Core Lightning

lightningd: add send_to_bwatch and watchman_ack

Introduce the outbound RPC path from watchman to the bwatch plugin
plus the ack lifecycle that drops a pending op once bwatch confirms
it.

- struct pending_op carries an op_id of the form "{method}:{owner}"
(e.g. "addscriptpubkeywatch:wallet/p2wpkh/42"); method and owner
are recoverable without a separate field.
- Datastore helpers (make_key, db_save, db_remove) persist pending
ops at ["watchman", "pending", op_id] for crash recovery.
- send_to_bwatch finds the bwatch plugin via find_plugin_for_command
on the method name; if bwatch is not yet INIT_COMPLETE, the send is
silently dropped (the op stays queued and will be replayed when
bwatch comes up). Otherwise it builds a JSON-RPC request with the
owner suffix and the caller-supplied json_params body, registers
bwatch_ack_response as the callback, and sends it.
- watchman_ack searches pending_ops by op_id; on a hit it removes the
datastore entry and drops the in-memory op.

db_save and send_to_bwatch are marked __attribute__((unused)) here
because their callers (enqueue_op, watchman_replay_pending) land in
the next commit; the markers are removed there.

lightningd: replay pending ops on plugin ready

Both bwatch and watchman must be crash-resistant: a watch_send or an
add_watch/del_watch op may be in flight when lightningd crashes, and
neither side is allowed to lose it. We solve this by persisting every
pending op to the datastore in enqueue_op and dropping it from the
datastore in watchman_ack. On startup load_pending_ops rebuilds the
in-memory queue from the datastore, and watchman_on_plugin_ready
replays it once bwatch reaches INIT_COMPLETE.

watchman_add cancels any prior add for the same owner; watchman_del
cancels any pending add for the same owner before queueing the
delete. This keeps the queue from accumulating stale or
self-cancelling op pairs across restarts.

release: prepare v26.06

Describe the change

xpay: don't crash on circular routehints.

We earlier fixed the cases of gossipd inserting a same-node channel,
but didn't prevent it for local modifications:

```
cln-askrene: common/gossmap.c:52: nodeidx_htable_add: Assertion `!nodeidx_htable_getmatch_(ht, k, h, v, &i)' failed.
cln-askrene: FATAL SIGNAL 6 (version v26.06rc2-5-gd389c3f-modded)
0x5c50e80dd5cb send_backtrace
common/daemon.c:38
0x5c50e80dd685 crashdump
common/daemon.c:83
0x70a5b1e4532f ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x70a5b1e9eb2c __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x70a5b1e9eb2c __pthread_kill_internal
./nptl/pthread_kill.c:78
0x70a5b1e9eb2c __GI___pthread_kill
./nptl/pthread_kill.c:89
0x70a5b1e4527d __GI_raise
../sysdeps/posix/raise.c:26
0x70a5b1e288fe __GI_abort
./stdlib/abort.c:79
0x70a5b1e2881a __assert_fail_base
./assert/assert.c:96
0x70a5b1e3b516 __assert_fail
./assert/assert.c:105
0x5c50e80dfb44 nodeidx_htable_add
common/gossmap.c:52
0x5c50e80e1066 add_channel
common/gossmap.c:515
0x5c50e80e327c gossmap_apply_localmods
common/gossmap.c:1239
0x5c50e80bed55 do_getroutes
plugins/askrene/askrene.c:620
0x5c50e80bf919 listpeerchannels_done
```

Reported-by: Won Hoi Kim and Ahmad Elmoursi
Changelog-Fixed: Plugins: xpay no longer crashes on circular bolt11 routehints.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

release: prepare v26.06

schemas: remove obsolete fields in decode

msggen: add createproof, xkeysend and graceful generation

Fixed UnionField added and deprecated propagation
New primitive ProofField for createproof

Changelog-None

schemas: remove old deprecations, add missing deprecations/added fields

Also made fields not go optional if they are deprecated in the case that their parent is also deprecated. This makes more sense imo when you deprecate a whole command.

I added deprecation annotation for the .proto file as well so that later in the convert.rs file it properly annotates everything to allow for deprecated stuff.

Also fixed one propagation bug for the added/deprecated fields, that's why there are some additional changes of some fields.

Changelog-None

Cargo.lock: weekly dependency update

Updating pin-project v1.1.12 -> v1.1.13
Updating pin-project-internal v1.1.12 -> v1.1.13
Updating serde_qs v1.1.1 -> v1.1.2
Updating zerofrom v0.1.7 -> v0.1.8

Changelog-None

gitignore: add bwatch

Changelog-None

v26.06rc1

crates: weekly dependency update

Changelog-None

currencyrate: added README

Changelog-None

tests: remove `test_withdraw_stuck_reserved_on_broadcast_failure`

After the bug was fixed in 1c5e63299411912d469e4160caa8c93e07e91447
`test_withdraw_unreserves_on_broadcast_failure` serves as a regression test

Changelog-None

bwatch: notify watchman on block_processed

After bwatch persists a new tip, send a block_processed RPC to watchman
(lightningd) with the height and hash. bwatch only continues polling
for the next block once watchman has acknowledged that it has also
processed the new block height on its end.

This matters for crash safety: on restart we treat watchman's height as
the floor and re-fetch anything above it, so any block we acted on must
be visible to watchman before we move on.

If watchman isn't ready yet (e.g. lightningd still booting) the RPC
errors out non-fatally; we just reschedule and retry.

bwatch: detect reorgs and roll back tip

When handle_block fetches the next block, validate its parent hash
against our current tip. If they disagree we're seeing a reorg: pop our
in-memory + persisted tip via bwatch_remove_tip, walk the history one
back, and re-fetch from the new height. Each fetch may itself reorg
further, so the loop naturally peels off as many stale tips as needed
until the chain rejoins.

After every rollback, tell watchman the new tip via
revert_block_processed so its persisted height tracks bwatch's. If we
crash before the ack lands, watchman's stale height will be higher than
ours on restart, which retriggers the rollback.

If the rollback exhausts our history (we rolled back past the oldest
record we still hold) we zero current_height/current_blockhash and let
the next poll re-init from bitcoind's tip.

Notifying owners that their watches were reverted lands in a subsequent
commit.

setconfig: fix crash on dynamic multi-value plugin options

We had an assert(!(ot->type & OPT_MULTI)) which crashed when using
setconfig on a plugin option marked as both dynamic and multi.

The fix changes plugin_set_dynamic_opt to accept an array of values
(scalar options pass a 1-element array, multi options pass the complete
set). For multi options, setconfig replaces ALL values atomically - an
empty array clears them.

Fixes: #8295

Changelog-Fixed: setconfig no longer crashes on dynamic multi-value plugin options

graceful: new command to instruct CLN to start shutting down.

Based on "lightningd: add "snub-idle-channels" dynamic config variable" by
Matt Whitlock <c-lightning@mattwhitlock.name>.

Fixes: https://github.com/ElementsProject/lightning/issues/4842
Changelog-Added: JSON-RPC: `graceful` command to prepare CLN for shutdown.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

common: implement tal_arr_append and tal_arr_appendn, and use them.

These are useful for the common pattern of "append these bytes to this tal array".

As a bonus, we do memcheck() on all these callers, for extra checking
under valgrind.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

pay: deprecate pay and paystatus.

Use xpay and listpays.

Some tests which are pay/paystatus specific simply enabled deprecations.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Deprecated: JSON-RPC: `pay` and `paystatus`: use `xpay`, `listpays` (or `xpay`'s notifications for details of attempts). `pay` will be replaced by `xpay` in v27.03.

decode: fix decode on recurring offers.

We no longer have offer_recurrence, we have
offer_recurrence_compulsory and offer_recurrence_optional. Decode was
changed in v25.12, but we never properly tested it (recurrence is
experimental, after all).

I opted for simplicity over truth here, and simply modified decode to
match the schema, but add a "compulsory" flag.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

common/bolt12: use a const char * for fail reason.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

offers: add createproof API.

Changelog-EXPERIMENTAL: JSON-RPC: `createproof` to create a payment proof for a (successful) BOLT12 payment.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

decode / bolt12-cli: add missing invreq_recurrence_cancel field.

We missed this. It's experimental, so no changelog needed.

Spotted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>