fix: R-059 deadlock in with_wallets_from_seeds

[m2ux]

Summary

Fix the guaranteed deadlock in with_wallets_from_seeds (R-059) by restructuring mutex acquisition so the same non-reentrant std::sync::Mutex is no longer locked twice while a guard is still alive. The function now acquires self.wallets exactly once and produces two disjoint &mut Wallet<D> references from one guard via HashMap::get_disjoint_mut.

🎫 Issue 📐 Engineering

---

Motivation

with_wallets_from_seeds in ledger/helpers/src/versions/common/context.rs called self.wallets.lock() and took a &mut Wallet reference from the resulting guard, then attempted to lock the same non-reentrant std::sync::Mutex a second time. The first guard could not drop because origin_wallet borrowed from it, so the second .lock() deadlocked unconditionally on every invocation. The function is called from transient.rs:49, making any code path that triggers it a guaranteed hang.

Eliminating the deadlock is required before any feature work that depends on with_wallets_from_seeds can run reliably, and before tests covering this code path can be exercised end-to-end.

---

Changes

ledger/helpers/src/versions/common/context.rs — body rewrite of with_wallets_from_seeds:

• Acquire self.wallets.lock() exactly once. The two disjoint &mut Wallet<D> references are obtained from a single guard via HashMap::get_disjoint_mut([&origin_seed, &destination_seed]) (stable since Rust 1.86; workspace pin is 1.95).
• Add an up-front assert!(origin_seed != destination_seed, ...) so aliased-seed misuse panics with a specific message ("origin_seed and destination_seed must differ") before the lock is taken, rather than producing the opaque None that get_disjoint_mut returns for aliased keys.
• Map missing-seed None to a panic whose message style matches the existing wallet_for_seed panic ("Wallet with seed ...").
• Add a rustdoc comment above the function naming the two preconditions (single-lock invariant; distinct seeds required).
• Public signature unchanged — FnOnce(&mut Wallet<D>, &mut Wallet<D>) -> R is preserved; the single live caller (transient.rs:49) compiles unchanged.

Regression tests (added to the existing #[cfg(test)] mod tests block):

• with_wallets_from_seeds_does_not_deadlock — runs the fixed call on a worker thread and joins via mpsc::recv_timeout(Duration::from_secs(5)). The 5s wall-clock deadline is several orders of magnitude above the expected return time but well below any plausible CI hard timeout, so it cleanly discriminates "fixed" from "still hung". Also asserts the closure side-effect (an AtomicU64 counter) was observed.
• with_wallets_from_seeds_panics_on_aliased_seed — #[should_panic(expected = "origin_seed and destination_seed must differ")] pins the new aliased-seed panic message.
• with_wallets_from_seeds_panics_on_missing_seed — #[should_panic(expected = "Wallet with seed")] pins the missing-seed panic message.

changes/node/changed/PM-21800-r059-deadlock-with-wallets-from-seeds.md — new change file with #ledger #helpers tags, summary of bug + fix shape, and PR / JIRA links.

---

📌 Submission Checklist

• Changes are backward-compatible (or flagged if breaking)
• Pull request description explains why the change is needed
• Self-reviewed the diff
• I have included a change file, or skipped for this reason: [reason]
• If the changes introduce a new feature, I have bumped the node minor version
• Update documentation (if relevant)
• No new todos introduced

---

🔱 Fork Strategy

• Node Runtime Update
• Node Client Update
• Other
• N/A

---

🗹 TODO before merging

• Ready for review