0.2.3 final backports

[TheBlueMatt]

Backports #4717, #4716, #4714, #4713, #4712, #4718, and #4719.

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this PR (a backport bundle of already-reviewed upstream PRs):

• lightning-invoice/src/lib.rs — get_payee_pub_key/recover_payee_pub_key refactor removes the prior mutual recursion and is safe: check_signature cryptographically verifies an included payee_pub_key actually signed the invoice, so preferring it over the recovered key cannot be spoofed.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel DoS caps are correct; the continue for the channel cap is placed after all per-announcement reads so the cursor stays aligned, and the read-only lock is dropped before write operations (no deadlock).
• lightning/src/util/macro_logger.rs — DebugMsg truncation uses char_indices().nth() for a char-boundary-safe slice; off-by-one boundaries match the tests.
• lightning/src/util/ser.rs — capacity cap uses entry_size + 1, avoiding division-by-zero for zero-sized types.
• lightning/src/routing/router.rs — max_final_value_msat error index idx + 1 is always in bounds (overflow implies ≥1 following hop), and the call site marks the candidate exhausted before continue, preventing infinite loops.
• lightning/src/onion_message/dns_resolution.rs — byte-slice comparison avoids the prior non-char-boundary panic.
• possiblyrandom — the cfg gating matches the target-specific non-optional getrandom dependency in Cargo.toml; the zero-then-overwrite logic is equivalent to the old behavior on error.
• Logging changes in peer_handler.rs/channel.rs correctly route counterparty strings through log_msg! (deref coercion from &Cow<str>/&String to &str works).

No bugs, security issues, or logic errors found.

[TheBlueMatt]

Backports #4717, #4716, #4714, #4713, #4712, #4718, and #4719.

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this PR (a backport bundle of already-reviewed upstream PRs):

• lightning-invoice/src/lib.rs — get_payee_pub_key/recover_payee_pub_key refactor removes the prior mutual recursion and is safe: check_signature cryptographically verifies an included payee_pub_key actually signed the invoice, so preferring it over the recovered key cannot be spoofed.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel DoS caps are correct; the continue for the channel cap is placed after all per-announcement reads so the cursor stays aligned, and the read-only lock is dropped before write operations (no deadlock).
• lightning/src/util/macro_logger.rs — DebugMsg truncation uses char_indices().nth() for a char-boundary-safe slice; off-by-one boundaries match the tests.
• lightning/src/util/ser.rs — capacity cap uses entry_size + 1, avoiding division-by-zero for zero-sized types.
• lightning/src/routing/router.rs — max_final_value_msat error index idx + 1 is always in bounds (overflow implies ≥1 following hop), and the call site marks the candidate exhausted before continue, preventing infinite loops.
• lightning/src/onion_message/dns_resolution.rs — byte-slice comparison avoids the prior non-char-boundary panic.
• possiblyrandom — the cfg gating matches the target-specific non-optional getrandom dependency in Cargo.toml; the zero-then-overwrite logic is equivalent to the old behavior on error.
• Logging changes in peer_handler.rs/channel.rs correctly route counterparty strings through log_msg! (deref coercion from &Cow<str>/&String to &str works).

No bugs, security issues, or logic errors found.

[TheBlueMatt]

Backports #4717, #4716, #4714, #4713, #4712, #4718, and #4719.

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this PR (a backport bundle of already-reviewed upstream PRs):

• lightning-invoice/src/lib.rs — get_payee_pub_key/recover_payee_pub_key refactor removes the prior mutual recursion and is safe: check_signature cryptographically verifies an included payee_pub_key actually signed the invoice, so preferring it over the recovered key cannot be spoofed.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel DoS caps are correct; the continue for the channel cap is placed after all per-announcement reads so the cursor stays aligned, and the read-only lock is dropped before write operations (no deadlock).
• lightning/src/util/macro_logger.rs — DebugMsg truncation uses char_indices().nth() for a char-boundary-safe slice; off-by-one boundaries match the tests.
• lightning/src/util/ser.rs — capacity cap uses entry_size + 1, avoiding division-by-zero for zero-sized types.
• lightning/src/routing/router.rs — max_final_value_msat error index idx + 1 is always in bounds (overflow implies ≥1 following hop), and the call site marks the candidate exhausted before continue, preventing infinite loops.
• lightning/src/onion_message/dns_resolution.rs — byte-slice comparison avoids the prior non-char-boundary panic.
• possiblyrandom — the cfg gating matches the target-specific non-optional getrandom dependency in Cargo.toml; the zero-then-overwrite logic is equivalent to the old behavior on error.
• Logging changes in peer_handler.rs/channel.rs correctly route counterparty strings through log_msg! (deref coercion from &Cow<str>/&String to &str works).

No bugs, security issues, or logic errors found.

[TheBlueMatt]

Backports #4717, #4716, #4714, #4713, #4712, #4718, and #4719.

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this PR (a backport bundle of already-reviewed upstream PRs):

• lightning-invoice/src/lib.rs — get_payee_pub_key/recover_payee_pub_key refactor removes the prior mutual recursion and is safe: check_signature cryptographically verifies an included payee_pub_key actually signed the invoice, so preferring it over the recovered key cannot be spoofed.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel DoS caps are correct; the continue for the channel cap is placed after all per-announcement reads so the cursor stays aligned, and the read-only lock is dropped before write operations (no deadlock).
• lightning/src/util/macro_logger.rs — DebugMsg truncation uses char_indices().nth() for a char-boundary-safe slice; off-by-one boundaries match the tests.
• lightning/src/util/ser.rs — capacity cap uses entry_size + 1, avoiding division-by-zero for zero-sized types.
• lightning/src/routing/router.rs — max_final_value_msat error index idx + 1 is always in bounds (overflow implies ≥1 following hop), and the call site marks the candidate exhausted before continue, preventing infinite loops.
• lightning/src/onion_message/dns_resolution.rs — byte-slice comparison avoids the prior non-char-boundary panic.
• possiblyrandom — the cfg gating matches the target-specific non-optional getrandom dependency in Cargo.toml; the zero-then-overwrite logic is equivalent to the old behavior on error.
• Logging changes in peer_handler.rs/channel.rs correctly route counterparty strings through log_msg! (deref coercion from &Cow<str>/&String to &str works).

No bugs, security issues, or logic errors found.

[TheBlueMatt]

Backports #4717, #4716, #4714, #4713, #4712, #4718, and #4719.

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this PR (a backport bundle of already-reviewed upstream PRs):

• lightning-invoice/src/lib.rs — get_payee_pub_key/recover_payee_pub_key refactor removes the prior mutual recursion and is safe: check_signature cryptographically verifies an included payee_pub_key actually signed the invoice, so preferring it over the recovered key cannot be spoofed.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel DoS caps are correct; the continue for the channel cap is placed after all per-announcement reads so the cursor stays aligned, and the read-only lock is dropped before write operations (no deadlock).
• lightning/src/util/macro_logger.rs — DebugMsg truncation uses char_indices().nth() for a char-boundary-safe slice; off-by-one boundaries match the tests.
• lightning/src/util/ser.rs — capacity cap uses entry_size + 1, avoiding division-by-zero for zero-sized types.
• lightning/src/routing/router.rs — max_final_value_msat error index idx + 1 is always in bounds (overflow implies ≥1 following hop), and the call site marks the candidate exhausted before continue, preventing infinite loops.
• lightning/src/onion_message/dns_resolution.rs — byte-slice comparison avoids the prior non-char-boundary panic.
• possiblyrandom — the cfg gating matches the target-specific non-optional getrandom dependency in Cargo.toml; the zero-then-overwrite logic is equivalent to the old behavior on error.
• Logging changes in peer_handler.rs/channel.rs correctly route counterparty strings through log_msg! (deref coercion from &Cow<str>/&String to &str works).

No bugs, security issues, or logic errors found.

[TheBlueMatt]

Backports #4717, #4716, #4714, #4713, #4712, #4718, and #4719.

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this PR (a backport bundle of already-reviewed upstream PRs):

• lightning-invoice/src/lib.rs — get_payee_pub_key/recover_payee_pub_key refactor removes the prior mutual recursion and is safe: check_signature cryptographically verifies an included payee_pub_key actually signed the invoice, so preferring it over the recovered key cannot be spoofed.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel DoS caps are correct; the continue for the channel cap is placed after all per-announcement reads so the cursor stays aligned, and the read-only lock is dropped before write operations (no deadlock).
• lightning/src/util/macro_logger.rs — DebugMsg truncation uses char_indices().nth() for a char-boundary-safe slice; off-by-one boundaries match the tests.
• lightning/src/util/ser.rs — capacity cap uses entry_size + 1, avoiding division-by-zero for zero-sized types.
• lightning/src/routing/router.rs — max_final_value_msat error index idx + 1 is always in bounds (overflow implies ≥1 following hop), and the call site marks the candidate exhausted before continue, preventing infinite loops.
• lightning/src/onion_message/dns_resolution.rs — byte-slice comparison avoids the prior non-char-boundary panic.
• possiblyrandom — the cfg gating matches the target-specific non-optional getrandom dependency in Cargo.toml; the zero-then-overwrite logic is equivalent to the old behavior on error.
• Logging changes in peer_handler.rs/channel.rs correctly route counterparty strings through log_msg! (deref coercion from &Cow<str>/&String to &str works).

No bugs, security issues, or logic errors found.

[TheBlueMatt]

Backports #4717, #4716, #4714, #4713, #4712, #4718, and #4719.

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this PR (a backport bundle of already-reviewed upstream PRs):

• lightning-invoice/src/lib.rs — get_payee_pub_key/recover_payee_pub_key refactor removes the prior mutual recursion and is safe: check_signature cryptographically verifies an included payee_pub_key actually signed the invoice, so preferring it over the recovered key cannot be spoofed.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel DoS caps are correct; the continue for the channel cap is placed after all per-announcement reads so the cursor stays aligned, and the read-only lock is dropped before write operations (no deadlock).
• lightning/src/util/macro_logger.rs — DebugMsg truncation uses char_indices().nth() for a char-boundary-safe slice; off-by-one boundaries match the tests.
• lightning/src/util/ser.rs — capacity cap uses entry_size + 1, avoiding division-by-zero for zero-sized types.
• lightning/src/routing/router.rs — max_final_value_msat error index idx + 1 is always in bounds (overflow implies ≥1 following hop), and the call site marks the candidate exhausted before continue, preventing infinite loops.
• lightning/src/onion_message/dns_resolution.rs — byte-slice comparison avoids the prior non-char-boundary panic.
• possiblyrandom — the cfg gating matches the target-specific non-optional getrandom dependency in Cargo.toml; the zero-then-overwrite logic is equivalent to the old behavior on error.
• Logging changes in peer_handler.rs/channel.rs correctly route counterparty strings through log_msg! (deref coercion from &Cow<str>/&String to &str works).

No bugs, security issues, or logic errors found.

[TheBlueMatt]

Backports #4717, #4716, #4714, #4713, #4712, #4718, and #4719.

[ldk-reviews-bot]

I've assigned @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

[ldk-claude-review-bot]

No issues found.

I reviewed every file and hunk in this PR (a backport bundle of already-reviewed upstream PRs):

• lightning-invoice/src/lib.rs — get_payee_pub_key/recover_payee_pub_key refactor removes the prior mutual recursion and is safe: check_signature cryptographically verifies an included payee_pub_key actually signed the invoice, so preferring it over the recovered key cannot be spoofed.
• lightning-rapid-gossip-sync/src/processing.rs — node/channel DoS caps are correct; the continue for the channel cap is placed after all per-announcement reads so the cursor stays aligned, and the read-only lock is dropped before write operations (no deadlock).
• lightning/src/util/macro_logger.rs — DebugMsg truncation uses char_indices().nth() for a char-boundary-safe slice; off-by-one boundaries match the tests.
• lightning/src/util/ser.rs — capacity cap uses entry_size + 1, avoiding division-by-zero for zero-sized types.
• lightning/src/routing/router.rs — max_final_value_msat error index idx + 1 is always in bounds (overflow implies ≥1 following hop), and the call site marks the candidate exhausted before continue, preventing infinite loops.
• lightning/src/onion_message/dns_resolution.rs — byte-slice comparison avoids the prior non-char-boundary panic.
• possiblyrandom — the cfg gating matches the target-specific non-optional getrandom dependency in Cargo.toml; the zero-then-overwrite logic is equivalent to the old behavior on error.
• Logging changes in peer_handler.rs/channel.rs correctly route counterparty strings through log_msg! (deref coercion from &Cow<str>/&String to &str works).

No bugs, security issues, or logic errors found.