LND

sqldb/v2: add executor backend

Make TransactionExecutor satisfy the BatchedTx contract by
providing Backend() and asserting the interface conformance at
compile time.

This was a latent interface mismatch rather than an immediately
triggered package-wide compile failure. The executor was
instantiated directly, but sqldb/v2 did not yet assert or use it
as a BatchedTx, so the missing method stayed hidden until a caller
tried to rely on the advertised interface.

At the same time, move Backend() onto BatchedQuerier so the lower-
level contract explicitly requires backend identity. That lets the
executor delegate directly instead of probing an anonymous
interface at runtime, which would have weakened the contract and
fell back to BackendTypeUnknown instead of failing at compile
time.

Keep the focused runtime test and the compile-time assertion so
future interface drift is caught immediately.

sqldb/v2: use BaseDB skip flag

Route migration skipping through the BaseDB field that each
store already initializes.

This makes the embedded state meaningful and keeps the runtime
migration behavior consistent across both backends.

sqldb/v2: drop dead retry helper

Remove the unused txExecutorOptions retry helper so the package
only keeps the backoff logic that is actually used.

This avoids carrying a second retry API with different
semantics from the live exponential backoff path.

sqldb/v2: fix sqlite migration errors

Wrap SQLite programmatic migration setup failures with the
SQLite error helper instead of the Postgres helper.

Before this change, a MakeProgrammaticMigrations failure on the
SQLite path returned an error that mentioned Postgres, which made
backend-specific setup failures needlessly confusing to debug.
The package still compiled and behaved normally unless that narrow
error path was exercised, which is why it slipped through.

Add a targeted unit test that forces the failing constructor path
and asserts the returned error is attributed to SQLite rather
than Postgres.

sqldb/v2: restore sqlite conn limit

Restore the low default SQLite connection limit used in v1 so
the v2 store does not default to a Postgres-sized pool.

This is a real v2 regression from v1. The v1 store defines
DefaultSqliteMaxConns = 2 and routes SetMaxOpenConns through
cfg.MaxConns(), while v2 had fallen back to the generic
defaultMaxConns = 25. That change did not break compilation, but
it quietly changed runtime pool sizing in a way that is hostile
to SQLite's single-writer concurrency model and can increase lock
contention.

Add a small config helper and unit test so callers can still
override the limit explicitly while the default remains safe for
SQLite. The regression was easy to miss because existing tests
did not assert the effective default pool sizing.

sqldb/v2: enforce require ssl mode

Apply the RequireSSL config knob when opening Postgres stores
so it cannot be silently ignored.

Before this change, sqldb/v2 exposed PostgresConfig.RequireSSL
but still opened cfg.Dsn verbatim, which meant RequireSSL=true
was a no-op. A caller could set RequireSSL=true together with a
DSN such as sslmode=disable and still establish a non-TLS
connection.

This is a v2-only API contract bug, not a v1 regression in DSN
handling: v1 never offered a separate RequireSSL flag and always
left TLS policy entirely up to the DSN. The fix rewrites the DSN
to use sslmode=require when needed, while preserving stricter
modes such as verify-ca and verify-full.

The bug was easy to miss because no test asserted that the boolean
flag changed the effective DSN or overrode an insecure sslmode.
Keep the focused DSN rewrite test because it proves the contract
without needing a live Postgres instance.

sqldb/v2: fix postgres time rewrite

Keep the Postgres schema rewrite keyed on " TIMESTAMP" so
CURRENT_TIMESTAMP is not rewritten while schema files are
adapted.

Add a focused unit test to keep the replacement aligned with the
existing v1 behavior.

sqldb/v2: fix no_sqlite target builds

Restore the no_sqlite shim so unsupported SQLite targets still
build the module.

Update the stub to satisfy the current migration interface and
restore the missing Postgres-only SQL error helpers. These
failures were easy to miss because the default developer and CI
paths build native SQLite targets, while the broken code only
showed up on no-SQLite architectures and build tags.

sqldb/v2: align test helper build tags

Align the backend-swapped test helper files with the platforms
where their backing SQLite and Postgres helper implementations
actually exist.

This keeps the exported helper surface internally consistent even
on targets that current CI likely does not exercise. Before this
change, the SQLite helper file was still selected on no-SQLite
targets, and the Postgres helper file was still selected on
openbsd and netbsd under test_db_postgres even though the Docker
fixture was compiled out there.

sqldb/sqlc: simplify non-terminal payment query

Simplify FetchNonTerminalPayments by collapsing the selector down to
two branches: payments that are not failed and have no settled attempt,
and payments that still have unresolved attempts. This keeps the same
non-terminal semantics while making the query easier to reason about.

Also add a partial index on payments(id) where fail_reason IS NULL to
speed up the startup selector branch that scans payments without a
recorded failure reason.

docs: update release notes

ci: use GITHUB_TOKEN instead of PAT for PR severity workflow

The PR severity classifier only needs to run `gh pr view`, `gh pr edit`
(labels), and `gh pr comment`. All three operations are fully covered by
the built-in GITHUB_TOKEN given the existing permissions block:

permissions:
contents: read
pull-requests: write
issues: write

The workflow uses `pull_request_target`, which runs in the base repo
context, so GITHUB_TOKEN has write access even for fork PRs.

Inspection of the claude-code-action@v1 source confirmed that the only
internal call that would require `contents: write` is branch deletion,
which is never exercised here because Claude's tools are locked down to
`gh pr view/edit/comment` via --allowedTools.

This removes the dependency on the PR_SEVERITY_BOT_TOKEN PAT secret.

paymentsdb: log unexpected nil attempt hashes

RegisterAttempt falls back to the payment identifier when an attempt
hash is nil so legacy data can still round-trip safely. In live router
code, however, a nil attempt hash should never happen for newly
registered attempts.

Add an error log on the fallback path so an unexpected nil attempt hash
is surfaced immediately instead of silently persisting the fallback
value.

itest: wait for active channels before replaying payments

lntest: retry mempool snapshots during RBF churn

graph/db: tighten TestFilterChannelRangeVersionGuard assertions

Use isSQLDB to explicitly assert the expected outcome per backend:
SQL should succeed with empty results, KV should return
ErrVersionNotSupportedForKVDB.

graph/db: convert TestDisconnectBlockAtHeight to versioned test

Rename to testDisconnectBlockAtHeight and add it to the versionedTests
table so it runs against both v1 and v2 backends.

graph/db: convert TestGraphZombieIndex to versioned test

Rename to testGraphZombieIndex and add it to the versionedTests table
so it runs against both v1 and v2 backends. The assertNumZombies
helper is updated to accept a gossip version parameter.

graph/db: convert TestLightningNodeSigVerification to versioned test

Rename to testLightningNodeSigVerification and add it to the
versionedTests table so it runs against both v1 and v2. The signing
step is version-specific (ECDSA for v1, Schnorr for v2) while the
verification path is shared.

graph/db: convert TestNodePruningUpdateIndexDeletion to versioned test

Rename to testNodePruningUpdateIndexDeletion and add it to the
versionedTests table so it runs against both v1 and v2 backends.

The NodeUpdateRange is now built per-version: time-based for v1
and block-height-based for v2.

paymentsdb: remove dead inflight helper code

After removing the old FetchAllInflightAttempts query API, the helper
types that only existed to batch load that path are no longer used.

Use make lint as evidence. It reports the old inflight helper types as
unused once the query API is gone.

Remove the obsolete helper structs and batch-loading function from the
payment SQL store so the remaining code matches the new inflight
recovery path.

paymentsdb: use non-terminal payment query for recovery

The new FetchNonTerminalPayments query is available, but
FetchInFlightPayments still uses the old unresolved-attempt scan until
this commit.

Use the inflight recovery regression tests as evidence. They now pass
on both KV and SQL once the payment store is wired up to use the new
query.

Fix this by switching FetchInFlightPayments to the non-terminal
payment query and batch loading only the related attempt and route
data for those payment IDs.

sqldb/sqlc: remove old inflight query API

FetchInFlightPayments no longer relies on the old
FetchAllInflightAttempts query surface once the non-terminal payment
query is in place.

Use make lint and the inflight recovery tests as evidence. The code
still passes once the old query and its generated bindings are removed.

Remove FetchAllInflightAttempts from payments.sql, regenerate the sqlc
bindings, and drop the matching SQLQueries interface method.

sqldb/sqlc: add non-terminal payment query

FetchInFlightPayments needs a dedicated SQL query that can return
non-terminal payments without relying on the unresolved-attempt scan.
The first version of that query fixed correctness, but the follow-up
selector measurements showed a UNION-based shape was materially
faster while returning the same payment set.

Use the inflight regression tests as evidence. The tests still fail on
SQL before the Go payment store is wired up, but this commit adds the
final SQL surface the later wiring commit depends on.

Add FetchNonTerminalPayments to the SQL query set, regenerate the sqlc
bindings, add the PaymentAndIntent adapters for the new row type, and
use the UNION-based candidate selection so the final query shape lands
in one commit.

paymentsdb: add AMP hash regression test

SQL writes store the payment identifier in payment_hash for each
attempt. That is wrong for AMP payments, because the payment
identifier is the SetID while each shard carries its own HTLC hash.

Add TestRegisterAttemptPreservesAttemptHash as evidence. It passes on
KV and fails on SQL before the fix because SQL reads the attempt hash
back as the payment identifier.