Force-close can't confirm while the LSP is offline: hardcoded `trusted_peers_no_reserve` leaves no CPFP path — make anchor trust configurable

[hash-money]

Scenario

Downstream integrator (graduated-custody mobile wallet, sweep-everything Model A à la Phoenix). Product flow: an emergency unilateral exit while the LSP is unreachable. close_channels correctly branches to force_close_channel for the unusable channel — but the close can never confirm, so the funds sit in the commitment's to_local (not seed-recoverable) until the LSP returns.

On-device observation (Mutinynet, 2026-07-11)

• Force-close initiated with the LSP down. The holder commitment was handed to the broadcaster and rebroadcast every ~30 s indefinitely — broadcast itself is fine.
• It never entered the mempool: legacy-anchor commitments are built at the LDK fee floor (FEERATE_FLOOR_SATS_PER_KW = 253 ≈ 1.01 sat/vB), by design assuming a CPFP bump at close time.
• The bump never comes (mechanism below), and nothing external can help: the local anchor is keyed (get_keyed_anchor_redeemscript), and the anyone-can-spend branch needs the commitment already confirmed 16 blocks — exactly what we can't get.

Mechanism (at a283d74)

orange-sdk/src/lightning_wallet.rs#L66-L69 unconditionally puts the LSP in AnchorChannelsConfig::trusted_peers_no_reserve. ldk-node's documented semantics for trusted peers: "we won't take any action to get the required channel closing transactions confirmed ourselves … potentially insecure as the channel may not be closed if they refuse to do so" — and its event handler skips the bump exactly there ("Ignoring BumpTransactionEvent::ChannelClose … due to trusted counterparty", event.rs).

Neither Tunables nor WalletConfig (nor the FFI surface) exposes any anchor/trust/reserve field, so an integrator cannot change this without carrying a fork.

Ask

Make the LSP's anchor trust configurable — e.g. a Tunables field (lsp_trusted_no_reserve: bool, default true, preserving current behavior) plumbed into the AnchorChannelsConfig. Happy to send this PR if you'd take it; we can validate the untrusted path end-to-end on our Mutinynet staging stack (scripted LSP-down harness, both ends instrumented).

The tradeoff, stated honestly

De-trusting the LSP re-introduces ldk-node's per-channel anchor reserve (25k sat default) — in real tension with a sweep-everything wallet whose on-chain balance is ~0 at steady state (without a reserve, CPFP coin selection finds no confirmed UTXO and aborts anyway). So this knob is the first-order fix that makes unilateral exit possible for integrators willing to hold a reserve; the reserve-free design (zero-fee-commitment channels + keyless P2A bump) is gated in ldk-node, and we're filing those exposure asks there separately.

[hash-money]

Closing for now — we're first researching a client-side alternative that needs no changes here: a recovery tool that extracts the closing transaction from the user's own encrypted state backup (seed + channel state, which our users hold as a cloud/file backup) and completes the hostile/non-cooperative exit out of band. If that path proves unworkable we may ask to reopen this with our findings. Thanks for the consideration.

[hash-money]

Update for anyone tracking this from the orange-sdk side: we validated the recovery path that resolves this failure class against ldk-node main (#660, zero-fee commitments) on Mutinynet.

The unilateral exit works via backup restore, not via the live node's trusted-peer close: with the LSP permanently offline, restoring the channel state onto a fresh wallet (that does not trust the dead LSP) and force-closing lets it broadcast the fee-0 commitment and CPFP the keyless P2A anchor with any user-provided fee UTXO — no per-channel reserve, no keyed-anchor tooling. Confirmed on-chain, reproduced twice, incl. a zero-on-chain user recovering a 40k to_local. Details + txids in lightningdevkit/ldk-node#987.

So this is resolved for us by the 0FC path plus our own restore/broadcast tooling; no orange-sdk change is required beyond eventually surfacing the 0FC knob. Recording the link; no action needed here.