v0.9.0-rc4

What's Changed

• fix: watchtower multi-pass settlement tx scan for child-before-parent indexer ordering by @quake in #1439
• fix: prevent funding abort when tx is committed on chain after restart by @doitian in #1440
• fix: report permanent SendTx failures via tracer to restore abort_funding by @doitian in #1444
• harden gossip result handling by @jjyr in #1442
• [codex] Require dev scope for dev RPC by @jjyr in #1432
• fix: gate external funding TxUpdate sync on is_acceptor or signed_submitted by @quake in #1447
• [codex] Resolve flaky race in check_channels missing actor test by @jjyr in #1435
• Validate custom records size by @chenyukang in #1448
• [codex] Fix active gossip sync accounting by @jjyr in #1441
• fix: bind CCH fee budget to outgoing payments by @doitian in #1429
• chore(deps-dev): bump esbuild from 0.25.5 to 0.28.1 in /fiber-js by @dependabot[bot] in #1445
• fix: validate peer tlc_basepoint and per_commitment_point before accept by @quake in #1449
• fix: move TLC cleanup after commitment signature verification by @quake in #1450
• Stabilize watchtower multiple payments e2e by @chenyukang in #1458
• fix: prevent overflow panic on commitment_number=0 in watchtower settlement by @quake in #1452
• fix: remove watchtower channel entries on funding abort by @quake in #1457
• fix: only set THEIR_SHUTDOWN_SENT when peer actually sent Shutdown, not on reestablish by @quake in #1453
• fix: allow FNN_EVENT_WAIT_TIMEOUT_SECS to override wait_until_async_timeout by @quake in #1459
• fix: use pruning-aware apply_remove_tlc in clean_up_failed_tlcs to prevent unbounded commitment-point growth by @quake in #1454
• fix: skip sign funding tx when channel no longer exists by @quake in #1462
• test: stabilize max trampoline hops routing by @chenyukang in #1465
• fix: add reestablish timeout to prevent peer from stalling TLC safety handling indefinitely by @quake in #1456
• fix: remove panic paths from UDT regex and CKB RPC byte responses by @quake in #1467
• fix: delete stale channel-open records on peer disconnect by @quake in #1464
• fix: gossip CKB flood + npm release supply-chain hardening by @quake in #1460
• fix: verify channel update signatures in TryBroadcastMessages to prevent gossip bypass via onion errors by @quake in #1455
• fix: debounce payment retry scans on reestablish to prevent resource exhaustion by @quake in #1466
• fix: restrict watchtower channel removal to closed channels by @quake in #1463
• fix: prevent duplicate InFlightCkbTxActor spawns for the same tx by @quake in #1468
• fix: prevent funding abort when channel already signed by @quake in #1461
• chore: bump version to 0.9.0-rc4 by @quake in #1471
• fix: commit package-lock.json for npm ci compatibility by @quake in #1473
• fiber-js: adapt newer TypeScript version by @Officeyutong in #1474
• [codex] fix TLC in-flight limits after failed cleanup by @jjyr in #1472
• Add migration for TrampolineContext max_outgoing_tlc_expiry by @quake in #1476
• fix: record incorrect TLC expiry on reporting channel by @jjyr in #1475
• fix: validate next_per_commitment_point in RevokeAndAck against tlc_basepoint by @quake in #1478
• Stabilize trampoline rand expiry by @chenyukang in #1477
• chore(deps): bump log from 0.4.32 to 0.4.33 by @dependabot[bot] in #1481
• fix: coalesce ChannelReady retry scans by @quake in #1484

Full Changelog: v0.9.0-rc3...v0.9.0-rc4