No protobuf or HTTP/Nostr route changes since v0.0.34.
Request validation is stricter: sat amounts must be safe integers. Non-integer or unsafe values are rejected on invoice, payment, swap-quote, and channel-funding endpoints.
Behavior fixes
Debit (Ndebit): Recurring and authorized debit flows now require an authorized debit-access row; missing or revoked access returns Ndebit failure code 1. One-off invoice debits still work without prior authorization but are denied when a ban row exists.
Invoice swap refunds: RefundAdminInvoiceSwap is idempotent when a refund tx is already recorded. Refund state is persisted only after a successful broadcast; the admin uncooperative-refund path now records the refund tx after LND publish.
Failed pending payments: Balance refunds for confirmed failed outgoing payments run in a single DB transaction to avoid partial updates.
Balance storage: User balance increment/decrement rejects non-safe-integer sat amounts.
Config
No configuration changes.
Migration
No database migrations required. Upgrade in place; no operator action needed beyond deploying the new build. Apps relying on debits without prior authorization may need to ensure users complete debit authorization first.
