rust-lightning

Multiply the feerate by the spike multiple in `can_accept_incoming_htlc`

We choose to multiply `FEE_SPIKE_BUFFER_FEE_INCREASE_MULTIPLE` by the
feerate when checking the fee spike buffer in
`can_accept_incoming_htlc` instead of multiplying the multiple by the
commitment transaction fee. This allows us to delete
`NextCommitmentStats::commit_tx_fee_sat`, and return balances including
the commitment transaction fee in `TxBuilder::get_channel_stats`. This
unblocks a good amount of cleanup.

Note that this means LDK now rejects HTLCs that previous versions of LDK
would have accepted. We made the mirroring change in
`get_available_balances_for_scope` a few commits earlier.

We also now account for non-dust HTLCs turning to dust at the multiplied
feerate, decreasing the overall weight of the transaction.

We also remove other fields in `NextCommitmentStats` which can be easily
calculated in `channel` only.

`TxBuilder::get_channel_stats` could also check the reserve
requirements, given that it gets the reserves in `ChannelConstraints`.
I leave this to follow-up work.

Extract dust exposure calculation in `tx_builder` to its own function

This snippet is currently used in
`tx_builder::get_next_commitent_stats`, and will be used in an upcoming
commit in `get_available_balances_for_scope`.

There are no functional changes in this commit, as the
`extra_accepted_htlc_dust_exposure` member of `NextCommitmentStats` was
not used.

Move `ChannelContext::get_available_balances_for_scope` to `tx_builder`

This is a direct code move to `tx_builder::get_available_balances`.

Create `ChannelConstraints` to hold parameters for balance calculations

In an upcoming commit, we move `get_available_balances_for_scope` behind
`TxBuilder::get_channel_stats`, and pass channel parameters relevant to
balance calculations in `TxBuilder::get_channel_stats` via
`ChannelConstraints`.

There are no functional changes in this commit.

Print unexpected events upon assertion failure

Add pending changelog for SpliceFailed / DiscardFunding split

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Split DiscardFunding from SpliceFailed event

When a splice fails, users need to reclaim UTXOs they contributed to the
funding transaction. Previously, the contributed inputs and outputs were
included in the SpliceFailed event. This commit splits them into a
separate DiscardFunding event with a new FundingInfo::Contribution
variant, providing a consistent interface for UTXO cleanup across all
funding failure scenarios.

Changes:
- Add FundingInfo::Contribution variant to hold inputs/outputs for
DiscardFunding events
- Remove contributed_inputs/outputs fields from SpliceFailed event
- Add QuiescentError enum for better error handling in funding_contributed
- Emit DiscardFunding on all funding_contributed error paths
- Filter duplicate inputs/outputs when contribution overlaps existing
pending contribution
- Return Err(APIError) from funding_contributed on all error cases
- Add comprehensive test coverage for funding_contributed error paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Extract contributed_{inputs|outputs} iterators

The following types have methods for returning contributed inputs and
outputs:
- FundingNegotiationContext
- InteractiveTxConstructor
- InteractiveTxSigningSession
- ConstructedTransaction

Having iterators for these can avoid allocations, which is useful for
filtering contributed input and outputs when producing DiscardFunding
events.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add expect_splice_failed_events helper

Add a helper function to assert that SpliceFailed events contain the
expected channel_id and contributed inputs/outputs. This ensures that
tests verify the contributions match what was originally provided.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Fix silent merge conflict

RecipientOnionFields::secret_only requires an amount now, but when
do_abandon_splice_quiescent_action_on_shutdown was introduced it was
based on an earlier commit.

Validate CLTV somewhat in `Route::debug_assert_route_meets_params`

Now that we've cleaned up trampoline CLTV building and added
`Path::total_cltv_expiry_delta`, we can use both to do some basic
validation of CLTV values on blinded tails in
`Route::debug_assert_route_meets_params`

Add a `Path::total_cltv_expiry_delta` accessor

Rename `starting_htlc_offset` `cur_block_height` in onion building

Now that we are consistently using the
`RouteHop::cltv_expiry_delta` as the last hop's starting CLTV
rather than summing trampoline hops, `starting_htlc_offset` is a
bit confusing - its actually always the current block height. Thus,
here we rename it.

Clarify CLTV value selection in the first blinded hop marginally

Fix trampoline onion encoding to match doc-declared CLTV rules

The docs for `RouteHop::cltv_expiry_delta` claim that it includes
any trampoline hops, but the way we actually implemented onion
building it did not.

Because the docs described a simpler and more backwards-compatible
API, we update the onion-building logic to match rather than
updating the docs.

Use HTLC CLTV instead of onion CLTV values for payment claim timer

When we receive an HTLC as a part of a claim, we validate that the
CLTV on the HTLC is >= the CLTV that the sender requested we
receive, but then we use the CLTV value that the sender requested
we receive as the deadline to claim the HTLC anyway.

This isn't generally all that interesting (they're always the same
unless the previous-hop node gave us "free CLTV"), but for
trampoline payments where we're both a trampoline hop and the
blinded intro point and the recipient, it means we end up allowing
ourselves less claim time than we actually have.

Instead, here, we just use the actual HTLC CLTV deadline.

chanmon_consistency: assert claimed payments result in PaymentSent

Add an invariant to the settlement phase: every payment that a receiver
claimed (via claim_funds) must result in a PaymentSent event at the
sender. This catches bugs where a claimed payment's preimage fails to
propagate back to the sender.

To support this, change resolved_payments from Vec<PaymentId> to
HashMap<PaymentId, Option<PaymentHash>>, storing Some(hash) for
PaymentSent and None for PaymentFailed/probes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Abandon pending quiescent action upon shutdown initiation

Otherwise, now that we no longer have the awaiting quiescence state
flag, we may end up sending `stfu` for a channel we intend to close.

Remove awaiting quiescence channel state flag

With the introduction of `QuiescentAction`, the flag has essentially
become duplicate state, so we opt to remove it in favor of just checking
whether we have a pending `FundedChannel::quiescent_action`. Since the
quiescent flags are never persisted, we can simply remove it and update
the other flags, freeing up a bit for future use.

Merge initial and retry stfu send paths

In 15b04b5, we fixed a case in `FundedChannel::try_send_stfu` where we'd
send `stfu` unnecessarily for a new splice while one is already pending.
The same case also existed in `FundedChannel::send_stfu`, but was not
fixed. There's no good reason for both of these methods to exist, so we
merge them into one as `FundedChannel::try_send_stfu`. We also add a
test that reproduces the `FundedChannel::send_stfu` issue to ensure it's
fixed and does not regress.

Rename to StaticInvoice::held_htlc_available_paths

Otherwise, Bolt12Invoice::message_paths and StaticInvoice::message_paths would
have the same name but return completely different kinds of paths, which is
inconsistent.

Claude'd.

Clean up fuzz crate: use panic=abort, add stdin_fuzz support, remove dylib

This commit makes three related changes to the fuzz infrastructure:

1. Set panic=abort on both dev and release profiles, and remove the
dylib crate type (keeping rlib and staticlib). The dylib crate type
was added in e28fd78e6 (2019) for a C-callable harness that was
never implemented. Removing dylib is what enables panic=abort,
since Rust forces panic=unwind on dylib crates. staticlib is
retained as it is compatible with panic=abort.

2. Add stdin_fuzz support: a new Stdout logger, updated target template
so that stdin_fuzz calls _test() with Stdout logging, and updated
README with usage instructions. This allows reproducing crashes via
piped input, useful for git bisect and AI-assisted debugging.

3. Update all fuzzer frontends (AFL, honggfuzz, libfuzzer, stdin_fuzz)
to call the _test() functions directly instead of going through the
_run() C wrappers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Delete `TxBuilder::subtract_non_htlc_outputs`

We make temporary use of the raw
`tx_builder::saturating_sub_anchor_outputs` function in
`get_available_balances_for_scope`. This ok because we move most of
the `get_available_balances_for_scope` function to the
`TxBuilder::get_channel_stats` call in an upcoming commit.

Again, no functional change is introduced in this commit.

Delete `TxBuilder::commit_tx_fee_sat`

Move calls to `TxBuilder::commit_tx_fee_sat` in
`new_for_inbound_channel` and `new_for_outbound_channel` to
`ChannelContext::get_next_{*}_commitment_stats`, and set the parameters
such that the exact same behavior is maintained.

We also replace calls to `TxBuilder::commit_tx_fee_sat` in
`get_pending_htlc_stats`, `next_local_commit_tx_fee_msat`, and
`next_remote_commit_tx_fee_msat` with `chan_utils::commit_tx_fee_sat`.
All three functions get deleted in an upcoming commit, so we accept
this temporary use of the `chan_utils::commit_tx_fee_sat` function.

Introduce `TxBuilder::get_channel_stats`

This commit moves the previous `TxBuilder::get_next_commitment_stats`
method to a private function, and then calls this function in
`TxBuilder::get_channel_stats`.

Similar to the previous `TxBuilder::get_next_commitment_stats` method,
`TxBuilder::get_channel_stats` fails if any party cannot afford the
HTLCs outbound from said party, and the anchors if they are the funder.

Aside from the API changes on `TxBuilder`, there are no functional
changes in this commit.