repro: an error inside update_spent_notes drops the wallet shard trees

[dorianvp]

Claim

mem-take-leaves-empty-shard-trees: update_spent_notes in pepper-sync/src/sync/spend.rs:290 moves the wallet's shard trees out with std::mem::take(wallet.get_shard_trees_mut()?) and only writes them back at pepper-sync/src/sync/spend.rs:322 on the happy path. If get_wallet_transactions_mut()? at line 291 or the second get_shard_trees_mut()? at line 322 returns an error, or if update_spent_notes_by_protocol panics, the wallet is left holding ShardTrees::default() and all witness data is lost. The returned Err does not report the loss.

What the test does

sync::spend::tests::failed_spent_note_update_keeps_wallet_shard_trees wraps MockWallet in a local FailingTransactionsWallet whose get_wallet_transactions_mut returns an error. The inner shard trees hold an Orchard checkpoint at height 5. The test calls update_spent_notes with empty spend maps, asserts it returns Err, and then asserts the checkpoint is still present in the wallet's shard trees.

Observed output

thread 'sync::spend::tests::failed_spent_note_update_keeps_wallet_shard_trees' panicked at pepper-sync/src/sync/spend.rs:582:9:
assertion `left == right` failed: shard trees must survive a failed spent note update
  left: Some(BlockHeight(0))
 right: Some(BlockHeight(5))

The checkpoint at height 5 is gone and the wallet holds a fresh empty tree.

The write_shardtree site in pepper-sync/src/wallet/serialization.rs (the second site in the claim) is not covered here because it needs a panicking writer and catch_unwind.

This PR is a reproduction only and does not include a fix. The sync-bench A/B rule was not run because the commit adds a test only.

🤖 Generated with Claude Code