Bug fixes and hardening (no API or config changes)
No proto or route changes since v0.0.33; clients and Nostr RPC usage are unchanged. No new configuration keys or database migrations are required.
Swaps
- Submarine swaps now verify Boltz quote fields (expected lockup amount, swap tree, and lockup address) against locally derived values before any on-chain spend or invoice payment.
- Submarine lockup fee calculation is centralized and applied consistently when creating and resuming swaps.
- Reverse swaps no longer report success unless a validated on-chain claim transaction is observed; settlement without a claim tx is treated as failure.
- Submarine swap replay is blocked when a swap operation is already in progress.
- Transaction swaps fail cleanly when completion does not include a claim txId.
Payments
- External invoice payment failures only trigger balance refunds when LND or the liquidity provider confirms the payment failed; ambiguous errors leave the payment pending instead of auto-refunding.
Nostr debits
- Debit frequency caps are re-checked inside the payment transaction to close a race where concurrent debits could exceed limits.
- Frequency-cap violations now return the correct ndebit failure code (5) instead of a generic error.
Operator action: Standard rolling restart after upgrade. Monitor logs for swap quote verification failures, pending external payments left unresolved after transient errors, and debit frequency-cap rejections.