Core Lightning

lightningd: internal cleanups since all non-command JSON IDs are strings.

In particular, "struct jsonrpc_request"'s id is always a string.
cmd->id isn't, though.

We can also remove the now-unused json_get_id.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: limit invoices to 10 minutes for recurring offers in other currencies.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

fetchinvoice: don't bother with checking recurrence timing.

We don't actually need to enforce this check here: we can make that
the users' responsibility. This simplifies our work quite a lot,
since createinvoicerequest won't have to do a lookup any more.

This can be done by the repeatpay plugin itself.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lightningd: don't crash when truncating large log messages

It's not okay to call free() on the pointer to a truncated log message
that was allocated by tal_fmt() in cap_header(). Let's call tal_free()
instead, and rather than calling vasprintf() to malloc the log message in
the first place, let's call tal_vfmt().

Also, since we're now always using a tallocated string for the log message,
let's have cap_header() take ownership of it and either free it if it
truncated the message (and is returning a different pointer to the truncated
message) or else return the taken original pointer without freeing it.

Also, log_io()'s str and data parameters are marked TAKES, but the function
was not actually taking them, so fix that up too.

Also, don't call strlen() on a string returned by tal_fmt(). The returned
pointer is guaranteed to have tal_count() == strlen() + 1, so there's no
sense in scanning through the string to find its length.

Suggested-by: Lagrang3 <lagrang3@protonmail.com>
See: https://github.com/ElementsProject/lightning/pull/9331#discussion_r3628600315

Changelog-Fixed: log: don't crash when truncating large log messages

Dockerfile: add protobuf-compiler for vls signer step

After 608f6952ea2772a31f4699580bce75a8f82f7f1c the vls docker image build fails
because it is missing protoc.

```
> [vls-builder 9/10] RUN cargo build --release --target x86_64-unknown-linux-gnu:
177.2
177.2 Caused by:
177.2 process didn't exit successfully: `/opt/validating-lightning-signer/target/release/build/lightning-storage-server-85c73031cf3e0f51/build-script-build` (exit status: 1)
177.2 --- stdout
177.2 cargo:rerun-if-changed=proto/lss.proto
177.2 cargo:rerun-if-changed=proto
177.2
177.2 --- stderr
177.2 Error: Custom { kind: NotFound, error: "Could not find `protoc`. If `protoc` is installed, try setting the `PROTOC` environment variable to the path of the `protoc` binary. To install it on Debian, run `apt-get install protobuf-compiler`. It is also available at https://github.com/protocolbuffers/protobuf/releases For more information: https://docs.rs/prost-build/#sourcing-protoc" }
177.2 warning: build failed, waiting for other jobs to finish...
```

vls 0.14 also has an external dependency that requires protoc, so vls vendoring it would not be enough.

wallet: handle bwatch wallet/utxo spend notifications

When bwatch_got_utxo() records a wallet output, it arms an outpoint
watch owned by wallet/utxo/<txid>:<outnum>. This adds the receiving
end of that watch: the dispatch entry plus the found/revert handlers.

On watch_found (a tx consumed the outpoint): mark the output spent in
our_outputs, store the spending tx in our_txs, and emit a withdrawal
coin movement. On watch_revert (a reorg removed that tx): clear
spendheight so the UTXO is spendable again.

Co-authored-by: Cursor <cursoragent@cursor.com>

wallet: handle reorgs for our_outputs/our_txs by hand

The legacy tables rely on their blocks(height) ON DELETE SET NULL
foreign keys to mark rows unconfirmed/unspent when a block is reorged
out. our_outputs/our_txs deliberately carry no blocks FK (bwatch does
not maintain a blocks table), so block disconnect and rollback must
demote their blockheight/spendheight fields explicitly.

Demote, never delete: a row also carries state the chain cannot
re-deliver (reserved_til, onchaind close metadata), and this path runs
not just on real reorgs but on every startup, when chaintopology
invalidates its rescan window. Rediscovery re-promotes the row via
wallet_add_our_output / wallet_transaction_add; a tx that never
re-confirms just stays unconfirmed and unspendable.

Co-authored-by: Cursor <cursoragent@cursor.com>

wallet: read UTXO state from our_outputs

With every writer dual-writing since the previous two commits, flip
the readers: all UTXO queries (listfunds, coin selection, reservations,
onchaind close info) now come from our_outputs, and the legacy-only
read helpers (wallet_stmt2output, gather_utxos, db_get_unspent_utxos)
are deleted.

our_output_row_to_utxo replaces wallet_stmt2output, using channel_dbid
to discriminate HD outputs from channel-close outputs, and
wallet_get_spendable_utxos centralizes the unspent+unreserved query
that wallet_find_utxo and wallet_has_funds previously duplicated.

migrate_setup_coinmoves keeps reading the legacy table directly: that
migration runs at v25.09, before our_outputs exists.

Co-authored-by: Cursor <cursoragent@cursor.com>

wallet: make datastore helpers self-wrap a wallet transaction

The four wallet_datastore_{get,create,update,remove} helpers used to
require the caller to be inside a wallet transaction; otherwise the
underlying db_prepare_v2 fatals at db/utils.c:103 with "Attempting to
prepare a db_stmt outside of a transaction".

watchman persists its pending bwatch ops through these helpers from
plugin callbacks that run outside any transaction, so wrap one on
demand.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests: update test_wallet.py raw-SQL queries for our_outputs

The wallet no longer writes UTXO state to the legacy outputs table's
status/spend_height columns, so tests that peek at the database
directly must read our_outputs instead.

Co-authored-by: Cursor <cursoragent@cursor.com>

wallet: route transaction reads/writes through our_txs

Now that the bwatch wallet path records every relevant transaction in
our_txs, point the wallet's transaction readers at that table.

Since our_txs.blockheight is NOT NULL with 0 = unconfirmed, the legacy
NULL handling disappears: wallet_transactions_by_height no longer needs
its "IS NULL vs = ?" query split, and wallet_transaction_height reads
the column unconditionally.

wallet_transaction_add keeps dual-writing the legacy transactions
table: the close path still inserts into channeltxs, whose
transaction_id foreign key points at transactions(id), and
wallet_get_funding_spend joins it. That legacy write can only go away
with channeltxs itself.

Co-authored-by: Cursor <cursoragent@cursor.com>

wallet: Read the max_index for addresses from the in-memory cache

docs: Fixing Ubuntu installation docs
- updated release tag references
- removed protobuf-compiler dependency
- removed rustup default installation, changed it to only for Ubuntu <25.10 (rust <1.85)
- added note about tzdata config halting execution

doc: Fix spliceout description

Changelog-None.

docs: fixing Fedora installation

- `dnf`: switched from `groupinstall` to `group install` which is supported both by `dnf4`and `dnf5` which is used starting from fedora41
- added `openssl` and `openssl-devel` dependency
- `uv` install added, which the build now requires
- bumped latest version
- use `uv` to tun the `make`

pyln-proto: use coincurve 21 for python <=3.13 and add self-compiled wheels for python 3.14

coincurve 20 is broken for all python versions since it now pulls in a transient dependency that turned
a warning into an error:

```
× Failed to build `coincurve==20.0.0`
├─▶ The build backend returned an error
╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 7)

[stderr]
ERROR: Use build.verbose instead of cmake.verbose for scikit-build-core >= 0.10

hint: This usually indicates a problem with the package or the build environment.
help: `coincurve` (v20.0.0) was included because `cln-meta-project` (v0.1.0) depends on `pyln-proto` (v26.6.2) which depends on `coincurve`
```

coincurve 21 does not have this issue but it does have another issue with python 3.14:

```
Resolved 1 package in 289ms
× Failed to build `coincurve==21.0.0`
├─▶ The build backend returned an error
╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 1)

[stderr]
Traceback (most recent call last):
File "<string>", line 11, in <module>
wheel_filename = backend.build_wheel("/home/user/.cache/uv/builds-v0/.tmpfcwWrQ", {}, None)
File "/home/user/.cache/uv/builds-v0/.tmpNmyA8G/lib/python3.14/site-packages/hatchling/build.py", line 58, in build_wheel
return os.path.basename(next(builder.build(directory=wheel_directory, versions=["standard"])))
~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/user/.cache/uv/builds-v0/.tmpNmyA8G/lib/python3.14/site-packages/hatchling/builders/plugin/interface.py", line 149, in build
build_hook.initialize(version, build_data)
~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
File "/home/user/.cache/uv/sdists-v9/pypi/coincurve/21.0.0/sA4L50tQMHeL37XJdHnME/src/hatch_build.py", line 34, in initialize
raise RuntimeError(message)
RuntimeError: Expected exactly one LICENSE file in cffi distribution, got 0

hint: This usually indicates a problem with the package or the build environment.
```

coincurve for python 3.14 is fixed upstream but there is no release yet, so we use self-compiled wheels just for python 3.14

Changelog-None

ecdh_hsmd: ensure HSM fd is blocking on setup

On macOS under load, socketpair fds sent via SCM_RIGHTS can have
O_NONBLOCK set (from the sender's io_new_conn call in hsmd's
pass_client_hsmfd). This causes wire_sync_read to return NULL
with EAGAIN, killing connectd or channeld with "No hsmd ECDH response".

The fix mirrors the "Don't trust subd to set it blocking" pattern
already used in lightningd/subd.c:read_fds(): explicitly call
io_fd_block(hsm_fd, true) in ecdh_hsmd_setup.

Changelog-Fixed: connectd: fix intermittent "No hsmd ECDH response" crash on macOS under load.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lightningd: cancel watching original funding when we switch to the new one via splice.

This happens if the channel is *not* announcable yet. Then we hit the assertion
in funding_depth_cb that the txid is the same as the current funding.txid.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-EXPERIMENTAL: fixed crash when we splice a channel which hasn't been announced yet.

cln-grpc: vendor protoc as a build-dependency

our current version of `grpcio-tools` 1.75.1 bundles `protoc` version:

```
uv run python -m grpc_tools.protoc --version
libprotoc 31.1
```

In CI/Dockerfiles we use 29.4 or whatever the OS provides with the
`protobuf-compiler` package, which for the most part is 21.12.

We actually want to somewhat match these versions but we don't have any
control over OS packages' versions.

We can instead bundle `protoc` as a build dependency for `cln-grpc`.
The current version for that bundles 31.1 as well.

This way the versions of `protoc` are more consistent everywhere.

One downside is that arm 32-bit hosts get no bundled protoc for `cln-grpc`
and have to still install `protobuf-compiler` themselves.

Changelog-None

tests: fix flaky test_simple_close_delay_broadcast mempool race

The test mined a block as soon as 'Broadcasting txid' appeared in l2's
log, but that log fires when CLN calls sendrawtransaction, not when
bitcoind has accepted the tx into its mempool. Under rpcproxy timing the
block could be mined empty, leaving the funding output unspent so
'Resolved FUNDING_TRANSACTION/FUNDING_OUTPUT by MUTUAL_CLOSE' never
logged and the test timed out.

Wait for the tx to enter the mempool before generating the block.

Changelog-None

tests: lower testpluguv's required python version

uv would use python 3.14 which currently leads to an error because of a build dependency update

```
× Failed to build `coincurve==20.0.0`
├─▶ The build backend returned an error
╰─▶ Call to `hatchling.build.build_wheel` failed (exit status: 7)

[stderr]
ERROR: Use build.verbose instead of cmake.verbose for scikit-build-core >= 0.10

hint: This usually indicates a problem with the package or the build environment.
help: `coincurve` (v20.0.0) was included because `cln-meta-project` (v0.1.0) depends on `pyln-proto` (v26.6.2) which depends on `coincurve`
```

Changelog-None

repro: add automake as explicit dependency

noble builds were failing because of a missing aclocal
usual recommendation is to install automake which apparently no longer
is in the dependency graph for noble

we add it to all ubuntu images in case it gets removed in jammy/resolute as well

Changelog-None

Revert "Bolt quote updates and improvements"

Reverts commits b0e728572b through aa6ecad90e (11 commits).

This PR was accidentally merged without proper review. The `channeld.c` splice-detection logic (`is_splice_active` + txid comparison) was NACKed by @ddustin as deviating from the spec, the correct approach requires a `funding_tx_index` on the inflight rather than a `txid` comparison.

A clean replacement PR will be opened for discussion once the approach is agreed upon.

Changelog-None

getroutes: don't crash on source==destination

```
cln-askrene: plugins/askrene/child/child.c:40: final_hop: Assertion `tal_count(hops) > 0' failed.
cln-askrene: FATAL SIGNAL 6 (version v26.06-19-g46b039d)
lightningd-1 2026-06-15T12:34:26.296Z DEBUG plugin-cln-askrene: notify msg debug: Final answer has 1 flows
0x55ab65429902 send_backtrace
common/daemon.c:38
0x55ab6542998c crashdump
common/daemon.c:83
0x7fbc84a8bdef ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7fbc84ae095c __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x7fbc84a8bcc1 __GI_raise
../sysdeps/posix/raise.c:26
0x7fbc84a744ab __GI_abort
./stdlib/abort.c:77
0x7fbc84a7441f __assert_fail_base
./assert/assert.c:118
0x55ab6541b60c final_hop
plugins/askrene/child/child.c:40
0x55ab6541b70d fmt_route
plugins/askrene/child/child.c:48
0x55ab6541ba5b convert_flows_to_routes
plugins/askrene/child/child.c:135
0x55ab6541c037 run_child
plugins/askrene/child/child.c:265
0x55ab65416caa do_getroutes
plugins/askrene/askrene.c:711
0x55ab65416d28 begin_request
plugins/askrene/askrene.c:887
0x55ab654170a2 json_getroutes
plugins/askrene/askrene.c:968
0x55ab654285ec ld_command_handle
plugins/libplugin.c:2206
0x55ab654287f6 ld_read_json
plugins/libplugin.c:2282
0x55ab65439261 next_plan
ccan/ccan/io/io.c:60
0x55ab65439580 do_plan
ccan/ccan/io/io.c:422
0x55ab65439639 io_ready
ccan/ccan/io/io.c:439
0x55ab6543a5fc io_loop
ccan/ccan/io/poll.c:470
0x55ab65428bc4 plugin_main
plugins/libplugin.c:2481
0x55ab65417491 main
plugins/askrene/askrene.c:1551
0x7fbc84a75ca7 __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
0x7fbc84a75d64 __libc_start_main_impl
../csu/libc-start.c:360
0x55ab65413920 ???
_start+0x20:0
0xffffffffffffffff ???
???:0
```

Changelog-Fixed: askrene-getroutes: don't crash on invalid user input, source==destination

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

Update tests after changing deadline from `blockheight + 12` to `blockheight + 72` blocks.

Added 60 blocks to all tests that relied on this parameter in order to fix them. i.e. 12 -> 72, 13 -> 73, etc...