Core Lightning

ci: Enable sccache compiler cache for Rust and C

[ Cherry-picked from another PR, and read the docs which say you have
to set SCCACHE_GHA_ENABLED to get inter-job caching! --RR ]

ccan: import new version to change vsprintfs to vsnprintfs

misc: fix uninitialised errors for macOS

MacOS SDK is quite strict so treats these uninitialised variable warnings as errors.

lightningd: honor `payment-fronting-node` when making bolt12 offers.

We use all the fronting nodes when creating offers.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lightningd: don't assert if plugin crashes early.

If a plugin exits early, we will not exit with ret == plugins: return
from this function and we will exit because ld->exit_code is set.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: allow explicit fronting nodes for an offer.

The next commit makes us honor these when issuing a payment.

Changelog-Added: JSON-RPC: `offer` now has a `fronting_nodes` option to specify neighbors for payer to use to fetch invoices and make payments.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

libplugin: support multi options.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Added: libplugin: support for options which accumulate if specified more than once ("multi": true).

lightningd: add payment-fronting-node option.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Added: Config: `payment-fronting-node` option to specify neighbor node(s) to use for all bolt11 invoices, bolt12 offers, invoices and invoice_requests.

offers: honor `payment-fronting-nodes` when creating invoices.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: modify find_best_peer() to only select from fronting nodes if set.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lightningd: honor `payment-fronting-node` when making bolt11 invoices.

We use all the fronting nodes when creating invoices.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: only use blinded path nodes from offers when creating invoice for invoice_request.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: honor `payment-fronting-nodes` when creating invoice_requests.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: encapsulate globals in plugin_get_data()

This is how modern plugins do it, and it has the benefit of not
requiring extra code for memleak tracking.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

Build: don't use HAVE_FUNCTION_SECTIONS for update-mocks.

I ran `uv run make update-mocks` and many mocks vanished. But that
broke MacOS (and maybe other archs) which doesn't support function
sections and no longer linked.

If this proves problematic, we might end up generating mocks properly:
1. Use #include "mocks-sphinx-xor_cipher_stream_gen.c"
2. Generate those separate files as necessary.
3. Don't commit them, build them locally.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

pytest: fix flake in test_reconnect_remote_sends_no_sigs

Actual order could be either way:

```
FAILED tests/test_connection.py::test_reconnect_remote_sends_no_sigs - AssertionError: assert ['peer_in', 'peer_out'] == ['peer_out', 'peer_in']

At index 0 diff: 'peer_in' != 'peer_out'

Full diff:
[
+ 'peer_in',
'peer_out',
- 'peer_in',
]
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

pytest: really fix race in test_buy_liquidity_ad_check_bookkeeping

I thought I fixed this in b15f386df66b31b55e50bb55195bbf835ad1c4c8,
but it happened again, because my fix was insufficent! "all([])" is
true, and we want to make sure the channel really has been seen.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

pytest: fix test_sendpay_grouping regex.

It doesn't match "after 10 attempts":

```
with pytest.raises(RpcError, match=r'Ran out of routes to try after [1-9]+ attempts'):
> l1.rpc.pay(inv, amount_msat='100001msat')

tests/test_pay.py:5250:
...
elif "error" in resp:
> raise RpcError(method, payload, resp['error'])
E pyln.client.lightning.RpcError: RPC call failed: method: pay, payload: {'bolt11': 'lnbcrt1p5evy5ksp5ndq75geqkggp9jvkal5e36mwpyppf0vm8ftzv7qqv9plkw2u5hkspp53rw3mkve9896muty6wzpjxc6ucau0cvekmakg6ta5h5v0ar07m6qdq8v3jhxccxqyjw5qcqp9rzjqvuytqpdyk6wqaxvl47d3vee5swuwklej79qxjqqg394r4ptqaue5qqqvuqqqqgqqqqqqqqpqqqqqzsqqc9qxpqysgq53phr29544luhuduaqjajvj8d54yep69sy6cqtesk2t3q83htsas8nhluh9jjqm4se274pzzg8ma943xe8a5sg7d286n2vttraqd7dsq8s7k84', 'amount_msat': '100001msat'}, error: {'code': 210, 'message': 'Ran out of routes to try after 10 attempts: see `paystatus`', 'attempts': [{'status': 'failed', 'failreason': 'failed: WIRE_TEMPORARY_CHANNEL_FAILURE (reply from remote)', 'partid': 0, 'amount_msat': 100001}, {'status': 'pending', 'failreason': 'No path found', 'partid': 1, 'amount_msat': 100001, 'parent_partid': 0}, {'status': 'failed', 'failreason': 'failed: WIRE_TEMPORARY_CHANNEL_FAILURE (reply from remote)', 'partid': 2, 'amount_msat': 51394, 'parent_partid': 1}, {'status': 'failed', 'failreason': 'failed: WIRE_TEMPORARY_CHANNEL_FAILURE (reply from remote)', 'partid': 4, 'amount_msat': 51394, 'parent_partid': 2}, {'status': 'failed', 'failreason': 'No path found', 'partid': 6, 'amount_msat': 51394, 'parent_partid': 4}, {'status': 'failed', 'failreason': 'No path found', 'partid': 7, 'amount_msat': 51394, 'parent_partid': 6}, {'status': 'failed', 'failreason': 'failed: WIRE_TEMPORARY_CHANNEL_FAILURE (reply from remote)', 'partid': 3, 'amount_msat': 48607, 'parent_partid': 1}, {'status': 'failed', 'failreason': 'failed: WIRE_TEMPORARY_CHANNEL_FAILURE (reply from remote)', 'partid': 5, 'amount_msat': 48607, 'parent_partid': 3}, {'status': 'failed', 'failreason': 'failed: WIRE_TEMPORARY_CHANNEL_FAILURE (reply from remote)', 'partid': 8, 'amount_msat': 48607, 'parent_partid': 5}, {'status': 'failed', 'failreason': 'No path found', 'partid': 9, 'amount_msat': 48607, 'parent_partid': 8}]}

```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

pytest: fix flake in test_gossip_store_compact_while_extending and test_gossmap_lost_node

node_factory.line_graph waits until all nodes have seen all channels,
not all node announcements, so we can get this:

```
> assert post_nodes == pre_nodes
...
E Full diff:
E [
E {
E + 'addresses': [],
E + 'alias': 'JUNIORYARD-b2d9563',
E + 'color': '02287b',
E + 'features': '808898880a8a59a1',
E + 'last_timestamp': 1771565748,
E 'nodeid': '02287bfac8b99b35477ebe9334eede1e32b189e24644eb701c079614712331cec0',
E },
E {
E 'addresses': [],
E 'alias': 'SILENTGOPHER-b2d9563',
E 'color': '033845',
E 'features': '808898880a8a59a1',
...
tests/test_gossip.py:1710: AssertionError
```

Since the same pattern occurs in test_gossmap_lost_node, fix that too.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

db: add STRICT tables with migration for old databases

Enables STRICT tables in developer mode, but old databases (~2019) may
have BLOB values in TEXT columns. Migration converts BLOB faildetail
to TEXT with UTF-8 validation, NULLs invalid data.

STRICT is only applied to fresh databases; existing databases being
upgraded skip STRICT to avoid type affinity issues with legacy data.

Also adds security pragmas in developer mode: trusted_schema=OFF,
cell_size_check=ON.

Fixes #5390.

Changelog-Added: Database: STRICT tables and security pragmas in developer mode
Changelog-Fixed: Database migration for old BLOB-typed faildetail values

renepay: refactor and bugfixes

We remove the auxiliary RPC renesenday (only used internally) in favor
of a function that builds the onion, stores the shared secrets
needed to recover the onion reply, and calls sendonion/injectpaymentonion.

This solves a concurrency race
```
**BROKEN** plugin-cln-renepay: Unable to parse sendpay_failure
```
in which we are waiting for renesenday to return in order to record the shared
secrets but we get the a sendpay_failure notification with an onionreply
before we have secrets to decode it.

It also solves a missing JSON id seen in the logs
```
DEBUG plugin-cln-renepay: JSON reply with unknown id
```
because renesendpay was using his command variable to issue an RPC
to sendonion/injecpaymentonion and would fail or succeed the command
before those RPCs were done. This also meant that the callback
functions were silently being ignored.

Changelog-Fixed: renepay: fixes a race condition that leads to **BROKEN** plugin-cln-renepay: Unable to parse sendpay_failure

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

fuzz: fix uninitialized variable in fuzz-handle_onion_message

Changelog-Fixed: fuzz: fix build with newer clang.

Fixes: #8683

Add `-O2` in armv7 Docker build following bug fix
Changelog-None

pytest: fix flake in test_gossip_force_broadcast_channel_msgs

With the extra padding pings, we can get more!

```
# Make sure the noise is within reasonable bounds
assert tally['query_short_channel_ids'] <= 1
assert tally['query_channel_range'] <= 1
> assert tally['ping'] <= 3
E assert 4 <= 3

tests/test_gossip.py:2396: AssertionError
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

pytest: make test_no_delay more robust.

Unfortunately the effect of leaving Nagle enabled is subtle. Here it
is in v25.12:

Normal:
tests/test_connection.py::test_no_delay PASSED
====================================================================== 1 passed in 13.87s

Nagle enabled:
tests/test_connection.py::test_no_delay PASSED
====================================================================== 1 passed in 21.70s

So it's hard to both catch this issue and not have false positives. Improve the
test by deliberately running with Nagle enabled, so we can do a direct comparison.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>