Core Lightning

doc: add notification schemas for native topics

Add schema definitions for the documented native notifications which were
still only described in prose.

This makes the notification payloads available in doc/schemas so msggen can
consume them in later commits, while keeping this commit schema-only.

The balance_snapshot schema follows the current implementation shape:
the notification wrapper contains a single balance_snapshot object whose
accounts field is an array of account snapshots.

doc: add flat xpay notification schemas

Add schema files for the documented xpay notifications using the temporary
flat naming convention.

These topics are plugin-emitted rather than native lightningd notifications,
so keep them separate from msggen generation for now while still recording
their subscriber-visible payload shape in doc/schemas.

msggen: generate native notification bindings from schemas

Expand the native notification list consumed by msggen and regenerate the Rust and gRPC outputs for the documented notification schemas.

This wires the new schema-backed native notifications through cln-rpc, cln-grpc, and the bundled msggen schema metadata. Keep the temporary xpay-prefixed plugin notifications out of generation for now.

coin_movement.extra_tags remains a repeated string in the generated gRPC surface for now because msggen does not currently emit enums nested under repeated array items correctly.

Changelog-Changed: cln-rpc and cln-grpc now expose notification bindings for balance_snapshot, coin_movement, deprecated_oneshot, disconnect, forward_event, invoice_creation, invoice_payment, log, onionmessage_forward_fail, openchannel_peer_sigs, plugin_started, plugin_stopped, sendpay_failure, sendpay_success, shutdown, and warning.

msggen: generate xpay notification bindings

Treat xpay as a built-in plugin for notification generation and include its documented notification schemas in the msggen output.

This extends the generated cln-rpc and cln-grpc notification surfaces with the flat xpay schema files, while exposing the actual notification names `pay_part_start` and `pay_part_end` in generated APIs.

Changelog-Changed: cln-rpc and cln-grpc now expose xpay notification bindings for `pay_part_start` and `pay_part_end`.

pytest: fix flake in test_easy_splice_out_into_channel

```
2026-04-01T07:56:01.0560642Z > assert 'inflight' not in p1
2026-04-01T07:56:01.0581633Z E AssertionError: assert 'inflight' not in {'peer_id': '033845802d25b4e074ccfd7cd8b339a41dc75bf9978a034800444b51d42b07799a', 'peer_connected': True, 'reestablished': True, 'channel_type': {'bits': [12, 22], 'names': ['static_remotekey/even', 'anchors/even']}, 'updates': {'local': {'htlc_minimum_msat': 0, 'htlc_maximum_msat': 990000000, 'cltv_expiry_delta': 6, 'fee_base_msat': 1, 'fee_proportional_millionths': 10}, 'remote': {'htlc_minimum_msat': 0, 'htlc_maximum_msat': 990000000, 'cltv_expiry_delta': 6, 'fee_base_msat': 1, 'fee_proportional_millionths': 10}}, 'state': 'CHANNELD_AWAITING_SPLICE', 'scratch_txid': 'bf969125a0929605ba1e007912173fbf55cc67e19963e6d87a66066b7d764d9d', 'last_tx_fee_msat': 4545000, 'lost_state': False, 'feerate': {'perkw': 3750, 'perkb': 15000}, 'owner': 'channeld', 'short_channel_id': '103x2x0', 'direction': 1, 'channel_id': '68c2b5982e67b7dbd42d310e2dd481831c5add0d6a541fec6e26d000fd0ea0f4', 'funding_txid': 'f4a00efd00d0266eec1f546a0ddd5a1c8381d42d0e312dd4dbb7672e98b5c268', 'funding_outnum': 0, 'initial_feerate': '939perkw', 'last_feerate': '939perkw', 'next_feerate': '978perkw', 'inflight': [{'funding_txid': '88f913adf41749a106c97cea7a6f6e448efa73fc6bc9325b78802188d8b0b67d', 'funding_outnum': 1, 'feerate': '939perkw', 'total_funding_msat': 1100000000, 'our_funding_msat': 1000000000, 'splice_amount': 0, 'scratch_txid': '1076f7048d0c1debb7bf2e1d448b3f1345a6973e24dc6a2fadade67ef75133aa'}], 'close_to_addr': 'bcrt1p9r2qj40kfad955p2arkd70lpyh0epugjljrm2djh6483kqffg04q9fufhw', 'close_to': '512028d40955f64f5a5a502ae8ecdf3fe125df90f112fc87b53657d54f1b012943ea', 'private': False, 'opener': 'local', 'alias': {'local': '7654047x8069664x16198', 'remote': '14528636x6434403x24187'}, 'features': ['option_static_remotekey', 'option_anchors'], 'funding': {'local_funds_msat': 1000000000, 'remote_funds_msat': 0, 'pushed_msat': 0, 'psbt': 'cHNidP8BAgQCAAAAAQMEZgAAAAEEAQEBBQECAQYBAwH7BAIAAAAAAQBxAgAAAAE/IGufqbpSEgvYbw685nDEyMxGKL9FlQilR593oz4l8wAAAAAA/f///wLzbOcpAQAAABYAFLikxoEHURUNIRqJZO+hZBpDIRdbgIQeAAAAAAAWABTiR1/vOKdPfmxe7PFjWeVXM/PEamUAAAABAR+AhB4AAAAAABYAFOJHX+84p09+bF7s8WNZ5Vcz88RqAQhrAkcwRAIgffBOLzpOGluuXVQL3+Nh57/v1KiZMmTQ8azbTp1uvq8CIEEJMg/FcFFBRhJEEj7+qSAWJ1zYMoTRkLXnz2kYn1t+ASECAuzPYkKg0uX0lzjSQPmcEN8Qg4GvjKKB1Kggpt1l4X8BDiBsxRVtCsARg7eO1wBCa1Q9QSO1uVsgKM0CdYaTNqNDaQEPBAEAAAABEAT9////DPwJbGlnaHRuaW5nAgIAAQz8CWxpZ2h0bmluZwEItnNGZ/Bz25IAAQMIQEIPAAAAAAABBCIAIAudZByKBPnrEYNlicb4obXo+9D41IAxB52EsOTPC6lrAAEDCAEvDwAAAAAAAQQiUSCfpNJOnaQ8W/j8DZc21ORFI4rNcU0GgRbfUWXQeR26HSEHoyOuZ721tL0aN6eJJY4wZEeSiAU21KuPQRiZUZCCbScJAIgBXIECAAAADPwJbGlnaHRuaW5nAQixrSLGhyK6fAA=', 'withheld': False}, 'to_us_msat': 1000000000, 'min_to_us_msat': 1000000000, 'max_to_us_msat': 1000000000, 'total_msat': 1000000000, 'fee_base_msat': 1, 'fee_proportional_millionths': 10, 'dust_limit_msat': 546000, 'their_max_htlc_value_in_flight_msat': 18446744073709551615, 'our_max_htlc_value_in_flight_msat': 18446744073709551615, 'their_reserve_msat': 10000000, 'our_reserve_msat': 10000000, 'spendable_msat': 978718000, 'receivable_msat': 0, 'minimum_htlc_in_msat': 0, 'minimum_htlc_out_msat': 0, 'maximum_htlc_out_msat': 990000000, 'their_to_self_delay': 5, 'our_to_self_delay': 5, 'max_accepted_htlcs': 483, 'state_changes': [{'timestamp': '2026-04-01T07:52:32.735Z', 'old_state': 'CHANNELD_AWAITING_LOCKIN', 'new_state': 'CHANNELD_NORMAL', 'cause': 'user', 'message': 'Lockin complete'}, {'timestamp': '2026-04-01T07:52:51.053Z', 'old_state': 'CHANNELD_NORMAL', 'new_state': 'CHANNELD_AWAITING_SPLICE', 'cause': 'remote', 'message': 'Splice signatures sent'}], 'status': ['CHANNELD_NORMAL:Channel ready for use.'], 'in_payments_offered': 0, 'in_offered_msat': 0, 'in_payments_fulfilled': 0, 'in_fulfilled_msat': 0, 'out_payments_offered': 0, 'out_offered_msat': 0, 'out_payments_fulfilled': 0, 'out_fulfilled_msat': 0, 'htlcs': []}
2026-04-01T07:56:01.0603053Z
2026-04-01T07:56:01.0607410Z tests/test_splice.py:713: AssertionError
```

We need to wait for this, as l1 and l3 may not have seen block yet.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

connectd: remove DNS seeds entirely.

For 25.05 (0a94f3b5706cd06e69ca120f1b77da8562cd2453) we removed DNS lookups,
but we left them for the corner case where a proxy is used. darosior points
out that his is no longer functional, which brought my attention to this
vestigial corner case.

Changelog-None: we said we'd removed them earlier!
Reported-by: darosior
Closes: https://github.com/ElementsProject/lightning/pull/8968
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lightningd: refuse to let a peer open a channel if we have no fee estimates.

This seems a sensible precaution anyway.

Changelog-Changed: lightningd: we don't allow new incoming channels if we cannot estimate fees (rather than assuming minfee).
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

tests: test reproduce #8863
[ Neated and added xfail -- RR ]

pytest: removed old test

lightningd: don't hand 0 to dualopend as anchor feerate if we cannot estimate fees.

Fixes: https://github.com/ElementsProject/lightning/issues/8847
Reported-by: https://github.com/mdance
Changelog-EXPERIMENTAL: fixed crash with dual funding if we cannot estimate fees.

common: allow current_feerate under 253 in marginal_feerate().

We don't allow this for now (by spec!), but in case we ever did we
should not try to enforce it here!

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

pytest: test that we refuse incoming open requests if we have no feerates.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: use amount hints in find_best_peer for blinded paths.

This lets us reliably eliminate peers which can't give us anything
when seeking blinded paths for invoices.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

tests: add an xpay test to reproduce a regression where we pay fees in a direct route

Changelog-None

offers: when creating an invoice for an offer, only reuse fronting paths.

Now we know whether blinded paths in the offer were added explicitly
(by the fronting_nodes option to the `offer command, or via the
`payment-fronting-node` config option) we know whether we need to use
them when minting an invoice.

Previously when I introduced fronting nodes in this release, we
*always* reused them. But that's not quite right: the blinded path
for the offer can use any peer, but for the invoice we need to use
a peer with sufficient capacity to pay us. For some offers we won't
even know the amount at the time the offer is made.

So now we only force reuse of the offer's paths when they were set by
the user in the first place: otherwise, we can be more flexible in
path selection when minting the invoice. This is consistent with what
we did before introducing fronting.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

pytest: demonstrate the weird 0 htlc_maximum_msat problem.

It depends on gossip_store order, so it's not reliable.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

createonion: add `force_paths` parameter.

We simply store it in the db, and return it with `listoffers` for now.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

decode: print htlc_minimum_msat / htlc_maximum_msat in blinded paths.

Weird we didn't print this before!

Reported-by: https://github.com/Lagrang3
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: set `force_paths` on offer if fronting nodes are used.

When an invoice request comes in, this will let us know that we need to
limit ourselves to the blinded paths, as they have been forced by the user.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

plugins/sql: rename `update_stmt` to `insert_stmt`.

The current variable name is confusing, since it's an INSERT!

This becomes more noticible in the next patch, where we add a delete statement.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

plugins/sql: support updates for tables with `created_index` values.

For these, when things change, we simply delete amd recreate the
changed entries.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Changed: Plugins: `sql` plugin tables "htlcs", "forwards", "invoices", "sendpays" and "networkevents" are now updated more efficiently.

pytest: add sql change test.

This is trivial now, as the invoice table gets reloaded every time,
but is an important check as we improve the implementation.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

plugins/sql: add a delete_statement to toplevel tables with created_index values.

This will let us (efficiently) delete a single entry, so we can wean
tables with created_index off the default "delete all and reload" behavior.

Change insert_stmt to a const, too (and use a temporary when we're
building it).

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

sql: keep persistent watches on tables.

We now always watch for deleted/created/updated, and keep multiple
flags and indices (though we don't use them yet!).

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

plugins/sql: use td->last_created_index directly, don't stash it in dbq.

We can actually just make struct table_desc non-const where required,
and hand its var directly.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

plugins/sql: remove unneeded TODO entries.

1. Refresh time would say "dont refresh if it's only this old" but
better is to simply make refresh more efficient, which we've done
and continue to do.
2. time_msec could be used in two places, but floating point suffices.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

plugins/sql: keep track of last `updated_index` value in tables.

We're going to need this once we start using `wait updated` to track
these.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>