Askrene and xpay improve

[rustyrussell]

Depends on #9138

This prepwork for repeatpay improves askrene and xpay:

1. Cleans up JSON ids for plugins, now they're always strings.
2. Add "success" knowledge to askrene, and have xpay use it.
3. Make askrene's explain-failure smarter when we have insufficient funds.
4. Simplify recurrence handling (repeatpay will ensure consistency).
5. Make sure currency-based offers give invoices with 10-minute timeouts, for currency fluctuations.

[cdecker]

ACK 9b3f051

[Lagrang3]

Overall I like the improvements introduced in this PR.
Askrene's layers as they are right now, convey unprocessed information in the form of
constraints and impressions with their associated timestamp. There is not space for interpretation here.

In this way we delegate the interpretation to the moment when we call getroutes:
"given these channel intels we recorded in time what do you think is the most likely current liquidity range".
I wanted to add a smooth time relaxation of the channel constraints and it can be very much
compatible with this abstraction if we implement it this way.

[Lagrang3]

• rebased,
• fixed memory leak,
• added unit tests for str_to_u64,

[Lagrang3]

• rebased
• fixed xpay tests after changes in the "explain failure" messages

[Lagrang3]

Is this correct? Why is olddata >= data_in?
I thought wire's cursors moved to greater values after reading.

[Lagrang3]

On one commit comment:

commit 199e0572040e13e86c580897f694e63faf347766 (HEAD)
Author: Rusty Russell <rusty@rustcorp.com.au>
Date:   Wed May 20 18:00:49 2026 +0930

    askrene: correctly order constraints.
    
    Pure "constraints" don't care about order (they simply clamp max and
    min), but "impressions" are relative, so they do.  Change the
    hashtable to keep them timestamp sorted.
    
    Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

Ordering is awesome! Besides the fact that impressions being relative do care about order, it can also be argued that "pure constraints" should also because older constraints are less reliable than the more recent.

[Lagrang3]

• added a small optimization: now that "channel intels" are sorted by timestamp we can remove old entries with a single realloc,
• rebased,

[Lagrang3]

• added a new case to "explain failure", for capacity that is known and enabled.

[Lagrang3]

• replaced

tal_free(intelarr[i].impression);
tal_free(intelarr[i].constraint);

with

tal_steal(tmpctx, intelarr[i].impression);
tal_steal(tmpctx, intelarr[i].constraint);

• rebased

[Lagrang3]

• fixed some failing tests due to change in the error messages,
• rebased

[Lagrang3]

• rebase,
• fixed conflicts with wallet/migrations.c

I can't reproduce the change in the doc examples that CI generated in the previous run. It must be a flake.
Let's see when this run completes.

[nGoline]

ack 3a3af52

[nGoline]

Re-reviewed at 3a3af52. Everything from my July round is addressed: the copy_data argument inversion is fixed at all seven sites, test_downgrade_impressions now round-trips all record types (constraints, impressions, node bias, channel bias, created channels, updates, disabled nodes), the htable-during-iteration hazard in layer_trim_constraints has a proper deferred re-add with a comment, and the str_to_u64 test and indentation are fixed, and CI is green.

Nothing below blocks merge. Filing the first two as follow-up issues. The rest are cosmetic and can be swept whenever.

[nGoline]

layer_apply_constraints() adds imp->amount to both min and max for the reverse direction with no clamp to channel capacity, and saturating-subtracts to 0 on the forward direction. With get_constraints() now seeding *max from the gossmap capacity rather than -1ULL, max can end up above capacity, and enough same-direction volume drives it to 0. The FIXME added to test_xpay_fake_channeld documents exactly this ("a buildup of usage on 0x2134x0/0"). mcf.c guards min > max and askrene-age caps impression lifetime at an hour, so the blast radius is bounded, but clamping max to capacity and min to max inside layer_apply_constraints() would keep the layer state coherent while the tuning work happens separately.

[nGoline]

test_xpay_fake_channeld uses skip, and will stay silent once channeld_fakenet is fixed. xfail(strict=True) matches the convention and fails loudly when the underlying problem goes away. The reason string should also reference #9282.

[nGoline]

Some cosmetic fixes to be done when you feel like...

• tools/lightning-downgrade.c:56,133: both wrappers pass convert_impression = true, so the if (!convert_impression) copy_data(...) branch is unreachable. The name also reads backwards, true means drop. Either drop the parameter or rename to drop_impressions.
• lightningd/offer.c:380,451: prev_basetime is never assigned now, so the previous_basetime response field is dead. Both can go.
• plugins/askrene/datastore_wire.c: fromwire_dstore_channel_impression() takes const tal_t *ctx and never uses it, unlike the bias variant which needs it for the string.
• plugins/askrene/layer.c:1214: the counting loop uses continue where the sorted-array invariant means break. If the array is ever unsorted, count_old and tal_arr_remove_range(&intelarr, 0, count_old) disagree and the entries stolen to tmpctx stay referenced. break matches the stated assumption and fails safe.
• plugins/askrene/layer.c:1142,1144: AMOUNT_MSAT(-1ULL), whereas add_constraint() a few lines up uses AMOUNT_MSAT(UINT64_MAX).
• plugins/askrene/layer.c:1223: if(count_old){ wants spaces.
• common/utils.c:150: // comment, codebase uses /* */. Header doc says "Remove a range of element".
• doc/schemas/askrene-age.json: num_removed is documented as "number of constraints removed", it now counts impressions too.
• All three askrene schemas: the impressions[].timestamp description is copy-pasted as "The UNIX timestamp when this constraint was created."
• plugins/libplugin.c:346: when prefix needs escaping the guard blanks method instead of prefix, so the unsafe prefix still lands in the id. Unreachable today since every id a plugin sees is lightningd-generated and already sanitized, and method is a literal at every call site, so the condition only fires for the case it does not fix. One-word fix if you want it: prefix = "!weird!".