rust-lightning

Prevent stale fs-store writes after lock cleanup

Reserve write versions while holding the per-path lock map mutex so
cleanup cannot remove the version state between version allocation and
lock reference acquisition.

Add a regression test for the ordering invariant.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Release LSPS2 intercepted HTLCs on open failure

When a JIT channel open fails, release queued intercepted HTLCs through the intercept API so they are not held until expiry. Keep resetting the LSPS2 state if an intercept has already been released.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Avoid repeated persisted async invoice refreshes

When a used async receive offer's refreshed static invoice is persisted,
advance the recorded invoice creation time. This keeps the refresh
threshold anchored to the newest invoice instead of making the offer
look stale on every timer tick.

Add coverage that a used offer does not enqueue another
ServeStaticInvoice immediately after the server confirms the refresh.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Account for UTXO base weight in anchor reserve checks

get_supportable_anchor_channels estimates how much each reserve UTXO can contribute after spending fees. Include the base input weight in that fee so UTXOs just below the public per-channel reserve are not counted as supporting another anchor channel.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Return P2WSH script pubkey for keyed anchor prevouts

AnchorDescriptor::previous_utxo is used for coin selection and PSBT witness_utxo metadata. For keyed anchors it should describe the on-chain P2WSH anchor output instead of the witness script so wallets can validate and sign the package.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Throttle LSPS5 lifecycle cooldown resets

LSPS5 resets notification cooldowns when a peer reconnects so clients
can receive prompt wake-ups after coming online. A peer can otherwise
churn connections to clear the webhook cooldown repeatedly, turning the
LSP into an amplification source for registered notification URLs.

Rate-limit how often peer lifecycle events may clear notification
cooldowns while keeping the first reset immediate. Also make
LSPSDateTime elapsed-time calculation directional so backwards clock
movement does not make future timestamps look expired.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Clear stale monitor pending resends on reestablish

A stale ChannelManager can be reloaded after a monitor update has
already completed in a prior runtime and released its post-update
messages to the counterparty. The latest ChannelMonitor is not stale,
but the serialized manager may still contain the old in-flight monitor
state and `monitor_pending_*` resend flags from before the completion
action ran.

This becomes observable when startup monitor-completion background
events are interleaved with splice promotion. On reload, the completed
monitor update is queued as a background event. If a splice confirmation
is processed before that background event fully resumes the channel,
splice promotion can create a new `RenegotiatedFundingLocked` monitor
update. The old completion is then blocked behind the new in-flight
splice update. Once the channel reconnects and the splice update
completes, `monitor_updating_restored` may consume the stale
`monitor_pending_revoke_and_ack` / `monitor_pending_commitment_signed`
flags and release a duplicate `revoke_and_ack` or `commitment_signed`.

The peer's `channel_reestablish` commitment numbers are authoritative
for this case. If `next_remote_commitment_number` says the peer is not
waiting for a `revoke_and_ack`, clear `monitor_pending_revoke_and_ack`.
Likewise, if `next_local_commitment_number` says the peer already has
our latest `commitment_signed`, clear
`monitor_pending_commitment_signed`.

Send splice_locked before reestablish commitment

If we have pending updates to send to our counterparty on
reestablishment, while also pending a `splice_locked` send, then we must
send our `splice_locked` first as the pending updates are considering
the post-splice-locked state.

Raise iteration capacity in chanmon consistency when settling state

LDK and the chanmon_consistency fuzz target have grown in complexity
recently and thus require more iterations than previously assumed to
fully settle the state of all active channels.

Ignore stale splice signing fuzz events

Now that the fuzz target supports canceling splice funding attempts, we
may see failed signing attempts due to the cancellation.

Send splice_locked for promoted splice on reconnect

When a splice confirms after our `channel_reestablish` was generated and
sent, but prior to processing the counterparty's, we may promote the
splice and clear `pending_splice`. In such cases, we're still required
to send an explicit `splice_locked` as the `channel_reestablish` we sent
did not consider the splice confirmation.

Reject quantity of 0 for offers with bounded quantity

An offer advertising Quantity::Bounded expects at least one item, but
is_valid_quantity accepted a quantity of 0 since it only checked the
upper bound. Require the quantity to be greater than 0 so that an
invoice request for 0 items is rejected as an InvalidQuantity.

Co-Authored-By: Claude <noreply@anthropic.com>

Prefer outbound_scid_alias over short_channel_id in get_outbound_payment_scid

With splicing, the real SCID changes when a splice confirms while the
outbound_scid_alias remains stable. Prefer alias-first in
get_outbound_payment_scid so routes built before a splice confirmation
stay valid after.

Also fix route direction in fail_splice_on_tx_complete_error and update
onion_route_tests comment to state intent rather than describe change.

Correct HashMap preallocation amount copy/paste typo

Stop using an introduction node in blinded message paths

lnd is preparing to ship a release with opt-in onion messages
without support for forwarding onion messages from non-channel
peers. This breaks the common BOLT 12 OM flow today where we
direct-connect to the blinded path introduction point and send the
`invoice_request` without a channel. For CLN it turns out this is
fine as they never select a peer for their introduction point at
all. However, for LDK this would break existing nodes as nodes
might now pick an lnd peer as an introduction node but it won't
forward the onion message.

For now, we just drop the separate introduction point selection and
just always use ourselves as an introduction point (assuming we're
an announced node).

This should also have the side-effect of making offers marginally
more robust, which may be worth it, even if it sucks to drop any
pretense of privacy.

Set PaymentSent::fee_paid_msat in abandoned case

If an outbound payment was abandoned with htlcs in-flight and later claimed, we
would previously have the PaymentSent::fee_paid_msat be set to None. This
contradicted some docs on the event that stated the field would always be Some
after 0.0.103.

Persist negotiated splice candidates on reload

Prior to supporting RBF, we would avoid persisting
`FundedChannel::pending_splice` when there was a pending funding
negotiation that could not be resumed on channel reestablishment. With
the addition of RBF support, this would cause our previously negotiated
splices (but still pending) to be dropped unintentionally.

Add async migratable filesystem stores

Allow the filesystem stores to use the async migration helper and cover
both store versions with async migration tests.

Co-Authored-By: HAL 9000

Add async migratable KV store migration API

Expose an async migratable KV store trait and async migration helper so
async stores can migrate data without using the synchronous API.

Co-Authored-By: HAL 9000

Rename migratable KV store trait for sync API

Prepare the migration API naming for an async variant by giving the
existing synchronous trait an explicit Sync suffix.

Co-Authored-By: HAL 9000

Add AGENTS.md symlink

Add AGENTS.md as a symlink to CLAUDE.md so Codex can load the same
repository guidance.

Generate TLV write length impls

Add a writeable TLV helper macro that emits both write and
serialized_length from the same field list. Reuse the shared TLV length
helper from impl_ser_tlv_based so the generated read/write path and the
new custom-read path stay aligned.

Use the new helper for the hot channel funding and commitment
transaction TLV writers while leaving their custom read implementations
unchanged.

Avoid nested TLV length counting writes

Add direct serialized length implementations for common serialization
wrappers. This avoids routing field payload length calculations through
in-memory writers for common nested serialization paths used by the
existing TLV length helpers.

Rename read-write TLV ser macros

Rename TLV macros that generate both Readable and Writeable
impls to use the impl_ser_tlv_based prefix. Keep the MaybeReadable
upgradable enum helpers and shared write-only enum helper under
writeable naming so macro names match the traits they generate.

Detect nested v1 filesystem data

FilesystemStoreV2 already rejected v1 data when a key file was found
at the store root, but it did not inspect namespace directories. This
missed v1 layouts such as primary/key, where v2 expects primary to
contain secondary namespace directories.

For example, an ldk-node store can contain a BDK descriptor below a
namespace directory. The previous check would accept that directory as
v2 data because the root contained only directories, leaving the
incompatible descriptor file undetected.