Core Lightning

ci: reduce sanitizer/valgrind worker count to avoid runner OOM

The ASan/UBSan and Valgrind shards intermittently have their hosted
runner killed mid-run with "The runner has received a shutdown signal",
surfaced as a mass test cancellation. The VM itself is being
terminated, most likely from memory exhaustion: `-n $(nproc)+1` runs 5
parallel node-clusters and ASan roughly triples RSS, peaking past the
16GB hosted-runner ceiling on heavy shards (deterministic repro at ~10%
on ASan/UBSan 3/6 due to the fixed --test-group-random-seed=42).

Drop these two jobs to `-n $(nproc)` (one fewer worker) to lower peak
memory, and add an `if: failure()` step that dumps OOM-related dmesg and
kernel-log lines so the next failure records the actual cause.

Changelog-None

connectd/tests: fix test_announce_and_connect_via_dns on macOS

localhost.localdomain is not present in /etc/hosts on macOS by default,
so the test's DNS-resolve step fails immediately. Any hostname that
does resolve on macOS (e.g. test.localhost via mDNSResponder) causes
mDNSResponder to open temporary sockets which dev_report_fds() flags
as unowned (BROKEN) at teardown.

Skip the test explicitly on macOS with @unittest.skipIf so the reason
is visible and trackable. A follow-up can fix dev_report_fds to
tolerate resolver sockets and re-enable the test on macOS.

Changelog-None

closingd: add `lightning_simpleclosed` for `option_simple_close`

New subdaemon implementing the BOLT2 simple close protocol, replacing `lightning_closingd` when `option_simple_close` is negotiated:
- Each peer independently sends `closing_complete` with their fee proposal;
- The other side signs it and sends `closing_sig`;
- Both sides broadcast two conflicting closing transactions and whichever confirms first wins.

Key protocol details:
- Closer pays the fee and closee receives their exact channel balance;
- TLV variants selected per BOLT2: `closer_output_only`, `closer_and_closee_outputs`, `closee_output_only`;
- Sequence 0xFFFFFFFD enables RBF via re-sending `closing_complete`;
- Script mismatch on `closee_scriptpubkey` warns and fails to reconnect;

common/shutdown_scriptpubkey.h/c: removed `static` from `is_valid_op_return` so it can be used in `simpleclosed.c`

lightningd: wire up `option_simple_close` master-side handling

Adds the master-side glue for the `simpleclosed` subdaemon and removes the xfail markers from the integration tests:
- simple_close_control.c:
- starts the daemon with feerate bounds and shutdown scripts;
- handles SIMPLECLOSED_GOT_SIG (broadcast closer tx), SIMPLECLOSED_CLOSEE_BROADCAST (broadcast closee tx), and SIMPLECLOSED_COMPLETE (advance state, resolve close RPC)
- channel_control.c: route to peer_start_simpleclosed() instead of peer_start_closingd() when OPT_SIMPLE_CLOSE is negotiated;
- peer_control.c: drop_to_chain_simple_close() sets up the funding-spend watch and resolves the close RPC without broadcasting the commitment tx, avoids it RBF-replacing the mutual close txs;
- resend_closing_transactions() uses the same variant on restart

Changelog-Experimental: Protocol: implement `option_simple_close` (BOLT2) for simpler one-shot mutual close fee negotiation. Enable with --dev-force-features=+60.

test: add run-close_tx to validate simple-close transaction functionality

simpleclosed.c: add heuristic to delay our tx broadcast if our amount is less AND our fee is less than our peer's amount and fee
in case of a reboot the tx will be broadcast as usual.

simple_close_control.c: add delay logic to `drop_to_chain` after 1 hour.
test_closing.py: add test to verify the heuristic is being applied.

channeld: reject `closing_complete` and `closing_sig` with a clear error

When `option_simple_close` is negotiated the master launches `simpleclosed`
after `channeld` exits, so `closing_complete` and `closing_sig` should never
arrive inside `channeld`. Add stubs that call peer_failed_warn() with an
informative message rather than hitting the default unknown-message path.

common/close_tx: add `create_simple_close_tx()` for `option_simple_close`

Adds the BOLT3 simple closing transaction builder:
- sequence 0xFFFFFFFD (RBF-signalling)
- locktime from closing_complete
- closer pays fee (their output is reduced)
- dust outputs are omitted and a zero-value OP_RETURN is used when both outputs would be dust.

common: add `OPT_SIMPLE_CLOSE` feature bit (60/61)

features.h: Reserves bits 60/61 for `option_simple_close` per BOLT2.
features.c: Add `OPT_SIMPLE_CLOSE` to `feature_styles[]` and declare the correct `feature_name`.
tests/test_closing.py: Update options on `test_simple_close_...` to include `{experimental-simple-close: None}`.
lightningd/options.c: Register noarg option for simple close.
doc/schemas/listconfigs.json: add `experimental-simple-close` to config targeting v26.08.
doc/lightningd-config.5.md: Specify `experimental-simple-close` option.
contrib/pyln-testing/pyln/testing/utils.py: Allow setting `EXPERIMENTAL_SIMPLE_CLOSE` on tests.

Generated files after modifying sources.

tests: `add option_simple_close` integration tests

Four tests for the `option_simple_close` protocol (BOLT #2, bit 60). `test_simple_close_no_feature_fallback` exercises the existing legacy `closingd` path and passes now; the other three are marked xfail until the implementation lands:

- test_simple_close_basic: happy path; both nodes exchange
closing_complete/closing_sig, each broadcasts two conflicting txs,
the winner confirms, both nodes detect their output CONFIRMED
- test_simple_close_closer_pays_fee: closer bears the fee, closee
receives their exact pre-close balance
- test_simple_close_dust_output_omitted: closee output below dust is
omitted from the closing tx (closer_output_only variant)
- test_simple_close_no_feature_fallback: without bit 60, nodes fall
back to legacy closingd
- test_simple_close_restart: re-transmit our simple_close transaction after restart
- test_simple_close_closee_path: the closee (peer) transaction is stored

CI: Check generated docs on Mac

Test that the docs generated on Mac match the docs in the commit

Changelog-None

Add Blockstream info and badge in README

Closes #9263.

Changelog-None.

docs: update changelog

pytest: listpays: test grouping by calling xpay

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

listsendpays: discriminate ongoing payment by groupid

A payment attempt in listpays is defined as pair (payment hash, group id).
If we query xpay for ongoing payments we must discriminate
using both values.

Fixes flaky test tests/test_pay.py:test_sendpay_grouping
```
FAILED tests/test_pay.py::test_sendpay_grouping - AssertionError: assert ['pending', 'pending', 'complete'] == ['failed', 'failed', 'complete']
```

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

devtools: add --markdown output to credit for release notes

Generate a comprehensive contributor list ordered by commits, with a
separate section for first-time contributors, so release notes no longer
need manually maintained lists.

Co-Authored-By: Cursor <cursoragent@cursor.com>

makefile: update: update-ccan

Update update-ccan recipe to use ccan's commit instead of tag since ccan's home moved to github

Changelog-None

ccan: update ccan to efd48386

- readme: remove reference to old domain and point to rustyrussell/ccan

tests: fix flaky bwatch 1-block reorg test

The test mined a block and then reorged it, but it did not wait until bwatch had actually seen that block first.

Sometimes bwatch was still one block behind. In that case, the replacement
block looked like a normal new block, not a reorg, so the test waited forever for "Reorg detected".

Wait until bwatch has stored the block before reorging it.

currencyrate: vendor root certificates with webpki-roots

minimal setups without `ca-certificates` would cause cln-currencyrate to immediately exit with
`builder error`

We vendor the root certificates and improve the error message.

reported by @nepet

Changelog-Fixed: cln-currencyrate: include root certificates to fix the `builder error` on OS's without root certificates

release: CHANGELOG and version bumps for v26.06.2

security: sync both security policy files

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

ci: check that security and docs are synced

Changelog-None

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

repro: add automake as explicit dependency

noble builds were failing because of a missing aclocal
usual recommendation is to install automake which apparently no longer
is in the dependency graph for noble

we add it to all ubuntu images in case it gets removed in jammy/resolute as well

Changelog-None

pytest: test to reproduce failed to retransmit funding transaction

`resend_opening_transactions` gated on `channel->depth != 0`, but depth is reset to 0 when channels are loaded from the DB and only repopulated `after begin_topology()` runs. So at startup every channel matched and `bitcoind` rejected the rebroadcast with error `-27` ("Transaction outputs already in utxo set"), facing as an `UNUSUAL` log.

Changelog-Fixed: lightningd: don't spuriously try to re-broadcast funding txs of already-confirmed channels on startup.