EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Repository coverage

1853 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue169AI analyses
146commits · 30 days
225commits · 60 days
803commits · 180 days
1853commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
430Strong · 80–100
1163Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Rusty Russell9587376072
Sangbida Chaudhuri1463137066
Dusty Daemon771313066
ShahanaFarooqui931010063
daywalker908956062
Níckolas Goline4055076
Lagrang37644069
Christian Decker3645072
Vincenzo Palazzo833080
Chandra Pratap5622082
ekzyis222063
Peter Neuroth9711070
Analysis record

Published AI watches

Last scanned 51 minutes ago

Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Informational 16 AI analysisMessage 90 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

add a test for downgrading askrene datastore

This commit adds a regression test for Core Lightning's database downgrade path. It ensures that when a user downgrades from an upcoming v26.09 release to an older version (v26.06), the new 'impressions' data added by the askrene routing s…

Database downgrade path for new askrene schema (impressions table)Regression test only; no production code changeNo input validation, cryptography, network, or authorization changes
1818553eby Lagrang3+156−13 files
No security note in commit
Low 25 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightning-hsmtool: Fix getsecret does not show mnemonic after typing passphrase

This is a bug fix in a command-line helper tool used by Core Lightning node operators. The `getsecret` command was accidentally refusing to show the wallet recovery words (mnemonic) when the wallet was protected by a passphrase. After the …

Functional bug in secret-recovery pathError path blocked legitimate mnemonic recoveryNo input validation, memory-safety, or cryptographic change
8480f6c2by ekzyis+1−21 file
No security note in commit
Informational 12 AI analysisMessage 60 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: add regression test for hsmtool commands with passphrase

This commit only adds and updates a regression test in the project's test suite. It checks that the hsmtool utility correctly handles both empty and non-empty passphrases when working with BIP39 mnemonic-based wallet secrets. There is no c…

Regression test added for passphrase handling in hsmtoolNo production code changes observedTest-only change to tests/test_wallet.py
8c42be35by ekzyis+47−201 file
No security note in commit
Low 33 AI analysisMessage 76 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wally: update libwally to v1.5.6

This commit updates the bundled libwally library to version 1.5.6. The practical effect is that calling the JSON-RPC `signpsbt` command on a PSBT that is already signed now succeeds as a harmless no-op, instead of returning an error on Bit…

Dependency update to incorporate upstream bug fixBehavior change from error to no-op on re-signing signed PSBTsTaproot keypath handling change in upstream cryptographic library
37526ca4by daywalker90+7−82 files
No security note in commit
Low 31 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: make datastore helpers self-wrap a wallet transaction

This change fixes a crash bug in Core Lightning's wallet datastore helpers. Previously, four datastore functions required the caller to already be inside a database transaction, and would fatally crash if called outside one. The patch make…

Fixes fatal assertion/crash in database statement preparationResolves transaction-context mismatch in wallet datastore helperswatchman plugin persistence path was affected
ae1a3347by Sangbida Chaudhuri+23−11 file
No security note in commit
Informational 24 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: handle bwatch wallet/utxo spend notifications

This commit adds the missing bookkeeping that runs when Core Lightning's own on-chain wallet spends a UTXO. It makes the node mark the UTXO as spent, record the spending transaction, and log a withdrawal coin movement. It also handles bloc…

Missing spend tracking for wallet-owned UTXOs could lead to stale UTXO state or incorrect coin-movement accountingReorg handling clears spendheight, preventing a spent output from becoming permanently unspendable in the wallet's viewDefensive log_broken calls on unexpected missing UTXO or malformed watch suffix
4ba051caby Sangbida Chaudhuri+149−03 files
No security note in commit
Moderate 54 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: handle reorgs for our_outputs/our_txs by hand

This commit fixes how Core Lightning's wallet records handle blockchain reorganizations (reorgs) for two newer database tables, our_outputs and our_txs. Previously, these tables were not properly updated when blocks were removed or rolled …

Incorrect state persistence across blockchain reorgsMissing reorg handling for wallet tables without foreign-key cascadePotential stale spend/confirmation metadata in our_outputs/our_txs
bcdea215by Sangbida Chaudhuri+40−01 file
No security note in commit
Low 34 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: read UTXO state from our_outputs

This commit switches Core Lightning's wallet code to read UTXO (unspent transaction output) data from a new database table called our_outputs instead of the older outputs table. It also deletes several old helper functions and updates test…

Large internal data-model migration with reader/writer split between old and new tablesDual-write mirroring to legacy outputs table for downgrade compatibilityDeletion of legacy UTXO reading helpers
0a10e74eby Sangbida Chaudhuri+433−5772 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: rename b32script to scriptpubkey in PSBT change paths

This commit is a simple variable rename inside a Bitcoin/Lightning wallet file. The old name 'b32script' suggested all change addresses were bech32 format, but the project now uses a newer address type (p2tr) by default. The developer rena…

b8a60579by Sangbida Chaudhuri+12−141 file
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: update test_wallet.py raw-SQL queries for our_outputs

This commit only updates internal test code to query a new database table (our_outputs) instead of an old one (outputs). It does not change the actual wallet or node software that users run, so it cannot directly affect security.

d14ee378by Sangbida Chaudhuri+31−281 file
No security note in commit
Low 44 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: register scriptpubkey watches at startup

This change makes Core Lightning register long-lasting 'watches' for all wallet deposit addresses when the node starts up, so the new bwatch plugin can spot incoming payments from the first block it scans. It also removes a now-redundant p…

Change is part of an experimental chain-watcher (bwatch) featureAdds startup registration of scriptPubKey watches for all derived wallet keysRemoves a redundant unconfirmed-change watch, relying on the new blanket coverage
4a951d65by Sangbida Chaudhuri+89−114 files
No security note in commit
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: dual-write chaintopology UTXO changes into our_outputs

This is a database refactoring commit in Core Lightning. It makes the wallet write UTXO (unspent transaction output) state to a new table called our_outputs in addition to the legacy outputs table, while reads still use the old table. The …

Database schema migration with dual-write mirror patternNo security claim in commit title or messageNo CVE, advisory, or researcher attribution in commit metadata
824e8195by Sangbida Chaudhuri+118−162 files
No security note in commit
Low 32 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: record bwatch-discovered wallet outputs

This commit adds new wallet bookkeeping code for Core Lightning. It records Bitcoin deposits found by a new chain-watcher ('bwatch') into database tables and handles blockchain reorganizations by demoting transactions back to unconfirmed r…

New database write paths for wallet UTXOs and transactionsReorg revert logic demotes rather than deletes rows to preserve metadataOwner-string constructors added to avoid silent unwatch failures from format mismatches
bc021011by Sangbida Chaudhuri+543−07 files
No security note in commit
Low 32 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: route transaction reads/writes through our_txs

This commit changes how Core Lightning stores and reads wallet-related transactions. It moves most reads to a new table called our_txs while still keeping the old transactions table updated for compatibility. The main concern is that the c…

Dual-write consistency risk between our_txs and legacy transactions tableNew anti-downgrade logic for confirmed transactions in our_txsRemoval of legacy NULL handling for unconfirmed transactions
2c1ab4d0by Sangbida Chaudhuri+89−642 files
No security note in commit
Informational 18 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: add our_outputs + our_txs schema migrations

This commit only adds two new empty database tables (our_outputs and our_txs) to Core Lightning's wallet. It is a preparatory schema change for a future feature; no code reads from or writes to these tables yet, and no existing behavior is…

Schema-only migration with no runtime codeNew tables are not yet populated or queried by any code pathDesign note: sentinel 0 replaces NULL for blockheight/txindex/reserved_til, which could reduce NULL-handling bugs in future code
ea4d1fcaby Sangbida Chaudhuri+38−01 file
No security note in commit
Low 28 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: add migrate_backfill_bwatch_tables

This commit adds a database migration that copies existing wallet data into new tables used by an upcoming 'bwatch' wallet component. It is a data backfill, not a code fix for an active vulnerability. The main risk is that if the migration…

Database migration touching wallet UTXO and transaction tablesPotential for data inconsistency if mapping logic is wrongON CONFLICT DO NOTHING prevents overwrite but could hide duplicate-key anomalies
2e23893bby Sangbida Chaudhuri+513−04 files
No security note in commit
Low 27 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: mirror bwatch writes into legacy outputs table

This change is a behind-the-scenes bookkeeping patch for Core Lightning's wallet database. The project is moving to a new table (`our_outputs`) for tracking spendable coins, but older versions of the software still read from the old table …

Race-condition guard for foreign-key-backed confirmation_height and spend_height when bwatch is ahead of chaintopologyTemporary mirroring to keep legacy outputs table consistent with new our_outputs tableON CONFLICT DO NOTHING used for legacy insert to avoid duplicate-key failures
bba68e0aby Sangbida Chaudhuri+101−62 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedbkpr: limp along if we lost our db.by Rusty Russell · 29e0a1dd · Feb 17, 2026 · 2 filesMessage 76 · AdequateTriage 0Details
Commit message · Rusty Russell

bkpr: limp along if we lost our db.

We can't really do decent bookkeeping any more, but don't crash!

```
bookkeeper: plugins/bkpr/recorder.c:178: find_txo_chain: Assertion `acct->open_event_db_id' failed.
bookkeeper: FATAL SIGNAL 6 (version v25.12)
0xaaaab7d51a7f send_backtrace
common/daemon.c:38
0xaaaab7d51b2b crashdump
common/daemon.c:83
0xffff8c0b07cf ???
???:0
0xffff8bdf7608 __pthread_kill_implementation
./nptl/pthread_kill.c:44
0xffff8bdacb3b __GI_raise
../sysdeps/posix/raise.c:26
0xffff8bd97dff __GI_abort
./stdlib/abort.c:79
0xffff8bda5cbf __assert_fail_base
./assert/assert.c:96
0xffff8bda5d2f __assert_fail
./assert/assert.c:105
0xaaaab7d41fd7 find_txo_chain
plugins/bkpr/recorder.c:178
0xaaaab7d421fb account_onchain_closeheight
plugins/bkpr/recorder.c:291
0xaaaab7d37687 do_account_close_checks
plugins/bkpr/bookkeeper.c:884
0xaaaab7d38203 parse_and_log_chain_move
plugins/bkpr/bookkeeper.c:1261
0xaaaab7d3871f listchainmoves_done
plugins/bkpr/bookkeeper.c:171
0xaaaab7d4811f handle_rpc_reply
plugins/libplugin.c:1073
0xaaaab7d4827b rpc_conn_read_response
plugins/libplugin.c:1377
0xaaaab7d889a7 next_plan
ccan/ccan/io/io.c:60
0xaaaab7d88f7b do_plan
ccan/ccan/io/io.c:422
0xaaaab7d89053 io_ready
ccan/ccan/io/io.c:439
```

Fixes: https://github.com/ElementsProject/lightning/issues/8854
Changelog-Fixed: Plugins: `bkpr_listbalances` no longer crashes if we lost our db, then do emergencyrecover and close a channel.
Reported-by: https://github.com/enaples

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedcommon: move gossip_store_wire.csv into common/ from gossipd/by Rusty Russell · e8fd235d · Feb 16, 2026 · 26 filesMessage 73 · AdequateTriage 0Details
Commit message · Rusty Russell

common: move gossip_store_wire.csv into common/ from gossipd/

It's used by common/gossip_store.c, which is used by many things other than
gossipd. This file belongs in common.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: unusually broad change
AI review queuedpytest: test for crash when we have dying channels and compact the gossip_store.by Rusty Russell · b1503098 · Feb 16, 2026 · 1 fileMessage 83 · StrongTriage 0Details
Commit message · Rusty Russell

pytest: test for crash when we have dying channels and compact the gossip_store.

Before I fixed the handling of dying channels:

```
lightning_gossipd: gossip_store: can't read hdr offset 2362/2110: Success (version v25.12-279-gb38abe6-modded)
0x6537c19ecf3a send_backtrace
common/daemon.c:38
0x6537c19f1a1d status_failed
common/status.c:207
0x6537c19e557a gossip_store_get_with_hdr
gossipd/gossip_store.c:527
0x6537c19e5613 check_msg_type
gossipd/gossip_store.c:559
0x6537c19e5a36 gossip_store_set_flag
gossipd/gossip_store.c:577
0x6537c19e5c82 gossip_store_del
gossipd/gossip_store.c:629
0x6537c19e8ddd gossmap_manage_new_block
gossipd/gossmap_manage.c:1362
0x6537c19e390e new_blockheight
gossipd/gossipd.c:430
0x6537c19e3c37 recv_req
gossipd/gossipd.c:532
0x6537c19ed22a handle_read
common/daemon_conn.c:35
0x6537c19fbe71 next_plan
ccan/ccan/io/io.c:60
0x6537c19fc174 do_plan
ccan/ccan/io/io.c:422
0x6537c19fc231 io_ready
ccan/ccan/io/io.c:439
0x6537c19fd647 io_loop
ccan/ccan/io/poll.c:470
0x6537c19e463d main
gossipd/gossipd.c:609
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedpytest: reproduce crash when node disconnects between hooks:by Rusty Russell · eaf6fabf · Feb 11, 2026 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · Rusty Russell

pytest: reproduce crash when node disconnects between hooks:

```
lightningd-2 2026-02-09T00:41:35.196Z TRACE lightningd: Plugin peer_connected_logger_a.py returned from peer_connected hook call
lightningd-2 2026-02-09T00:41:35.196Z TRACE lightningd: Calling peer_connected hook of plugin peer_connected_logger_b.py
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: FATAL SIGNAL 11 (version v25.12-257-g2a5fbd1-modded)
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: common/daemon.c:46 (send_backtrace) 0x5b2abd7f29bd
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: common/daemon.c:83 (crashdump) 0x5b2abd7f2a0c
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 ((null)) 0x75950d84532f
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/peer_control.c:1333 (peer_connected_serialize) 0x5b2abd79c964
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:359 (plugin_hook_call_next) 0x5b2abd7ae14a
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:299 (plugin_hook_callback) 0x5b2abd7ae38f
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/plugin.c:701 (plugin_response_handle) 0x5b2abd7a7e28
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/plugin.c:790 (plugin_read_json) 0x5b2abd7ace9c
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:60 (next_plan) 0x5b2abd81dada
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:422 (do_plan) 0x5b2abd81def6
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:439 (io_ready) 0x5b2abd81dfb3
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ccan/ccan/io/poll.c:470 (io_loop) 0x5b2abd81f0db
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/io_loop_with_timers.c:22 (io_loop_with_timers) 0x5b2abd77c13b
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: lightningd/lightningd.c:1495 (main) 0x5b2abd781c6a
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ../sysdeps/nptl/libc_start_call_main.h:58 (__libc_start_call_main) 0x75950d82a1c9
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: ../csu/libc-start.c:360 (__libc_start_main_impl) 0x75950d82a28a
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x5b2abd752964
lightningd-2 2026-02-09T00:41:35.293Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0xffffffffffffffff
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedlightningd: don't assume peer existrs in peer_connected_serialize.by Rusty Russell · 09781bd3 · Feb 11, 2026 · 2 filesMessage 81 · StrongTriage 0Details
Commit message · Rusty Russell

lightningd: don't assume peer existrs in peer_connected_serialize.

It's always true for the first hook invocation, but if there is more
than one plugin, it could vanish between the two! In the default configuration, this can't happen.

This bug has been around since v23.02.

Note: we always tell all the plugins about the peer, even if it's
already gone.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: lightningd: possible crash when peers disconnected if there was more than one plugin servicing the `peer_connected` hook.
Reported-by: https://github.com/santyr
Fixes: https://github.com/ElementsProject/lightning/issues/8858

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queueddecode: don't treat every failure as a rune.by Rusty Russell · 6a937307 · Feb 3, 2026 · 6 filesMessage 68 · AdequateTriage 7Details
Commit message · Rusty Russell

decode: don't treat every failure as a rune.

If we can't decode something, and it decodes as a rune (and all bech32
strings do!), then we would usually just complain it was a malformed
rune. Be a big more useful, when the parameter looks like somthing else.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: JSON-RPC: `decode` is now more informative with malformed strings (won't claim everything is a malformed rune!).

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedlightningd: don't allow enableoffer on single-use offer.by 21M4TW · d76e4e71 · Feb 2, 2026 · 3 filesMessage 65 · AdequateTriage 0Details
Commit message · 21M4TW

lightningd: don't allow enableoffer on single-use offer.

Changelog-Fixed: enableoffer: Adding an error when trying to activate an used single use offer (don't crash!)

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedpytest: test for crash when enableoffer called on a used single-use offer.by Rusty Russell · e2d17cea · Feb 2, 2026 · 1 fileMessage 83 · StrongTriage 0Details
Commit message · Rusty Russell

pytest: test for crash when enableoffer called on a used single-use offer.

Assertion happens here:

newstatus = offer_status_in_db(s | OFFER_STATUS_ACTIVE_F);

Since OFFER_STATUS_SINGLE_F|OFFER_STATUS_USED_F|OFFER_STATUS_ACTIVE_F
is not a valid combination:

```
lightningd-3 2026-01-28T04:45:21.184Z **BROKEN** lightningd: offer_status_in_db: 7 is invalid
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: FATAL SIGNAL 6 (version v25.12-92-g7fff32d-modded)
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: common/daemon.c:83 (crashdump) 0x5a883759dbb7
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 ((null)) 0x79a2b0c4532f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:44 (__pthread_kill_implementation) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:78 (__pthread_kill_internal) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:89 (__GI___pthread_kill) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../sysdeps/posix/raise.c:26 (__GI_raise) 0x79a2b0c4527d
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./stdlib/abort.c:79 (__GI_abort) 0x79a2b0c288fe
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/log.c:1054 (fatal_vfmt) 0x5a8837509557
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/log.c:1064 (fatal) 0x5a88375095fe
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./wallet/wallet.h:1451 (offer_status_in_db) 0x5a88375491dc
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: wallet/wallet.c:6160 (offer_status_in_db) 0x5a8837555388
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: wallet/wallet.c:6162 (wallet_offer_enable) 0x5a8837555388
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/offer.c:288 (json_enableoffer) 0x5a8837540939
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:769 (command_exec) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:910 (rpc_command_hook_final) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:884 (rpc_command_hook_final) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:243 (hook_done) 0x5a8837535383
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:343 (plugin_hook_call_next) 0x5a8837535383
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:998 (plugin_hook_call_rpc_command) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:1123 (parse_request) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:1217 (read_json) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:60 (next_plan) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:422 (do_plan) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:439 (io_ready) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/poll.c:470 (io_loop) 0x5a88375eead5
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/io_loop_with_timers.c:22 (io_loop_with_timers) 0x5a8837501f8e
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/lightningd.c:1492 (main) 0x5a88374d3c27
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../sysdeps/nptl/libc_start_call_main.h:58 (__libc_start_call_main) 0x79a2b0c2a1c9
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../csu/libc-start.c:360 (__libc_start_main_impl) 0x79a2b0c2a28a
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x5a88374d5aa4
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0xffffffffffffffff
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedfuzz-tests: Make `fuzz-bolt12-offer-decode` roundripby Chandra Pratap · 557a744b · Jan 30, 2026 · 1 fileMessage 91 · StrongTriage 12Details
Commit message · Chandra Pratap

fuzz-tests: Make `fuzz-bolt12-offer-decode` roundrip

Changelog-None: Currently, the `BOLT #12` offer parsing test only
tests the offer decode function. Add a test for the encoding
function as well by making the test roundtrip.

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidenceparser or protocol pathsecond-pass: security-sensitive path
AI review queuedfuzz-tests: Add coverage increasing inputs to seed corporaby Chandra Pratap · 461ca686 · Jan 30, 2026 · 31 filesMessage 83 · StrongTriage 12Details
Commit message · Chandra Pratap

fuzz-tests: Add coverage increasing inputs to seed corpora

Improvements in the fuzz-testing scheme of
`fuzz-bolt12-offer-decode` led to the discovery of test inputs
that result in greater in code coverage.

Add these inputs to the test's seed corpus.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidenceparser or protocol pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI review queuedpytest: use old hsm secret whenever a canned database files is usedby Sangbida Chaudhuri · 81d1d4a3 · Jan 26, 2026 · 8 filesMessage 65 · AdequateTriage 12Details
Commit message · Sangbida Chaudhuri

pytest: use old hsm secret whenever a canned database files is used

Anything using a canned db depends on the node ids being generated from the old hsm seed.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedlogging: switch to a simple ringbuffer.by Rusty Russell · 4d8f923a · Jan 26, 2026 · 8 filesMessage 76 · AdequateTriage 12Details
Commit message · Rusty Russell

logging: switch to a simple ringbuffer.

We keep a history of logs internally, so we can drop them to disk on a
crash. This "black box recorder" was some of the first code I wrote
for CLN, but I can't remember the last time we use a crash log to
diagnose a problem.

We attempt to prune it to keep it under 10MB, but the complexity
and cost is rarely worth it: simplify it to use a ringbuffer.

Changelog-Changed: lightningd: logging is now more efficient internally (no more pruning, simple ringbuffer).

```
139993 DEBUG lightningd: fixup_scan: block 786151 with 1203 txs
===> 55388 DEBUG plugin-bcli: Log pruned 1001 entries (mem 10508118 -> 10298662)
33000 DEBUG gossipd: Unreasonable timestamp in 0102000a38ec41f9137a5a560dac6effbde059c12cb727344821cbdd4ef46964a4791a0f67cd997499a6062fc8b4284bf1b47a91541fd0e65129505f02e4d08542b16fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d61900000000000d9d56000ba40001690fe262010100900000000000000001000003e8000001f30000000000989680
23515 DEBUG hsmd: Client: Received message 14 from client
22269 DEBUG 024b9a1fa8e006f1e3937f65f66c408e6da8e1ca728ea43222a7381df1cc449605-hsmd: Got WIRE_HSMD_ECDH_REQ
14409 DEBUG gossipd: Enqueueing update for announce 0102002f7e4b4deb19947c67292e70cb22f7fac837fa9ee6269393f3c513d0431d52672e7387625856c19299cfd584e1a3f39e0f98df13c99090df9f4d5cca8446776fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d61900000000000e216b0008050001692e1c390101009000000000000003e800000000000013880000004526945a00
12534 DEBUG gossipd: Previously-rejected announce for 514127x248x1
10761 DEBUG 02e01367e1d7818a7e9a0e8a52badd5c32615e07568dbe0497b6a47f9bef89d6af-channeld-chan#70770: Got it!
10761 DEBUG 02e01367e1d7818a7e9a0e8a52badd5c32615e07568dbe0497b6a47f9bef89d6af-channeld-chan#70770: ... , awaiting 1120
10761 DEBUG 02e01367e1d7818a7e9a0e8a52badd5c32615e07568dbe0497b6a47f9bef89d6af-channeld-chan#70770: Sending master 1020
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI review queuedlightningd: remove `decodepay`.by Rusty Russell · 592f8586 · Jan 20, 2026 · 24 filesMessage 58 · ThinTriage 7Details
Commit message · Rusty Russell

lightningd: remove `decodepay`.

Changelog-Removed: JSON-RPC: `decodepay` (use `decode`), deprecated v24.11.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI review queuedmsggen: add string_map typeby daywalker90 · 8bc2e76f · Jan 19, 2026 · 7 filesMessage 35 · OpaqueTriage 0Details
Commit message · daywalker90

msggen: add string_map type

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedclnrest: add clnrest-register-path method for dynamic pathsby daywalker90 · d03cf820 · Jan 19, 2026 · 25 filesMessage 65 · AdequateTriage 0Details
Commit message · daywalker90

clnrest: add clnrest-register-path method for dynamic paths

Changelog-Added: clnrest: add clnrest-register-path rpc method to register dynamic paths

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedwallet: use correct derivation for elements when using mnemonic hsm_secret.by Rusty Russell · 29465f52 · Jan 14, 2026 · 1 fileMessage 73 · AdequateTriage 12Details
Commit message · Rusty Russell

wallet: use correct derivation for elements when using mnemonic hsm_secret.

Even though we don't do taproot addresses on elements yet, use the
same scheme for simplicity and for future when we *do* do taproot.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedwallet: change dev_listaddrs to also list bip86 addressesby Sangbida Chaudhuri · e19fd5d6 · Jan 14, 2026 · 1 fileMessage 83 · StrongTriage 12Details
Commit message · Sangbida Chaudhuri

wallet: change dev_listaddrs to also list bip86 addresses

listaddrs is dev only and used in tests so it's okay if we change the API here, the usage is by positional arguments in tests so we're okay. Also changing est_option_upfront_shutdown_script to handle both old hsmsecret and the newer mnemonic one.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedlightning-hsmtool: fix dumponchaindescriptors for mnemonic hsm_secrets.by Rusty Russell · d2123a94 · Jan 14, 2026 · 2 filesMessage 73 · AdequateTriage 12Details
Commit message · Rusty Russell

lightning-hsmtool: fix dumponchaindescriptors for mnemonic hsm_secrets.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: `lightning-hsmtool`: handle mnemonic hsm_secret files (nodes created >= v25.12).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedplugins/pay: don't crash if erring index is past route array end.by Rusty Russell · 9c6430c0 · Jan 14, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Rusty Russell

plugins/pay: don't crash if erring index is past route array end.

I assume this happens with multi-hop routehints?

```
1768169599027 2026-01-11T22:13:19.027Z pay: plugins/libplugin-pay.c:1199: payment_result_infer: Assertion `i <= len' failed.
1768169599027 2026-01-11T22:13:19.027Z pay: FATAL SIGNAL 6 (version 25.12)
1768169599036 2026-01-11T22:13:19.036Z 0x5562816bcaa4 send_backtrace
1768169599036 2026-01-11T22:13:19.036Z common/daemon.c:38
1768169599036 2026-01-11T22:13:19.036Z 0x5562816bcb40 crashdump
1768169599036 2026-01-11T22:13:19.036Z common/daemon.c:83
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca29d32f ???
1768169599036 2026-01-11T22:13:19.036Z ???:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca2f6b2c ???
1768169599036 2026-01-11T22:13:19.036Z pthread_kill+0x11c:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca29d27d ???
1768169599036 2026-01-11T22:13:19.036Z gsignal+0x1d:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca2808fe ???
1768169599036 2026-01-11T22:13:19.036Z abort+0xde:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca28081a ???
1768169599036 2026-01-11T22:13:19.036Z ???:0
1768169599036 2026-01-11T22:13:19.036Z 0x7f5fca293516 ???
1768169599036 2026-01-11T22:13:19.036Z __assert_fail+0x46:0
1768169599037 2026-01-11T22:13:19.037Z 0x5562816ae9f6 payment_result_infer
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin-pay.c:1199
1768169599037 2026-01-11T22:13:19.037Z 0x5562816b4acd payment_waitsendpay_finished
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin-pay.c:1653
1768169599037 2026-01-11T22:13:19.037Z 0x5562816aca60 handle_rpc_reply
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin.c:1062
1768169599037 2026-01-11T22:13:19.037Z 0x5562816acc86 rpc_conn_read_response
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin.c:1377
1768169599037 2026-01-11T22:13:19.037Z 0x5562816f0e87 next_plan
1768169599037 2026-01-11T22:13:19.037Z ccan/ccan/io/io.c:60
1768169599037 2026-01-11T22:13:19.037Z 0x5562816f1358 do_plan
1768169599037 2026-01-11T22:13:19.037Z ccan/ccan/io/io.c:422
1768169599037 2026-01-11T22:13:19.037Z 0x5562816f1415 io_ready
1768169599037 2026-01-11T22:13:19.037Z ccan/ccan/io/io.c:439
1768169599037 2026-01-11T22:13:19.037Z 0x5562816f2e23 io_loop
1768169599037 2026-01-11T22:13:19.037Z ccan/ccan/io/poll.c:470
1768169599037 2026-01-11T22:13:19.037Z 0x5562816ae114 plugin_main
1768169599037 2026-01-11T22:13:19.037Z plugins/libplugin.c:2429
1768169599037 2026-01-11T22:13:19.037Z 0x5562816a894c main
1768169599037 2026-01-11T22:13:19.037Z plugins/pay.c:1581
1768169599037 2026-01-11T22:13:19.037Z 0x7f5fca2821c9 ???
1768169599037 2026-01-11T22:13:19.037Z ???:0
1768169599037 2026-01-11T22:13:19.037Z 0x7f5fca28228a ???
1768169599037 2026-01-11T22:13:19.037Z __libc_start_main+0x8a:0
1768169599037 2026-01-11T22:13:19.037Z 0x5562816a4eb4 ???
1768169599037 2026-01-11T22:13:19.037Z _start+0x24:0
1768169599037 2026-01-11T22:13:19.037Z 0xffffffffffffffff ???
1768169599037 2026-01-11T22:13:19.037Z ???:0
1768169599136 2026-01-11T22:13:19.136Z 2026-01-11T22:13:19.136Z INFO plugin-pay: Killing plugin: exited during normal operation
69599136 2026-01-11T22:13:19.136Z 2026-01-11T22:13:19.136Z **BROKEN** plugin-pay: Plugin marked as important, shutting down lightningd!
```

Reported-by: michael1011
Fixes: https://github.com/ElementsProject/lightning/issues/8828
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: plugins: `pay` can crash on errors returned from deep inside routehints.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedaskrene: don't crash if refining flow which has capacity greaater than max it should have.by Rusty Russell · 35e703bf · Jan 14, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Rusty Russell

askrene: don't crash if refining flow which has capacity greaater than max it should have.

```
1767724611265 2026-01-06T18:36:51.265Z plugins/libplugin.c:1073
1767724611265 2026-01-06T18:36:51.265Z 0x55fc0c1428ac handle_rpc_reply
1767724611264 2026-01-06T18:36:51.264Z plugins/askrene/askrene.c:801
1767724611264 2026-01-06T18:36:51.264Z 0x55fc0c13174c listpeerchannels_done
1767724611264 2026-01-06T18:36:51.264Z plugins/askrene/askrene.c:669
1767724611264 2026-01-06T18:36:51.264Z 0x55fc0c130f55 do_getroutes
1767724611264 2026-01-06T18:36:51.264Z plugins/askrene/mcf.c:1636
1767724611264 2026-01-06T18:36:51.264Z 0x55fc0c138bd7 default_routes
1767724611264 2026-01-06T18:36:51.264Z plugins/askrene/mcf.c:1415
1767724611264 2026-01-06T18:36:51.264Z 0x55fc0c1382ec linear_routes
1767724611264 2026-01-06T18:36:51.264Z plugins/askrene/refine.c:510
1767724611264 2026-01-06T18:36:51.264Z 0x55fc0c13b110 refine_flows
1767724611264 2026-01-06T18:36:51.264Z plugins/askrene/refine.c:449
1767724611264 2026-01-06T18:36:51.264Z 0x55fc0c13ac9f increase_flows
1767724611264 2026-01-06T18:36:51.264Z abort+0xde:0
```

Fixes: #8823
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: plugins: `askrene` can crash on a corner case in increase_flows.

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedlightning-hsmtool: support extracting the mnemonic from hsm_secret.by Rusty Russell · f975bb37 · Jan 13, 2026 · 5 filesMessage 73 · AdequateTriage 12Details
Commit message · Rusty Russell

lightning-hsmtool: support extracting the mnemonic from hsm_secret.

We cannot use the codex32 or raw hex for recovery of 25.12 nodes,
since they will then use the incorrect derivation for all paths, and
be unable to spend (or even find!) their funds.

So implement `getsecret` to replace `getcodexsecret`.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Changed: `lightning-hsmtool`: `getsecret` replaces `getcodexsecret` for modern nodes (gives mnemonic).
Changelog-Deprecated: `lightning-hsmtool`: `getcodexsecret`. Use `getsecret`.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedaskrene: fix payment crashby Lagrang3 · 118e4746 · Jan 13, 2026 · 2 filesMessage 58 · ThinTriage 0Details
Commit message · Lagrang3

askrene: fix payment crash

Changelog-Fixed: askrene: fix a plugin crash triggered during single path payments when a channel fees doesn't fit u32.

Signed-off-by: Lagrang3 <lagrang3@protonmail.com>

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedpytest: work around pay flakiness.by Rusty Russell · 2333f024 · Jan 8, 2026 · 1 fileMessage 86 · StrongTriage 0Details
Commit message · Rusty Russell

pytest: work around pay flakiness.

pay sometimes ignores exclusions. WONTFIX.

```
with pytest.raises(RpcError, match=r'is not reachable directly and all routehints were unusable.'):
> l1.rpc.pay(inv, exclude=[scid12])

tests/test_pay.py:5279:
...
elif "error" in resp:
> raise RpcError(method, payload, resp['error'])
E pyln.client.lightning.RpcError: RPC call failed: method: pay, payload: {'bolt11': 'lnbcrt1230n1p54mma3sp5x7uerjgyg7ws6fnzdwxc7pgpj6j25uhpqp5uvx3fk8dkcqm37m2spp5k02racjc9knux958u5rgtva24jfvxtr5w3t53pfeavn3thmyny0qdq8v3jhxccxqyjw5qcqp9rzjqgkjyd3q5dv6gllh77kygly9c3kfy0d9xwyjyxsq2nq3c83u5vw4jqqqvuqqqqgqqqqqqqqpqqqqqzsqqc9qxpqysgqcmv875mmzcjl8mwxxndy9an6p870ffpdxdtypmgf5gzsydnt2d68n4kjph0rcprye6tfz0ex0c5clgj3zwm8jgd5vs0fdv7hf7dqr8cqdrg3gf', 'exclude': ['103x2x0/1']}, error: {'code': 210, 'message': 'Ran out of routes to try after 6 attempts: see `paystatus`', 'attempts': [{'status': 'failed', 'failreason': 'No path found', 'partid': 0, 'amount_msat': 123000}, {'status': 'pending', 'failreason': 'No path found', 'partid': 1, 'amount_msat': 123000, 'parent_partid': 0}, {'status': 'failed', 'failreason': 'No path found', 'partid': 2, 'amount_msat': 57006, 'parent_partid': 1}, {'status': 'failed', 'failreason': 'No path found', 'partid': 4, 'amount_msat': 57006, 'parent_partid': 2}, {'status': 'failed', 'failreason': 'No path found', 'partid': 3, 'amount_msat': 65994, 'parent_partid': 1}, {'status': 'failed', 'failreason': 'No path found', 'partid': 5, 'amount_msat': 65994, 'parent_partid': 3}]}
```

The logs show that it doesn't exclude the routehint early: in successful runs we get "After filtering routehints we're left with 0 usable hints". Perhaps this is something to do with the timing of our own notifications?

```
2026-01-07T05:51:10.7902502Z lightningd-1 2026-01-07T05:31:29.706Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Received getchaininfo blockcount=108, headercount=108
2026-01-07T05:51:10.7903334Z lightningd-1 2026-01-07T05:31:29.715Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: waitblockheight reports syncheight=108
2026-01-07T05:51:10.7904256Z lightningd-1 2026-01-07T05:31:29.734Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Updated a channel hint for 103x2x0/1: enabled true, estimated capacity 978718000msat
2026-01-07T05:51:10.7905355Z lightningd-1 2026-01-07T05:31:29.734Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Updated a channel hint for 7269357x11669990x33910/1: enabled false, estimated capacity UNKNOWN
2026-01-07T05:51:10.7906580Z lightningd-1 2026-01-07T05:31:29.735Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Updated a channel hint for 103x2x0/1: enabled false, estimated capacity UNKNOWN
2026-01-07T05:51:10.7907665Z lightningd-1 2026-01-07T05:31:29.735Z INFO plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Payment fee constraint 615msat is below exemption threshold, allowing a maximum fee of 5000msat
2026-01-07T05:51:10.7908845Z lightningd-1 2026-01-07T05:31:29.752Z DEBUG plugin-pay: Received a channel_hint {.scid = 103x2x0/1, .enabled = 1, .estimate = 978718000msat, .capacity = 1000000000msat }
2026-01-07T05:51:10.7909710Z lightningd-1 2026-01-07T05:31:29.754Z INFO plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Filtering out 1 routehints
2026-01-07T05:51:10.7910544Z lightningd-1 2026-01-07T05:31:29.779Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Checking hint {.scid=103x2x0/1, .enabled=1, .estimate=978718000msat}
2026-01-07T05:51:10.7911470Z lightningd-1 2026-01-07T05:31:29.780Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: After filtering routehints we're left with 1 usable hints
2026-01-07T05:51:10.7912385Z lightningd-1 2026-01-07T05:31:29.780Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Checking hint {.scid=103x2x0/1, .enabled=1, .estimate=978718000msat}
2026-01-07T05:51:10.7913471Z lightningd-1 2026-01-07T05:31:29.780Z DEBUG plugin-pay: cmd -c:pay#64/cln:pay#121 partid 0: Using routehint 022d223620a359a47ff7f7ac447c85c46c923da53389221a0054c11c1e3ca31d59 (103x1x0) cltv_delta=6
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

86/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedpytest: fix timing flake in test_invoice_expiry.by Rusty Russell · 56a32c9f · Jan 8, 2026 · 1 fileMessage 78 · AdequateTriage 0Details
Commit message · Rusty Russell

pytest: fix timing flake in test_invoice_expiry.

Under Postgres, this actually takes more than 2 seconds, so w2
really has timed out already:

```
time.sleep(2) # total 2
assert not w1.done()
> assert not w2.done()
E assert not True
E + where True = done()
E + where done = <Future at 0x7fe14e54fee0 state=finished raised RpcError>.done

tests/test_invoices.py:420: AssertionError
```

So space the timeouts out more, and sleep one second too short; the
.result() (which sleeps) will catch up if we were extremely slow.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedlightningd: fix segfault when parse_filter failsby dovgopoly · a1a4affe · Dec 22, 2025 · 1 fileMessage 68 · AdequateTriage 0Details
Commit message · dovgopoly

lightningd: fix segfault when parse_filter fails

We need to initialize ->json_cmd *before* complaining about malformed
filters.

```
lightningd: FATAL SIGNAL 11 (version v25.12-21-g3851187-modded)
0x1042d2023 ???
send_backtrace+0x4f:0
0x1042d20cb ???
crashdump+0x43:0
0x19fe3b743 ???
???:0
0x104180173 command_log
lightningd/jsonrpc.c:1406
0x10420d8f7 command_fail_badparam
common/json_command.c:25
0x104181a07 parse_request
lightningd/jsonrpc.c:1075
0x104181a07 read_json
lightningd/jsonrpc.c:1216
0x10424c65b next_plan
ccan/ccan/io/io.c:60
0x10424c65b do_plan
ccan/ccan/io/io.c:422
0x10424c587 io_ready
ccan/ccan/io/io.c:439
0x10424dd9b io_loop
ccan/ccan/io/poll.c:470
0x10417ede7 io_loop_with_timers
lightningd/io_loop_with_timers.c:22
0x104183a33 main
lightningd/lightningd.c:1492
```

Co-authored-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: JSON-RPC: malformed filters no longer crash lightningd.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology