rust-lightning

Validate all common fields in LSPS1 `is_valid` order check

Add missing cross-validation of `LSPS1OrderParams` against
`LSPS1Options` as required by bLIP-51:

- Check `required_channel_confirmations` >= `min_required_channel_confirmations`
- Check `funding_confirms_within_blocks` >= `min_funding_confirms_within_blocks`
- Check total channel balance (`lsp_balance_sat` + `client_balance_sat`)
is within [`min_channel_balance_sat`, `max_channel_balance_sat`],
using `checked_add` to guard against overflow

Co-Authored-By: HAL 9000

Clamp our selected reserve to the counterparty's dust limit

In a subsequent commit, we will allow the counterparty's dust limit to
be greater than our `MIN_THEIR_CHANNEL_RESERVE_SATOSHIS`. Our selected
reserve must always be greater than their dust limit, so we set our
selected reserve to be equal to or greater than their dust limit.

Remove ChannelSignerType

We plan to have a single channel signer type going forward, so this is
unnecessary.

Remove musig2 crate

Taproot support is not planned we see an increase in demand for it by
users. The `musig2` crate is now owned by a third-party, and ultimately
won't be used by the production version of Taproot that we end up
releasing.

Handle FeeRateAdjustmentError variants in splice acceptor path

Replace the generic error handling in splice_init and tx_init_rbf with
explicit matching on FeeRateAdjustmentError variants:

- FeeRateTooLow: initiator's feerate is below our minimum. Proceed
without contribution and preserve QuiescentAction for an RBF retry at
our preferred feerate.
- FeeRateTooHigh: initiator's feerate exceeds our maximum and would
consume too much of our change output. Reject the splice with
WarnAndDisconnect.
- FeeBufferInsufficient: our fee buffer can't cover the acceptor's
estimated fee at this feerate. Proceed without contribution.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Handle tx_ack_rbf on the initiator side

After sending tx_init_rbf, the initiator receives tx_ack_rbf from the
acceptor. Implement the handler to validate the response and begin
interactive transaction construction for the RBF funding transaction.

Only clear the interactive signing session in `reset_pending_splice_state`
when the current funding negotiation is in `AwaitingSignatures`. When an
earlier round completed signing and a later RBF round is in `AwaitingAck`
or `ConstructingTransaction`, the session belongs to the prior round and
must be preserved. Otherwise, disconnecting mid-RBF would destroy the
completed prior round's signing session and fire a false debug assertion.

Update test_splice_rbf_acceptor_basic to exercise the full initiator
flow: rbf_channel → funding_contributed → STFU exchange → tx_init_rbf →
tx_ack_rbf → interactive TX → signing → mining → splice_locked. This
replaces the previous test that manually constructed tx_init_rbf.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ln/events: multiple htlcs in/out for trampoline PaymentForwarded

Contribute to splice as acceptor

When both nodes want to splice simultaneously, the quiescence
tie-breaker designates one as the initiator. Previously, the losing
node responded with zero contribution, requiring a second full splice
session after the first splice locked. This is wasteful, especially for
often-offline nodes that may connect and immediately want to splice.

Instead, the losing node contributes to the winner's splice as the
acceptor, merging both contributions into a single splice transaction.
Since the FundingContribution was originally built with initiator fees
(which include common fields and shared input/output weight), the fee is
adjusted to the acceptor rate before contributing, with the surplus
returned to the change output.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Adjust FundingContribution for acceptor

When constructing a FundingContribution, it's always assumed the
estimated_fee is for when used as the initiator, who pays for the common
fields and shared inputs / outputs. However, when the contribution is
used as the acceptor, we'd be overpaying fees.

Additionally, the initiator's chosen fee rate may not be compatible with
the acceptors contributions. The selected UTXOs may not be enough to pay
for a higher feerate (i.e., the change output is not enough to pay or
there is no change output).

This change provides a method on FundingContribution for adjusting the
fee rate with the above concerns in mind. It also updates it to include
a max_feerate specified by the user when initiating a splice. This
ensures the acceptor isn't forced to pay an overly high fee rate.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Include change output weight in estimate_transaction_fee

Add a `change_output: Option<&TxOut>` parameter to
`estimate_transaction_fee` so the initial fee estimate accounts for the
change output's weight. Previously, the change output weight was omitted
from `estimated_fee` in `FundingContribution`, causing the estimate to
be slightly too low when a change output was present.

This also eliminates an unnecessary `Vec<TxOut>` allocation in
`compute_feerate_adjustment`, which previously cloned outputs into a
temporary Vec just to include the change output for the fee estimate.

A mock `TightBudgetWallet` is added to `splicing_tests` to demonstrate
that `validate()` correctly rejects contributions where the input value
is sufficient without the change output weight but insufficient with it.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Stop persisting QuiescentAction and remove legacy code

Now that the Splice variant (containing non-serializable
FundingContribution) is the only variant produced, and the previous
commit consumes the acceptor's quiescent_action in splice_init(),
there is no longer a need to persist it. This allows removing
LegacySplice, SpliceInstructions, ChangeStrategy, and related code
paths including calculate_change_output, calculate_change_output_value,
and the legacy send_splice_init method.

With ChangeStrategy removed, the only remaining path in
calculate_change_output was FromCoinSelection which always returned
Ok(None), making it dead code. The into_interactive_tx_constructor
method is simplified accordingly, and the signer_provider parameter
is removed from it and from splice_init/splice_ack since it was only
needed for the removed change output calculation.

On deserialization, quiescent_action (TLV 65) is still read for
backwards compatibility but discarded, and the awaiting_quiescence
channel state flag is cleared since it cannot be acted upon without
a quiescent_action.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Propagate unexpected metadata errors when preserving mtime in fs_store

Previously, all fs::metadata errors were silently ignored via .ok(),
which could hide permission or I/O errors. Now error are properly
handled.

Multiply the feerate by the spike multiple in `can_accept_incoming_htlc`

We choose to multiply `FEE_SPIKE_BUFFER_FEE_INCREASE_MULTIPLE` by the
feerate when checking the fee spike buffer in
`can_accept_incoming_htlc` instead of multiplying the multiple by the
commitment transaction fee. This allows us to delete
`NextCommitmentStats::commit_tx_fee_sat`, and return balances including
the commitment transaction fee in `TxBuilder::get_channel_stats`. This
unblocks a good amount of cleanup.

Note that this means LDK now rejects HTLCs that previous versions of LDK
would have accepted. We made the mirroring change in
`get_available_balances_for_scope` a few commits earlier.

We also now account for non-dust HTLCs turning to dust at the multiplied
feerate, decreasing the overall weight of the transaction.

We also remove other fields in `NextCommitmentStats` which can be easily
calculated in `channel` only.

`TxBuilder::get_channel_stats` could also check the reserve
requirements, given that it gets the reserves in `ChannelConstraints`.
I leave this to follow-up work.

Extract contributed_{inputs|outputs} iterators

The following types have methods for returning contributed inputs and
outputs:
- FundingNegotiationContext
- InteractiveTxConstructor
- InteractiveTxSigningSession
- ConstructedTransaction

Having iterators for these can avoid allocations, which is useful for
filtering contributed input and outputs when producing DiscardFunding
events.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Clean up fuzz crate: use panic=abort, add stdin_fuzz support, remove dylib

This commit makes three related changes to the fuzz infrastructure:

1. Set panic=abort on both dev and release profiles, and remove the
dylib crate type (keeping rlib and staticlib). The dylib crate type
was added in e28fd78e6 (2019) for a C-callable harness that was
never implemented. Removing dylib is what enables panic=abort,
since Rust forces panic=unwind on dylib crates. staticlib is
retained as it is compatible with panic=abort.

2. Add stdin_fuzz support: a new Stdout logger, updated target template
so that stdin_fuzz calls _test() with Stdout logging, and updated
README with usage instructions. This allows reproducing crashes via
piped input, useful for git bisect and AI-assisted debugging.

3. Update all fuzzer frontends (AFL, honggfuzz, libfuzzer, stdin_fuzz)
to call the _test() functions directly instead of going through the
_run() C wrappers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Include MPP payment amount in `RecipientOnionFields`

In some uses of LDK we need the ability to send HTLCs for only a
portion of some larger MPP payment. This allows payers to make
single payments which spend funds from multiple wallets, which may
be important for ecash wallets holding funds in multiple mints or
graduated wallets which hold funds across a trusted wallet and a
self-custodial wallet.

In order to allow for this, we need to separate the concept of the
payment amount from the onion MPP amount. Here we start this
process by adding a `total_mpp_amount_msat` field to
`RecipientOnionFields` (which is the appropriate place for a field
describing something in the recipient onion).

We currently always assert that it is equal to the existing fields,
but will relax this in the coming commit(s).

We also start including a payment preimage on probe attempts,
which appears to have been the intent of the code, but which did
not work correctly.

The bulk of the test updates were done by Claude.

Validate the `Router` is meeting MPP and max-fee limitations given

When `OutboundPayments` calls the provided `Router` to fetch a
`Route` it passes a `RouteParameters` with a specific max-fee. Here
we validate that the `Route` returned sticks to the limits
provided, and also that it meets the MPP rules of not having any
single MPP part which can be removed while still meeting the
desired payment amount.

Replace `get_payment_preimage_hash!` macro with direct function calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace `get_closing_signed_broadcast!` macro with direct function calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace `check_closed_broadcast!` macro with direct function calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Time out incomplete MPP payments in chanmon_consistency

This requires calling `timer_tick_occurred`. As a result, when
`timer_tick_occurred` is called, disabled/enabled updates and
`WarnAndDisconnect` events may be triggered.

Drive splices to completion in chanmon_consistency

This commit adds support for locking splices. This required confirming
transactions, which this target previously didn't consider.

It also fixes a `serial_id` collision, due to its generation using
the first 4 bytes of `get_secure_random_bytes`, that was preventing
splices from negotiating up to the `tx_signatures` exchange.

Support async signing in chanmon_consistency

This commit adds new opcodes to enable/disable signer operations one by
one. Note that this only covers signer operations post-funding.

Free holding cell upon tx_signatures exchange

After cad88af, a few code paths that also lead to a quiescence exit were
not accounted for. This commit addresses the last remaining path where
we exit quiescence when we exchange `tx_signatures` with the
counterparty.

Use CoinSelection::change_output when splicing

Now that CoinSelection is used to fund a splice funding transaction, use
that for determining of a change output should be used. Previously, the
initiator could either provide a change script upfront or let LDK
generate one using SignerProvider::get_destination_script.

Since older versions may have serialized a SpliceInstruction without a
change script while waiting on quiescence, LDK must still generate a
change output in this case.