte rebroadcast or explicit abandonment after external reconciliation.
• Derive abandonment timestamps inside the aggregate wallet from wall time and tracked observation/eviction state; overflow fails before mutation.
• Keep LDK-managed broadcasts fire-and-forget on a dedicated priority queue.
• Require backend evidence before reconciliation, preserve only the canonical payment record, and make confirmation cleanup crash-safe across BDK, payment-store, and intent-store persistence failures.
• Classify Bitcoin Core, Electrum, and Esplora responses conservatively, including already-known acceptance and returned-txid mismatch rejection.
• Publish the breaking binding contract as 0.7.0-rc.67; PR fix: sigabrt runtime teardown #111 reserves rc.66.

Preview

N/A — no user-visible changes.

QA Notes

• A deterministic backend rejection does not reach the consumer success path and does not create sent activity.
• A timeout or operational failure after dispatch carries the original transaction ID. Consumers must reconcile or call rebroadcast_transaction for that exact ID; they must not create a second payment.
• list_pending_broadcasts enumerates unresolved IDs. abandon_pending_broadcast is valid only after the caller proves the entire payment lineage absent from mempool and chain.
• Swift unit NodeError cases no longer carry the legacy generated message value. The four broadcast-result cases carry txid.
• Kotlin unit NodeException cases now have empty generated messages. The four broadcast-result cases carry txid.

Validation

• Exact PR head: 550b99177102ba1bc5d01f9c41160765993a3520; local HEAD and upstream match; worktree clean.
• cargo fmt --check and git diff --check: passed.
• cargo build --all-targets --locked: passed. Existing target-name, unused-import, and unused-variable warnings remain outside this change.
• cargo test --lib: 131 passed.
• cargo test --features uniffi --lib: 141 passed; only the repository's existing UniFFI warnings were emitted.
• cargo test --doc: 13 passed.
• cargo test --features uniffi --doc: 13 passed.
• cargo test --test multi_address_types_tests rbf::test_rbf_cross_wallet_transaction -- --exact --nocapture: passed against real bitcoind and electrs.
• onchain_transaction_evicted_event: accepted-send indexing and pending-intent assertions passed; the final eviction injection is guarded and skipped because the bundled Bitcoin Core lacks removetx.
• The dedicated splice integration test reaches the same pre-existing On-chain transaction signing failed path and wait on both base 03ccac798aeb907c6dda367fa4c8af6e3eaa54fa and this branch.
• ./bindgen.sh: passed the JVM build/publish graph, Python generation, Swift XCFramework assembly, Android three-ABI build, DWARF/strip validation, 16 KiB alignment validation, native-debug-symbol packaging, and Maven Local publication.
• Generated Swift archive SHA256: d6ccac3a6a013fbb5313d49faf4d3373b14053ede91923e9a1cd4f3230c6848c; Package.swift matches.
• Generated Android AAR SHA256: 36ce1902372a5e6be38b93debce365445c878efa646c7ffc0697150648ad2f63; Maven Local and the bindgen output match byte-for-byte.
• Kotlin Android/JVM common bindings match; Python generated sources compile; Swift and Android archives pass integrity checks.

Consumer validation

• iOS branch e72a87566f672c14f4b7b5a32f72cb6615262270 compiled against the rc.67 API-equivalent XCFramework before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Swift unchanged. After the expected enum-payload compatibility adaptation, Accepted, rejected, failed, timed-out, not-dispatched, maximum-send, and wrapped-error tests passed: 7 passed, 0 failed, 0 skipped.
• Android branch e733f9c4ed4dbed701a640fe58c3799717c77b0b compiled against the rc.67 API-equivalent Maven AAR before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Kotlin unchanged. Repository and UI accepted/rejected send-path tests passed: 5 passed.
• Earlier live consumer journeys proved the product behavior end to end: accepted iOS tx 24b2dd80ebdca0610fdc2e90b589b810bd9fd2781cc33de8a55b63e6020b44f9 and Android tx bd2fb7e01eb49fefc70fc46be9466d3f209999c1668cdd9ec2aeaac1dfab703a reached mempool/activity/success; rejected iOS tx feeb000e379dc52d1c140f3fd8a01edfa7dfb29f12a8e670ab1b99a7a33f7b7a and Android tx 481280340d1e5507079c771de07ab8d0c13ace14203f6e0d508c9250ab09726b propagated RPC -26, stayed absent from mempool/chain/activity, and did not show success.
• Both consumer worktrees were restored to their committed production rc.63 wiring and are clean. No consumer branch or artifact was published.

Release

• No tag or release was created. rc.67 may be released from the fully pushed PR head only after a non-author approval, all required checks, and PR fix: sigabrt runtime teardown #111's rc.66 ordering are resolved. Add the release link here before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed2026-09-02T13:21:31.826968Z	550b991	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:92486e5695

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:431c6f9f29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit:550b991771

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ben-kaufman]

Reminder to run ./bindgen.sh before merge. The UDL now returns PendingBroadcastInfo, but the checked-in Swift, Kotlin, and Python bindings still return Txid, so they need to be regenerated together with the native artifacts and the Package.swift checksum.

[ben-kaufman]

note_locally_applied_unconfirmed runs before backend dispatch, but these markers are emitted unconditionally. In particular, reject_rbf_broadcast does not remove the rejected replacement marker, and a transaction confirmed before the first sync can emit Confirmed followed by Received. Could we clear the marker on RBF rejection and skip absent or already-confirmed transactions here?

[ben-kaufman]

write_broadcast_intent runs before next_broadcast_timestamp. If an existing lineage contains u64::MAX - 1, the timestamp call fails after the new active replacement has been persisted but before BDK records it. Restart then fails while reapplying the missing active transaction. Could we calculate the timestamp before persisting the replacement, or roll the intent back, and add an RBF restart test for this boundary?

[ovitrif]

Closes#112

Summary

• Wait for the configured backend result before explicit on-chain sends report acceptance.
• Return transaction-keyed rejected, not-dispatched, acceptance-unknown failure, and acceptance-unknown timeout errors through Rust, Swift, Kotlin, and Python.
• Persist every possibly dispatched transaction and its complete RBF lineage before broadcast, reserve its inputs across restart, expose pending transaction IDs, and support exact-byte rebroadcast or explicit abandonment after external reconciliation.
• Derive abandonment timestamps inside the aggregate wallet from wall time and tracked observation/eviction state; overflow fails before mutation.
• Keep LDK-managed broadcasts fire-and-forget on a dedicated priority queue.
• Require backend evidence before reconciliation, preserve only the canonical payment record, and make confirmation cleanup crash-safe across BDK, payment-store, and intent-store persistence failures.
• Classify Bitcoin Core, Electrum, and Esplora responses conservatively, including already-known acceptance and returned-txid mismatch rejection.
• Publish the breaking binding contract as 0.7.0-rc.67; PR fix: sigabrt runtime teardown #111 reserves rc.66.

Preview

N/A — no user-visible changes.

QA Notes

• A deterministic backend rejection does not reach the consumer success path and does not create sent activity.
• A timeout or operational failure after dispatch carries the original transaction ID. Consumers must reconcile or call rebroadcast_transaction for that exact ID; they must not create a second payment.
• list_pending_broadcasts enumerates unresolved IDs. abandon_pending_broadcast is valid only after the caller proves the entire payment lineage absent from mempool and chain.
• Swift unit NodeError cases no longer carry the legacy generated message value. The four broadcast-result cases carry txid.
• Kotlin unit NodeException cases now have empty generated messages. The four broadcast-result cases carry txid.

Validation

• Exact PR head: 550b99177102ba1bc5d01f9c41160765993a3520; local HEAD and upstream match; worktree clean.
• cargo fmt --check and git diff --check: passed.
• cargo build --all-targets --locked: passed. Existing target-name, unused-import, and unused-variable warnings remain outside this change.
• cargo test --lib: 131 passed.
• cargo test --features uniffi --lib: 141 passed; only the repository's existing UniFFI warnings were emitted.
• cargo test --doc: 13 passed.
• cargo test --features uniffi --doc: 13 passed.
• cargo test --test multi_address_types_tests rbf::test_rbf_cross_wallet_transaction -- --exact --nocapture: passed against real bitcoind and electrs.
• onchain_transaction_evicted_event: accepted-send indexing and pending-intent assertions passed; the final eviction injection is guarded and skipped because the bundled Bitcoin Core lacks removetx.
• The dedicated splice integration test reaches the same pre-existing On-chain transaction signing failed path and wait on both base 03ccac798aeb907c6dda367fa4c8af6e3eaa54fa and this branch.
• ./bindgen.sh: passed the JVM build/publish graph, Python generation, Swift XCFramework assembly, Android three-ABI build, DWARF/strip validation, 16 KiB alignment validation, native-debug-symbol packaging, and Maven Local publication.
• Generated Swift archive SHA256: d6ccac3a6a013fbb5313d49faf4d3373b14053ede91923e9a1cd4f3230c6848c; Package.swift matches.
• Generated Android AAR SHA256: 36ce1902372a5e6be38b93debce365445c878efa646c7ffc0697150648ad2f63; Maven Local and the bindgen output match byte-for-byte.
• Kotlin Android/JVM common bindings match; Python generated sources compile; Swift and Android archives pass integrity checks.

Consumer validation

• iOS branch e72a87566f672c14f4b7b5a32f72cb6615262270 compiled against the rc.67 API-equivalent XCFramework before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Swift unchanged. After the expected enum-payload compatibility adaptation, Accepted, rejected, failed, timed-out, not-dispatched, maximum-send, and wrapped-error tests passed: 7 passed, 0 failed, 0 skipped.
• Android branch e733f9c4ed4dbed701a640fe58c3799717c77b0b compiled against the rc.67 API-equivalent Maven AAR before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Kotlin unchanged. Repository and UI accepted/rejected send-path tests passed: 5 passed.
• Earlier live consumer journeys proved the product behavior end to end: accepted iOS tx 24b2dd80ebdca0610fdc2e90b589b810bd9fd2781cc33de8a55b63e6020b44f9 and Android tx bd2fb7e01eb49fefc70fc46be9466d3f209999c1668cdd9ec2aeaac1dfab703a reached mempool/activity/success; rejected iOS tx feeb000e379dc52d1c140f3fd8a01edfa7dfb29f12a8e670ab1b99a7a33f7b7a and Android tx 481280340d1e5507079c771de07ab8d0c13ace14203f6e0d508c9250ab09726b propagated RPC -26, stayed absent from mempool/chain/activity, and did not show success.
• Both consumer worktrees were restored to their committed production rc.63 wiring and are clean. No consumer branch or artifact was published.

Release

• No tag or release was created. rc.67 may be released from the fully pushed PR head only after a non-author approval, all required checks, and PR fix: sigabrt runtime teardown #111's rc.66 ordering are resolved. Add the release link here before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed2026-09-02T13:21:31.826968Z	550b991	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:92486e5695

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:431c6f9f29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit:550b991771

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ben-kaufman]

Reminder to run ./bindgen.sh before merge. The UDL now returns PendingBroadcastInfo, but the checked-in Swift, Kotlin, and Python bindings still return Txid, so they need to be regenerated together with the native artifacts and the Package.swift checksum.

[ben-kaufman]

note_locally_applied_unconfirmed runs before backend dispatch, but these markers are emitted unconditionally. In particular, reject_rbf_broadcast does not remove the rejected replacement marker, and a transaction confirmed before the first sync can emit Confirmed followed by Received. Could we clear the marker on RBF rejection and skip absent or already-confirmed transactions here?

[ben-kaufman]

write_broadcast_intent runs before next_broadcast_timestamp. If an existing lineage contains u64::MAX - 1, the timestamp call fails after the new active replacement has been persisted but before BDK records it. Restart then fails while reapplying the missing active transaction. Could we calculate the timestamp before persisting the replacement, or roll the intent back, and add an RBF restart test for this boundary?

[ovitrif]

Closes#112

Summary

• Wait for the configured backend result before explicit on-chain sends report acceptance.
• Return transaction-keyed rejected, not-dispatched, acceptance-unknown failure, and acceptance-unknown timeout errors through Rust, Swift, Kotlin, and Python.
• Persist every possibly dispatched transaction and its complete RBF lineage before broadcast, reserve its inputs across restart, expose pending transaction IDs, and support exact-byte rebroadcast or explicit abandonment after external reconciliation.
• Derive abandonment timestamps inside the aggregate wallet from wall time and tracked observation/eviction state; overflow fails before mutation.
• Keep LDK-managed broadcasts fire-and-forget on a dedicated priority queue.
• Require backend evidence before reconciliation, preserve only the canonical payment record, and make confirmation cleanup crash-safe across BDK, payment-store, and intent-store persistence failures.
• Classify Bitcoin Core, Electrum, and Esplora responses conservatively, including already-known acceptance and returned-txid mismatch rejection.
• Publish the breaking binding contract as 0.7.0-rc.67; PR fix: sigabrt runtime teardown #111 reserves rc.66.

Preview

N/A — no user-visible changes.

QA Notes

• A deterministic backend rejection does not reach the consumer success path and does not create sent activity.
• A timeout or operational failure after dispatch carries the original transaction ID. Consumers must reconcile or call rebroadcast_transaction for that exact ID; they must not create a second payment.
• list_pending_broadcasts enumerates unresolved IDs. abandon_pending_broadcast is valid only after the caller proves the entire payment lineage absent from mempool and chain.
• Swift unit NodeError cases no longer carry the legacy generated message value. The four broadcast-result cases carry txid.
• Kotlin unit NodeException cases now have empty generated messages. The four broadcast-result cases carry txid.

Validation

• Exact PR head: 550b99177102ba1bc5d01f9c41160765993a3520; local HEAD and upstream match; worktree clean.
• cargo fmt --check and git diff --check: passed.
• cargo build --all-targets --locked: passed. Existing target-name, unused-import, and unused-variable warnings remain outside this change.
• cargo test --lib: 131 passed.
• cargo test --features uniffi --lib: 141 passed; only the repository's existing UniFFI warnings were emitted.
• cargo test --doc: 13 passed.
• cargo test --features uniffi --doc: 13 passed.
• cargo test --test multi_address_types_tests rbf::test_rbf_cross_wallet_transaction -- --exact --nocapture: passed against real bitcoind and electrs.
• onchain_transaction_evicted_event: accepted-send indexing and pending-intent assertions passed; the final eviction injection is guarded and skipped because the bundled Bitcoin Core lacks removetx.
• The dedicated splice integration test reaches the same pre-existing On-chain transaction signing failed path and wait on both base 03ccac798aeb907c6dda367fa4c8af6e3eaa54fa and this branch.
• ./bindgen.sh: passed the JVM build/publish graph, Python generation, Swift XCFramework assembly, Android three-ABI build, DWARF/strip validation, 16 KiB alignment validation, native-debug-symbol packaging, and Maven Local publication.
• Generated Swift archive SHA256: d6ccac3a6a013fbb5313d49faf4d3373b14053ede91923e9a1cd4f3230c6848c; Package.swift matches.
• Generated Android AAR SHA256: 36ce1902372a5e6be38b93debce365445c878efa646c7ffc0697150648ad2f63; Maven Local and the bindgen output match byte-for-byte.
• Kotlin Android/JVM common bindings match; Python generated sources compile; Swift and Android archives pass integrity checks.

Consumer validation

• iOS branch e72a87566f672c14f4b7b5a32f72cb6615262270 compiled against the rc.67 API-equivalent XCFramework before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Swift unchanged. After the expected enum-payload compatibility adaptation, Accepted, rejected, failed, timed-out, not-dispatched, maximum-send, and wrapped-error tests passed: 7 passed, 0 failed, 0 skipped.
• Android branch e733f9c4ed4dbed701a640fe58c3799717c77b0b compiled against the rc.67 API-equivalent Maven AAR before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Kotlin unchanged. Repository and UI accepted/rejected send-path tests passed: 5 passed.
• Earlier live consumer journeys proved the product behavior end to end: accepted iOS tx 24b2dd80ebdca0610fdc2e90b589b810bd9fd2781cc33de8a55b63e6020b44f9 and Android tx bd2fb7e01eb49fefc70fc46be9466d3f209999c1668cdd9ec2aeaac1dfab703a reached mempool/activity/success; rejected iOS tx feeb000e379dc52d1c140f3fd8a01edfa7dfb29f12a8e670ab1b99a7a33f7b7a and Android tx 481280340d1e5507079c771de07ab8d0c13ace14203f6e0d508c9250ab09726b propagated RPC -26, stayed absent from mempool/chain/activity, and did not show success.
• Both consumer worktrees were restored to their committed production rc.63 wiring and are clean. No consumer branch or artifact was published.

Release

• No tag or release was created. rc.67 may be released from the fully pushed PR head only after a non-author approval, all required checks, and PR fix: sigabrt runtime teardown #111's rc.66 ordering are resolved. Add the release link here before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed2026-09-02T13:21:31.826968Z	550b991	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:92486e5695

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:431c6f9f29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit:550b991771

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ben-kaufman]

Reminder to run ./bindgen.sh before merge. The UDL now returns PendingBroadcastInfo, but the checked-in Swift, Kotlin, and Python bindings still return Txid, so they need to be regenerated together with the native artifacts and the Package.swift checksum.

[ben-kaufman]

note_locally_applied_unconfirmed runs before backend dispatch, but these markers are emitted unconditionally. In particular, reject_rbf_broadcast does not remove the rejected replacement marker, and a transaction confirmed before the first sync can emit Confirmed followed by Received. Could we clear the marker on RBF rejection and skip absent or already-confirmed transactions here?

[ben-kaufman]

write_broadcast_intent runs before next_broadcast_timestamp. If an existing lineage contains u64::MAX - 1, the timestamp call fails after the new active replacement has been persisted but before BDK records it. Restart then fails while reapplying the missing active transaction. Could we calculate the timestamp before persisting the replacement, or roll the intent back, and add an RBF restart test for this boundary?

[ovitrif]

Closes#112

Summary

• Wait for the configured backend result before explicit on-chain sends report acceptance.
• Return transaction-keyed rejected, not-dispatched, acceptance-unknown failure, and acceptance-unknown timeout errors through Rust, Swift, Kotlin, and Python.
• Persist every possibly dispatched transaction and its complete RBF lineage before broadcast, reserve its inputs across restart, expose pending transaction IDs, and support exact-byte rebroadcast or explicit abandonment after external reconciliation.
• Derive abandonment timestamps inside the aggregate wallet from wall time and tracked observation/eviction state; overflow fails before mutation.
• Keep LDK-managed broadcasts fire-and-forget on a dedicated priority queue.
• Require backend evidence before reconciliation, preserve only the canonical payment record, and make confirmation cleanup crash-safe across BDK, payment-store, and intent-store persistence failures.
• Classify Bitcoin Core, Electrum, and Esplora responses conservatively, including already-known acceptance and returned-txid mismatch rejection.
• Publish the breaking binding contract as 0.7.0-rc.67; PR fix: sigabrt runtime teardown #111 reserves rc.66.

Preview

N/A — no user-visible changes.

QA Notes

• A deterministic backend rejection does not reach the consumer success path and does not create sent activity.
• A timeout or operational failure after dispatch carries the original transaction ID. Consumers must reconcile or call rebroadcast_transaction for that exact ID; they must not create a second payment.
• list_pending_broadcasts enumerates unresolved IDs. abandon_pending_broadcast is valid only after the caller proves the entire payment lineage absent from mempool and chain.
• Swift unit NodeError cases no longer carry the legacy generated message value. The four broadcast-result cases carry txid.
• Kotlin unit NodeException cases now have empty generated messages. The four broadcast-result cases carry txid.

Validation

• Exact PR head: 550b99177102ba1bc5d01f9c41160765993a3520; local HEAD and upstream match; worktree clean.
• cargo fmt --check and git diff --check: passed.
• cargo build --all-targets --locked: passed. Existing target-name, unused-import, and unused-variable warnings remain outside this change.
• cargo test --lib: 131 passed.
• cargo test --features uniffi --lib: 141 passed; only the repository's existing UniFFI warnings were emitted.
• cargo test --doc: 13 passed.
• cargo test --features uniffi --doc: 13 passed.
• cargo test --test multi_address_types_tests rbf::test_rbf_cross_wallet_transaction -- --exact --nocapture: passed against real bitcoind and electrs.
• onchain_transaction_evicted_event: accepted-send indexing and pending-intent assertions passed; the final eviction injection is guarded and skipped because the bundled Bitcoin Core lacks removetx.
• The dedicated splice integration test reaches the same pre-existing On-chain transaction signing failed path and wait on both base 03ccac798aeb907c6dda367fa4c8af6e3eaa54fa and this branch.
• ./bindgen.sh: passed the JVM build/publish graph, Python generation, Swift XCFramework assembly, Android three-ABI build, DWARF/strip validation, 16 KiB alignment validation, native-debug-symbol packaging, and Maven Local publication.
• Generated Swift archive SHA256: d6ccac3a6a013fbb5313d49faf4d3373b14053ede91923e9a1cd4f3230c6848c; Package.swift matches.
• Generated Android AAR SHA256: 36ce1902372a5e6be38b93debce365445c878efa646c7ffc0697150648ad2f63; Maven Local and the bindgen output match byte-for-byte.
• Kotlin Android/JVM common bindings match; Python generated sources compile; Swift and Android archives pass integrity checks.

Consumer validation

• iOS branch e72a87566f672c14f4b7b5a32f72cb6615262270 compiled against the rc.67 API-equivalent XCFramework before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Swift unchanged. After the expected enum-payload compatibility adaptation, Accepted, rejected, failed, timed-out, not-dispatched, maximum-send, and wrapped-error tests passed: 7 passed, 0 failed, 0 skipped.
• Android branch e733f9c4ed4dbed701a640fe58c3799717c77b0b compiled against the rc.67 API-equivalent Maven AAR before the internal timestamp-only follow-up; final bindgen regenerated only native runtime artifacts and left generated Kotlin unchanged. Repository and UI accepted/rejected send-path tests passed: 5 passed.
• Earlier live consumer journeys proved the product behavior end to end: accepted iOS tx 24b2dd80ebdca0610fdc2e90b589b810bd9fd2781cc33de8a55b63e6020b44f9 and Android tx bd2fb7e01eb49fefc70fc46be9466d3f209999c1668cdd9ec2aeaac1dfab703a reached mempool/activity/success; rejected iOS tx feeb000e379dc52d1c140f3fd8a01edfa7dfb29f12a8e670ab1b99a7a33f7b7a and Android tx 481280340d1e5507079c771de07ab8d0c13ace14203f6e0d508c9250ab09726b propagated RPC -26, stayed absent from mempool/chain/activity, and did not show success.
• Both consumer worktrees were restored to their committed production rc.63 wiring and are clean. No consumer branch or artifact was published.

Release

• No tag or release was created. rc.67 may be released from the fully pushed PR head only after a non-author approval, all required checks, and PR fix: sigabrt runtime teardown #111's rc.66 ordering are resolved. Add the release link here before merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed2026-09-02T13:21:31.826968Z	550b991	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:92486e5695

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:431c6f9f29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ovitrif]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit:550b991771

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ben-kaufman]

Reminder to run ./bindgen.sh before merge. The UDL now returns PendingBroadcastInfo, but the checked-in Swift, Kotlin, and Python bindings still return Txid, so they need to be regenerated together with the native artifacts and the Package.swift checksum.

[ben-kaufman]

note_locally_applied_unconfirmed runs before backend dispatch, but these markers are emitted unconditionally. In particular, reject_rbf_broadcast does not remove the rejected replacement marker, and a transaction confirmed before the first sync can emit Confirmed followed by Received. Could we clear the marker on RBF rejection and skip absent or already-confirmed transactions here?

[ben-kaufman]

write_broadcast_intent runs before next_broadcast_timestamp. If an existing lineage contains u64::MAX - 1, the timestamp call fails after the new active replacement has been persisted but before BDK records it. Restart then fails while reapplying the missing active transaction. Could we calculate the timestamp before persisting the replacement, or roll the intent back, and add an RBF restart test for this boundary?