Electrum

lnrouter: LiquidityHints: add more type hints

and rename "amount" to "amount_msat"
- it's an easy mistake to pass an amount with a different unit, and we don't have type-checking against that... this is the least we should do

test_lnwallet: add unittest for single channel mpp split config

Tests that all parts of a multi-part payment over a single channel
are constructed using the channel of the split configuration.

tests: move ln graph definitions and prepare_invoice to lnhelpers.py

This makes them reusable from test files other than test_lnpeer and
removes the deferred test_lnpeer import in prepare_chans_and_peers_in_graph.

lnwallet: use split config channel for single channel mpp

Use the channel returned by the split config when sending a
single channel mpp (multiple parts on a single channel), instead
of allowing the pathfinding to use any channel.
Otherwise it can happen that we have a good split config fitting a
specific channel, but the pathfinding then tries to put both parts
on another channel that cannot handle the sum of the parts, raising
at _assert_can_add_htlc later on and failing the payment.

tests: check liquidity hints are updated for all htlcs

lnworker/lnrouter: update liquidity hints in htlc callbacks

Update the channel liquidity hints in the
`htlc_fulfilled`/`htlc_failed` callbacks instead of the htlc
log handler (`_process_htlc_log()`).
`_process_htlc_log()` would raise `PaymentSuccess()` on the first fulfilled
htlc, removing the inflight htlcs counted in `LiquidityHintMgr` only for this
htlc's route.
All other htlcs that arrive later would leak and not get removed anywhere,
so the inflight htlc counter didn't get decreased and successful routes
would be punished by the penalty.

test_lnpeer: add unittest for mpp fee budget check

LNWallet: fix fee budget check regression

The fee budget during local pathfinding route creation incorrectly
compared the full payment amount against the full budget on every
route instead of the partial amount against its fraction of the budget.
This is a regression introduced by df5c8c4c9 and makes it possible
for a payment to exceed the budget or a route to be incorrectly considered
too expensive.

ci: bump security review ci model to opus 5

Bump the LLM used by the security review CI script from Claude Opus 4.8 to Claude Opus 5

qt: rename color themes (the user-visible names of the themes)

"Light" is actually the Platform-dependent system theme, where we let Qt define the palette and it leave it alone. Qt in turn mostly defers to the OS. On modern windows/macos/gnome/kde/etc, if the OS is set to "dark mode", Electrum will end up using a system-specific dark mode. Hence the name "Light" is confusing.

"Dark" is the qdarkstyle theme, which is largely platform-independent.

I think it's fine if these names are not completely "user-friendly".

closes https://github.com/spesmilo/electrum/issues/10767

json_db: set_modified after incomplete data

Set the JsonDB modified after `maybe_load_incomplete_data`
removed a corrupted patch. Otherwise we might not override
the file on disk, append more patches and lose them all again
on the next reload.

json_db: escape '\' and '~' in json patch pointer

> Because the characters '~' (%x7E) and '/' (%x2F) have special
meanings in JSON Pointer, '~' needs to be encoded as '~0' and '/'
needs to be encoded as '~1' when these characters appear in a
reference token.

https://www.rfc-editor.org/info/rfc6901/

wallet_db: register onion_keys converter

`Channel.onion_keys` had no registered converter for hex -> bytes, causing
`pop_onion_key()` to return a hex str instead of bytes after the keys
got loaded from db following a restart.

qml: update ConfirmTxDialog onValidChanged

Commit 2de11eac923d51befe44dcc748505714196a7f2c gated the
ConfirmTxDialog amount behind `finalizer.valid`.
When sweeping private keys from the sweep view the resulting
`ConfirmTxDialog` is not valid in the beginning, and after it
turns valid nothing causes it to update. This results in the amount
being displayed as `0` even after it finished fetching the keys balances.

swaps: destroy swap transport on failed initialization

Call `swap_transport.destroy()` when the swap transport initialization
task fails, otherwise the task will keep the swap transport tasks alive,
leaking a swap transport for each failed connection attempt.

lntransport: wrap connection errors in send_bytes_and_drain

LightningPeerConnectionClosed is handled in Peer.handle_disconnect.

```
162.39 | E | lnpeer.Peer.[LNGossip, 02ab5336d0-d8be58cb] | Exception in main_loop: ConnectionResetError('Connection lost')
Traceback (most recent call last):
File "/home/user/wspace/electrum/electrum/util.py", line 1218, in wrapper
return await func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/user/wspace/electrum/electrum/lnpeer.py", line 544, in wrapper_func
return await func(self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/user/wspace/electrum/electrum/lnpeer.py", line 558, in main_loop
async with self.taskgroup as group:
^^^^^^^^^^^^^^
File "/home/user/wspace/aiorpcX/aiorpcx/curio.py", line 304, in __aexit__
await self.join()
File "/home/user/wspace/electrum/electrum/util.py", line 1423, in join
task.result()
~~~~~~~~~~~^^
File "/home/user/wspace/electrum/electrum/lnpeer.py", line 897, in _message_loop
await self._process_message(msg)
File "/home/user/wspace/electrum/electrum/lnpeer.py", line 277, in _process_message
await f(*args)
File "/home/user/wspace/electrum/electrum/lnpeer.py", line 389, in on_ping
await self.transport.send_bytes_and_drain(raw_msg)
File "/home/user/wspace/electrum/electrum/lntransport.py", line 238, in send_bytes_and_drain
await self.writer.drain()
File "/usr/lib/python3.13/asyncio/streams.py", line 386, in drain
await self._protocol._drain_helper()
File "/usr/lib/python3.13/asyncio/streams.py", line 166, in _drain_helper
raise ConnectionResetError('Connection lost')
ConnectionResetError: Connection lost
```

android build: fix prev: chown fresh_clone base dir before git clone

qml: emit a single dataChanged when updating blockchain height

emit a single dataChanged signal over the whole model index range
once in `QETransactionListModel.updateBlockchainHeight()` instead
of emitting a separate signal for each transaction.

qml: don't compute notification balance delta for large tx batches

Don't compute the wallet balance delta for the new tx notification
shown after synchronizing the wallet if the notification batch
exceeds 10 txs. Otherwise the calculation will block the UI, especially
for large wallets with many new txs after initial sync.

qml: change event callback logs to debug

Change per-tx event callback logs to debug, might make the process
a bit less clogged if there are many txs.

qml: don't force-build address model from tx event handlers

The addressCoinModel property getter lazily constructs
QEAddressCoinListModel, whose __init__ runs a full (slow) initModel().
Instead of initializing it on a new transaction, blocking the UI,
just initialize it lazily when the user actually opens it.
Same pattern as importAddresses/importPrivateKeys.

qml: skip per-tx balance updates during sync

During synchronization, new_transaction fires for every incoming tx and
each balanceChanged emit makes QML recompute the balance on the GUI
thread. The balance isn't shown anyway during sync.

qml: QETransactionListModel: add txid->row index

Add a txid -> model row index dict to `QETransactionListModel`
instead of re-iterating the `tx_history` list on each event
to find the tx item.
This noticeably unblocks the UI during sync of a large wallet.

contrib/make_download: fix imports

not sure why this was not an issue before(?)
perhaps due to python version differences
```
$ ./contrib/make_download /home/user/wspace/electrum-web
Traceback (most recent call last):
File "/home/user/wspace/electrum/./contrib/make_download", line 17, in <module>
version_spec = importlib.util.spec_from_file_location('version', 'electrum/version.py')
^^^^^^^^^^^^^^
AttributeError: module 'importlib' has no attribute 'util'
```

qml: android on-screen keyboard submit trigger accepted