LND

Merge pull request #11090 from yyforyongyu/task-peer-manager

peer: bound peer-controlled resource growth

contractcourt: fix stuck HTLC after confirmation

When we forward a payment we hold two HTLCs that must resolve together:
the incoming one (someone pays us) and the outgoing one (we pay the next
hop). If the outgoing HTLC dies, we have to deal with the incoming one
back upstream. Otherwise the incoming HTLC is stuck and hangs until its
own channel force closes near the timeout.

For an outgoing HTLC that is dust there is no output to resolve on chain,
so we process the incoming one back. This can happen at two points: before
any commitment confirms, and again in StateContractClosed once one did.

Whether an HTLC is dust is not fixed though, it depends on the fee rate
and the dust limit of the commitment it sits on. So an HTLC can have an
output on our local commitment, yet be trimmed to dust on the remote one.
If we did not see it as dust before, and the remote commitment is the one
that confirms, neither point handled the incoming HTLC back:
StateContractClosed only handled the dangling action and assumed all dust
HTLCs were already resolved. The incoming HTLC was left stuck.

StateContractClosed now also processes the incoming HTLCs of the dust
action. For an HTLC that was already handled before the confirmation
this sends a duplicate resolution message, which is safe as the switch
processes them idempotently.

peer: test outgoing queue lifecycle

Exercise queue drain accounting, teardown servicing, and the shared
priority/lazy admission policy. Join every goroutine so the tests pin
backlog behavior without leaking asynchronous work.

queue: synchronize circular buffer

Guard circular buffer writers and readers with one RWMutex. Add a
concurrent regression that exercises every public access method and
checks final ordering under the race detector.

docs: note configurable WalletKit lease lifetime

Document the new LeaseOutput and FundPsbt confirmation-depth option in
the 0.22.0 release notes.

walletrpc: release partial locks by owner ID

Make multi-input lease acquisition all-or-nothing. A metadata lookup or
lease failure after an earlier success now triggers one guarded deferred
rollback.

Release each acquired output with its recorded lock ID. This preserves a
caller's custom owner ID instead of incorrectly using LND's internal ID.
Cover both metadata and lease failures with internal and custom owners.

walletrpc: expose configurable output leases

Add optional confirmation-depth fields to LeaseOutput and FundPsbt. A
non-zero value selects a lease that ignores wall-clock expiry and
releases at the requested spend depth or by explicit owner release. Zero
preserves time-controlled leases.

Resolve wallet capability before acquiring inputs so unsupported
backends fail closed even when FundPsbt selects no new input. Echo the
accepted depth after installation, and expose persisted spend height
through ListLeases so clients can observe confirmation and reorg
progress.

Cover option forwarding, zero-depth compatibility, unsupported wallets,
partial acquisition rollback, and response marshalling.

lnwallet: add configurable output lease capability

Define an optional interface for confirmation-controlled output leases
without widening WalletController or changing existing callers.

Resolve that capability through adapter chains before applying a
non-zero depth. LightningWallet and RPCKeyRing expose their wrapped
controller, so local and remote-signer nodes reach the concrete
btcwallet backend. Unsupported controllers fail closed.

Map the accepted depth to btcwallet's persisted option and retain the
legacy LeaseOutput path for zero-depth callers.

build: pin configurable btcwallet output leases

Pin btcwallet and wtxmgr to the canonical upstream commit that
merged the configurable-lease API and its wall-clock expiry fix.

Without the follow-up fix, a slowly confirming spend can outlive its
timed lease before wtxmgr records the spend height. A later shallow
reorg can then expose the input to coin selection.

lnwire: preserve channel update extras

Canonicalize channel update TLV data without mutating the message during
encoding. This keeps unknown records intact, reconciles legacy duplicate
inbound fee representations, and makes signing match the emitted bytes.

Cover receiver immutability, legacy encoding shapes, concurrent
encoding, and signature verification across a wire round trip.

lnrpc: bound incoming websocket message size

The WebSocket proxy never set a read limit on the upgraded connection.
The gorilla default is unlimited, so the proxy would read a message of
any size a client cared to send, even though lnd already defines
MaxWsMsgSize and applies it to the responses written back out.

Note that this is a bound, not a fix for an amplification: ReadMessage
is io.ReadAll over the frame reader, so the buffer grows as bytes
actually arrive rather than being sized from the declared payload
length. A client that wants lnd to buffer N bytes has to send N bytes.
What the limit adds is the cheap rejection: gorilla now fails the frame
from its header in advanceFrame, before the payload is read at all.

Apply MaxWsMsgSize to the read side so both directions agree.

lnrpc: fix Sec-Websocket-Protocol parsing

forwardHeaders assumed that a Sec-Websocket-Protocol value matching one
of the allowed prefixes also contains the "+" delimiter, and indexed the
split result at [1] unconditionally. A client that sends only the
protocol name, for example "Grpc-Metadata-Macaroon" with no delimiter,
therefore caused an index out of range panic.

The panic is currently contained because forwardHeaders runs on the
net/http handler goroutine, whose deferred recover catches it, so only
the client's own connection dies. That containment is incidental to the
current call graph rather than by design though: neither the read loop
nor the backend forwarder goroutine has a recover of its own.

The prefix match was too loose in the other direction as well. The field
is a comma separated list of sub protocols, but it was matched and split
as a single string, so "Grpc-Metadata-Macaroon,other+value" passed the
prefix check and forwarded "value" from the second entry as the macaroon
for the first.

Split the field on "," first and cut each entry at its own delimiter,
forwarding only entries whose name adjoins that delimiter and is
allowed. Add a table test covering the forwarding rules including these
cases.

peer: price outgoing queue messages

Estimate memory retained by each outgoing wire message without
serialization. Include peer-controlled onion, gossip feature-map,
address, and opaque payload allocations in the byte budget.

peer: define outgoing queue limits

Define the per-peer outgoing backlog count and retained-memory bounds.
Keep the policy grouped so queue ownership and producers share one
immutable configuration.

peer: test outgoing queue costs

Cover each non-serializing queue cost rule with declarative message
shapes. Pin the retained opaque data charged for all active v1 bulk
gossip messages.

Merge pull request #11008 from LNBIG-COM/fix/psbt-funding-lock-order

lnwallet: fix limboMtx/intentMtx lock order inversion in PsbtFundingVerify

peer: test routed ping floods

Use a mock message router that would consume an oversized Ping. Prove
flood accounting disconnects first and preserves the sentinel error for
operator diagnostics.

peer: test ping policy boundaries

Exercise exact production burst, refill, and Pong-size boundaries.
Retain deterministic cadence and reply-suppression coverage without
relying on wall-clock scheduling.

peer: rate limit inbound pings

Bound Pong replies with separate reply and flood token buckets.
Count every decoded Ping before generic routing. Disconnect peers that
exhaust the flood budget through a stable sentinel error.

Merge pull request #11106 from ziggie1984/invoice-sql-mig

invoices: migrate legacy AMP invoice HTLCs

Merge pull request #11105 from ziggie1984/bump-grpc-1.82.1

build: bump grpc to v1.83.1

kvdb: bump grpc module floor

The kvdb module is versioned and published independently, so it must
also be tested or consumed as a nested module on its own.

Run go mod tidy in kvdb so the transitive requirements and checksums
match the grpc version selected by the module graph.

brontide: clarify InitializeKey error-discard invariant

x/crypto v0.51.0 adds a second failure mode to chacha20poly1305.New:
it now returns an error under Go's strict FIPS 140-only mode, in
addition to the existing bad-key-length case. The key here is a fixed
[32]byte, and lnd cannot run under strict FIPS mode because brontide
mandates ChaCha20-Poly1305, so the discarded error remains unreachable.
Expand the comment to record that widened invariant.

build: bump grpc to v1.83.1

peer: attach outgoing queue costs

Calculate retained-memory charges when messages enter the peer queue.
Carry them as immutable metadata. Keep generic priority queue accounting
independent of wire types.