Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …
No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…
Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…
Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
This commit adds a regression test for Core Lightning's database downgrade path. It ensures that when a user downgrades from an upcoming v26.09 release to an older version (v26.06), the new 'impressions' data added by the askrene routing s…
Database downgrade path for new askrene schema (impressions table)Regression test only; no production code changeNo input validation, cryptography, network, or authorization changes
This is a bug fix in a command-line helper tool used by Core Lightning node operators. The `getsecret` command was accidentally refusing to show the wallet recovery words (mnemonic) when the wallet was protected by a passphrase. After the …
Functional bug in secret-recovery pathError path blocked legitimate mnemonic recoveryNo input validation, memory-safety, or cryptographic change
This commit only adds and updates a regression test in the project's test suite. It checks that the hsmtool utility correctly handles both empty and non-empty passphrases when working with BIP39 mnemonic-based wallet secrets. There is no c…
Regression test added for passphrase handling in hsmtoolNo production code changes observedTest-only change to tests/test_wallet.py
This commit updates the bundled libwally library to version 1.5.6. The practical effect is that calling the JSON-RPC `signpsbt` command on a PSBT that is already signed now succeeds as a harmless no-op, instead of returning an error on Bit…
Dependency update to incorporate upstream bug fixBehavior change from error to no-op on re-signing signed PSBTsTaproot keypath handling change in upstream cryptographic library
This change fixes a crash bug in Core Lightning's wallet datastore helpers. Previously, four datastore functions required the caller to already be inside a database transaction, and would fatally crash if called outside one. The patch make…
Fixes fatal assertion/crash in database statement preparationResolves transaction-context mismatch in wallet datastore helperswatchman plugin persistence path was affected
This commit adds the missing bookkeeping that runs when Core Lightning's own on-chain wallet spends a UTXO. It makes the node mark the UTXO as spent, record the spending transaction, and log a withdrawal coin movement. It also handles bloc…
Missing spend tracking for wallet-owned UTXOs could lead to stale UTXO state or incorrect coin-movement accountingReorg handling clears spendheight, preventing a spent output from becoming permanently unspendable in the wallet's viewDefensive log_broken calls on unexpected missing UTXO or malformed watch suffix
This commit fixes how Core Lightning's wallet records handle blockchain reorganizations (reorgs) for two newer database tables, our_outputs and our_txs. Previously, these tables were not properly updated when blocks were removed or rolled …
Incorrect state persistence across blockchain reorgsMissing reorg handling for wallet tables without foreign-key cascadePotential stale spend/confirmation metadata in our_outputs/our_txs
This commit switches Core Lightning's wallet code to read UTXO (unspent transaction output) data from a new database table called our_outputs instead of the older outputs table. It also deletes several old helper functions and updates test…
Large internal data-model migration with reader/writer split between old and new tablesDual-write mirroring to legacy outputs table for downgrade compatibilityDeletion of legacy UTXO reading helpers
This commit is a simple variable rename inside a Bitcoin/Lightning wallet file. The old name 'b32script' suggested all change addresses were bech32 format, but the project now uses a newer address type (p2tr) by default. The developer rena…
This commit only updates internal test code to query a new database table (our_outputs) instead of an old one (outputs). It does not change the actual wallet or node software that users run, so it cannot directly affect security.
This change makes Core Lightning register long-lasting 'watches' for all wallet deposit addresses when the node starts up, so the new bwatch plugin can spot incoming payments from the first block it scans. It also removes a now-redundant p…
Change is part of an experimental chain-watcher (bwatch) featureAdds startup registration of scriptPubKey watches for all derived wallet keysRemoves a redundant unconfirmed-change watch, relying on the new blanket coverage
This is a database refactoring commit in Core Lightning. It makes the wallet write UTXO (unspent transaction output) state to a new table called our_outputs in addition to the legacy outputs table, while reads still use the old table. The …
Database schema migration with dual-write mirror patternNo security claim in commit title or messageNo CVE, advisory, or researcher attribution in commit metadata
This commit adds new wallet bookkeeping code for Core Lightning. It records Bitcoin deposits found by a new chain-watcher ('bwatch') into database tables and handles blockchain reorganizations by demoting transactions back to unconfirmed r…
New database write paths for wallet UTXOs and transactionsReorg revert logic demotes rather than deletes rows to preserve metadataOwner-string constructors added to avoid silent unwatch failures from format mismatches
This commit changes how Core Lightning stores and reads wallet-related transactions. It moves most reads to a new table called our_txs while still keeping the old transactions table updated for compatibility. The main concern is that the c…
Dual-write consistency risk between our_txs and legacy transactions tableNew anti-downgrade logic for confirmed transactions in our_txsRemoval of legacy NULL handling for unconfirmed transactions
This commit only adds two new empty database tables (our_outputs and our_txs) to Core Lightning's wallet. It is a preparatory schema change for a future feature; no code reads from or writes to these tables yet, and no existing behavior is…
Schema-only migration with no runtime codeNew tables are not yet populated or queried by any code pathDesign note: sentinel 0 replaces NULL for blockheight/txindex/reserved_til, which could reduce NULL-handling bugs in future code
This commit adds a database migration that copies existing wallet data into new tables used by an upcoming 'bwatch' wallet component. It is a data backfill, not a code fix for an active vulnerability. The main risk is that if the migration…
Database migration touching wallet UTXO and transaction tablesPotential for data inconsistency if mapping logic is wrongON CONFLICT DO NOTHING prevents overwrite but could hide duplicate-key anomalies
This change is a behind-the-scenes bookkeeping patch for Core Lightning's wallet database. The project is moving to a new table (`our_outputs`) for tracking spendable coins, but older versions of the software still read from the old table …
Race-condition guard for foreign-key-backed confirmation_height and spend_height when bwatch is ahead of chaintopologyTemporary mirroring to keep legacy outputs table consistent with new our_outputs tableON CONFLICT DO NOTHING used for legacy insert to avoid duplicate-key failures
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
AI review queuedhsm_encryption: delete hsm_encryptionby Sangbida Chaudhuri · b4984fd9 · Oct 26, 2025 · 65 filesMessage 50 · ThinTriage 0Details
Commit message · Sangbida Chaudhuri
hsm_encryption: delete hsm_encryption
Changelog-Removed: Remove hsm_encryption files as they have now been replaced by hsm_secret
50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
second-pass: unusually broad change
AI review queuedwalletrpc: add addresstype "bip86"; make newaddr+listaddresses use itby Sangbida Chaudhuri · 618d4f33 · Oct 26, 2025 · 6 filesMessage 73 · AdequateTriage 12Details
Commit message · Sangbida Chaudhuri
walletrpc: add addresstype "bip86"; make newaddr+listaddresses use it
We should now be able to get BIP86 Taproot addresses through lightning-cli! For now we're just adding taproot addresses.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedccan: update to get improved grab_file API, and adapt code.by Rusty Russell · 42f93613 · Oct 26, 2025 · 39 filesMessage 65 · AdequateTriage 7Details
Commit message · Rusty Russell
ccan: update to get improved grab_file API, and adapt code.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
parser or protocol pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI review queuedfuzz: translate fuzz-hsm_encryption to fuzz-hsm_secret.by Rusty Russell · 631a8ccd · Oct 26, 2025 · 62 filesMessage 75 · AdequateTriage 5Details
Commit message · Rusty Russell
fuzz: translate fuzz-hsm_encryption to fuzz-hsm_secret.
Copy corpora, since it's the same code paths.
Thanks Claude!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesecond-pass: unusually broad change
AI review queuedutxo: remove UTXO_P2TR_BIP86 enum and consolidate to UTXO_P2TRby Sangbida Chaudhuri · 185ab3d0 · Oct 26, 2025 · 4 filesMessage 73 · AdequateTriage 12Details
Commit message · Sangbida Chaudhuri
utxo: remove UTXO_P2TR_BIP86 enum and consolidate to UTXO_P2TR
This simplifies the UTXO type system by removing the separate BIP86 enum value. P2TR addresses will now use unified derivation logic based on the wallet's HSM secret type rather than having separate enum values."
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedcommon: add new_htable() macro to allocate, initialize and setup memleak coverage for any typed hash table.by Rusty Russell · 75616f6b · Oct 24, 2025 · 23 filesMessage 83 · StrongTriage 12Details
Commit message · Rusty Russell
common: add new_htable() macro to allocate, initialize and setup memleak coverage for any typed hash table.
You can now simply add per-tal-object helpers for memleak, but our older pattern required calling memleak functions explicitly during memleak handling. Hash tables in particular need to be dynamically allocated (we override the allocators using htable_set_allocator and assume this), so it makes sense to have a helper macro that does all three.
This eliminates a huge amount of code.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI review queuedlightningd: fix crash in channel_control.by Rusty Russell · 5a530e6c · Oct 24, 2025 · 1 fileMessage 78 · AdequateTriage 0Details
Commit message · Rusty Russell
lightningd: fix crash in channel_control.
I got a NULL deref on `infcopy->remote_funding = *inflight->funding->splice_remote_funding` at once point in testing, so this should prevent that from happening, yet still allow us to catch it in CI if it happens again.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
second-pass: broader security terminology
AI review queuedlightningd: cancel watching original funding when we switch to the new one via splice.by Rusty Russell · 89eaf834 · Oct 24, 2025 · 6 filesMessage 73 · AdequateTriage 12Details
Commit message · Rusty Russell
lightningd: cancel watching original funding when we switch to the new one via splice.
This happens if the channel is *not* announcable yet. Then we hit the assertion in funding_depth_cb that the txid is the same as the current funding.txid.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Changelog-EXPERIMENTAL: fixed crash when we splice a channel which hasn't been announced yet.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI review queuedbookkeeper: only read listchannelmoves 1000 entries at a time.by Rusty Russell · e522aedc · Oct 20, 2025 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Rusty Russell
bookkeeper: only read listchannelmoves 1000 entries at a time.
If we read all of them, we might get 1.6M at once (after initial migration). Then we submit a few hundred thousand simultaneous requests to lightningd, and it gets upset, queueing them all on the xpay command hook and running out of memory.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Changelog-Fixed: plugins: bookkeeper first invocation after migration from prior to 25.09 with very large databases will not crash.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI review queuedconnectd: close connection properly after dev-disconnect `+`.by Rusty Russell · fc6bee89 · Oct 13, 2025 · 1 fileMessage 85 · StrongTriage 0Details
Commit message · Rusty Russell
connectd: close connection properly after dev-disconnect `+`.
We need to drain subds too, otherwise if timing is correct we never close.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
second-pass: broader security terminology
AI review queuedccan: update to latest.by Rusty Russell · af340a68 · Oct 13, 2025 · 24 filesMessage 86 · StrongTriage 0Details
Commit message · Rusty Russell
ccan: update to latest.
We fix the configure test which was bogus, and breaks on 32-bit gcc with optimization:
``` checking for unaligned access to int... ccan/tools/configurator/configurator: Test for HAVE_UNALIGNED_ACCESS did not compile: configuratortest.c: In function 'main': configuratortest.c:8:22: error: array subscript 'int[0]' is partly outside array bounds of 'char[4]' [-Werror=array-bounds] 8 | return *x == *y; | ^~ configuratortest.c:5:11: note: at offset 1 into object 'pad' of size 4 5 | char pad[sizeof(int *) * 1]; | ^~~ cc1: all warnings being treated as errors ```
And also removes sprintf() calls, which apparently MacOS no longer likes:
``` ccan/ccan/closefrom/closefrom.c:83:2: error: 'sprintf' is deprecated: This function is provided for compatibility reasons only. Due to security concerns inherent in the design of sprintf(3), it is highly recommended that you use snprintf(3) instead. [-Werror,-Wdeprecated-declarations] 83 | sprintf(dnam, "/proc/%ld/fd", (long) getpid()); | ^ /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/_stdio.h:278:1: note: 'sprintf' has been explicitly marked deprecated here 278 | deprecated_msg("This function is provided for compatibility reasons only. Due to security concerns inherent in the design of sprintf(3), it is highly recommended that you use snprintf(3) instead.") | ^ /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/cdefs.h:218:48: note: expanded from macro 'deprecated_msg' 218 | #define deprecated_msg(_msg) attribute((deprecated(_msg))) | ^ ccan/ccan/closefrom/closefrom.c:162:2: error: 'sprintf' is deprecated: This function is provided for compatibility reasons only. Due to security concerns inherent in the design of sprintf(3), it is highly recommended that you use snprintf(3) instead. [-Werror,-Wdeprecated-declarations] 162 | sprintf(dnam, "/proc/%ld/fd", (long) getpid()); | ^ /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/_stdio.h:278:1: note: 'sprintf' has been explicitly marked deprecated here 278 | deprecated_msg("This function is provided for compatibility reasons only. Due to security concerns inherent in the design of sprintf(3), it is highly recommended that you use snprintf(3) instead.") | ^ /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/cdefs.h:218:48: note: expanded from macro 'deprecated_msg' 218 | #define deprecated_msg(_msg) attribute((deprecated(_msg))) | ^ 2 errors generated. make: *** [ccan-closefrom.o] Error 1 ```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Reported-by: Sangbida Fixes: https://github.com/ElementsProject/lightning/issues/8581 Reported-by: https://github.com/Raimo33 Fixes: https://github.com/ElementsProject/lightning/issues/8501 Changelog-Fixed: build: we now build on MacOS without errors on the latest Command Line Tools (macOS 15 SDK). Changelog-Fixes: build: fix build with -O2 on 32 bit arm (armhf)
86/100 · StrongMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
second-pass: unusually broad change
AI review queuedwallet: fix migration speed for postgres.by Rusty Russell · 9f2e6de6 · Oct 13, 2025 · 1 fileMessage 78 · AdequateTriage 12Details
Commit message · Rusty Russell
wallet: fix migration speed for postgres.
Testing a large db shows Postgres slowing down exponentially as it inserts the channel_events. Rather than updating the index in the db every time, do it at the end, for spectacular speedup:
``` lightningd-1 2025-10-08T05:39:44.333Z INFO lightningd: Creating database lightningd-1 2025-10-08T05:39:47.581Z DEBUG lightningd: Transferring 6166 chain_events lightningd-1 2025-10-08T05:39:48.455Z DEBUG lightningd: Transferring 1660043 channel_events lightningd-1 2025-10-08T05:39:54.390Z INFO lightningd: Inserted 103100/1660043 channel_events lightningd-1 2025-10-08T05:40:04.390Z INFO lightningd: Inserted 283280/1660043 channel_events lightningd-1 2025-10-08T05:40:14.390Z INFO lightningd: Inserted 464065/1660043 channel_events lightningd-1 2025-10-08T05:40:24.390Z INFO lightningd: Inserted 629559/1660043 channel_events lightningd-1 2025-10-08T05:40:34.390Z INFO lightningd: Inserted 800659/1660043 channel_events lightningd-1 2025-10-08T05:40:44.390Z INFO lightningd: Inserted 975433/1660043 channel_events lightningd-1 2025-10-08T05:40:54.390Z INFO lightningd: Inserted 1134719/1660043 channel_events lightningd-1 2025-10-08T05:41:04.390Z INFO lightningd: Inserted 1290549/1660043 channel_events lightningd-1 2025-10-08T05:41:14.390Z INFO lightningd: Inserted 1443304/1660043 channel_events lightningd-1 2025-10-08T05:41:24.390Z INFO lightningd: Inserted 1590013/1660043 channel_events lightningd-1 2025-10-08T05:41:29.148Z INFO lightningd: bookkeeper migration complete: migrated 6166 chainmoves, 1660043 channelmoves, 132481 descriptions ```
Now we complete the entire migration in 1 minute 45 seconds.
Thanks to @michael1101 for reporting this.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Changelog-Fixed: db: migration from v25.09 on a reasonable size account database could take almost infinite time.
78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedwallet: print progress reports for large account migration.by Rusty Russell · b260ec2f · Oct 13, 2025 · 1 fileMessage 73 · AdequateTriage 12Details
Commit message · Rusty Russell
wallet: print progress reports for large account migration.
Show the work we're doing (at debug level) and every 10 seconds print progress (at INFO level):x
It's the inserting channel_events which takes a long time, slowing down exponentially:
``` lightningd-1 2025-10-08T05:13:18.034Z INFO lightningd: Inserted 26690/1660043 channel_events lightningd-1 2025-10-08T05:13:28.034Z INFO lightningd: Inserted 47086/1660043 channel_events lightningd-1 2025-10-08T05:13:38.035Z INFO lightningd: Inserted 61699/1660043 channel_events lightningd-1 2025-10-08T05:13:48.035Z INFO lightningd: Inserted 73743/1660043 channel_events lightningd-1 2025-10-08T05:13:58.035Z INFO lightningd: Inserted 83244/1660043 channel_events ... lightningd-1 2025-10-08T05:35:18.286Z INFO lightningd: Inserted 466720/1660043 channel_events lightningd-1 2025-10-08T05:35:29.074Z INFO lightningd: Inserted 468437/1660043 channel_events lightningd-1 2025-10-08T05:35:39.079Z INFO lightningd: Inserted 470130/1660043 channel_events lightningd-1 2025-10-08T05:35:49.081Z INFO lightningd: Inserted 471871/1660043 channel_events ```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedlightningd: handle unparsable onion from first hop when using injectonionmessage.by Rusty Russell · 01e83b76 · Oct 13, 2025 · 2 filesMessage 93 · StrongTriage 0Details
Commit message · Rusty Russell
lightningd: handle unparsable onion from first hop when using injectonionmessage.
In this case we have a failmsg, so we should use that. Otherwise we can have both failmsg and failonion NULL in the call to injectonion_fail, which is not valid.
Reported-by: @michael1011 Changelog-Fixed: lightningd: potential crash when we receive a malformed onion complain from our first peer when using sendonion / injectpaymentonion. Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
Why it was queued
second-pass: broader security terminology
AI review queuedwallet: find and remove any duplicates from the bug we just fixed.by Rusty Russell · fb973fea · Oct 2, 2025 · 3 filesMessage 65 · AdequateTriage 12Details
Commit message · Rusty Russell
wallet: find and remove any duplicates from the bug we just fixed.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedwallet: unit test for duplicate detection in wallet_save_chain_mvt.by Rusty Russell · 7631ce63 · Oct 2, 2025 · 2 filesMessage 75 · AdequateTriage 12Details
Commit message · Rusty Russell
wallet: unit test for duplicate detection in wallet_save_chain_mvt.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedwallet: don't insert duplicate chain_moves entries after accounts.db migration.by Rusty Russell · bd1ba164 · Oct 2, 2025 · 2 filesMessage 73 · AdequateTriage 12Details
Commit message · Rusty Russell
wallet: don't insert duplicate chain_moves entries after accounts.db migration.
When we migrate from accounts.db, we use the `account_nonchannel_id` field. But we can replay the block chain and the channel involved is still open, we will use the `account_channel_id` field, and our duplicate detection fails.
As a result, we can end up with duplicate entries in the database, which make accounting incorrect.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Changelog-Fixed: JSON-RPC: `listchainmoves` could contain bogus duplicate entries after 25.09 bookkeeper migration.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedwallet: unit test the migration dedup code.by Rusty Russell · 5b06e653 · Oct 2, 2025 · 2 filesMessage 70 · AdequateTriage 12Details
Commit message · Rusty Russell
wallet: unit test the migration dedup code.
This is based on a real database, which values changed.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedpytest: test that we don't delete htlcs as soon as channel closed, wait for restart.by Rusty Russell · aa8d858c · Oct 2, 2025 · 1 fileMessage 75 · AdequateTriage 12Details
Commit message · Rusty Russell
pytest: test that we don't delete htlcs as soon as channel closed, wait for restart.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedwallet: don't delete old htlcs when we forget a channel, do it on startup.by Rusty Russell · cb2849d0 · Oct 2, 2025 · 5 filesMessage 100 · StrongTriage 12Details
Commit message · Rusty Russell
wallet: don't delete old htlcs when we forget a channel, do it on startup.
For old channels, this can take a while, and it stops everything. But we are only doing this to save space; it's not a *functional* necessity.
A quick and dirty test with 50,000 htlcs shows the htlc deletion took 450msec. I tried adding an index, and changing it to set hstate to HTLC_STATE_INVALID instead of deleting entries, but it still took about 350ms.
Whereas the "COUNT(*)" only took 1.7msec, so it's worth keeping.
Reported-by: @michael1011 Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Changelog-Changed: lightningd: we defer deletion of old htlcs on channel close, to avoid pausing for a long time (we clean them on startup) Fixes: https://github.com/ElementsProject/lightning/issues/7962
100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedwallet: don't show htlcs from closed channels in listhtlcs.by Rusty Russell · bee54f0e · Oct 2, 2025 · 1 fileMessage 85 · StrongTriage 12Details
Commit message · Rusty Russell
wallet: don't show htlcs from closed channels in listhtlcs.
This doesn't happen yet, since we delete all HTLCs when we close a channel. But we're about to change that, so update the wallet_htlcs_first() code to avoid them.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queueddoc: pretty!by Rusty Russell · 350af1a3 · Oct 1, 2025 · 1 fileMessage 33 · OpaqueTriage 0Details
Commit message · Rusty Russell
doc: pretty!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
33/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body! Too few words to establish purpose
AI review queuedBOLT12: Remove `start_any_period` from recurrence_base.by Rusty Russell · e7ea57e1 · Oct 1, 2025 · 17 filesMessage 73 · AdequateTriage 7Details
Commit message · Rusty Russell
BOLT12: Remove `start_any_period` from recurrence_base.
Offer_absolute_expiry should be used if you want to require starting at the start.
Changelog-EXPERIMENTAL: Protocol: BOLT 12 recurrence `start_any_period` removed, use expiry if you need to restrict when they can start using the offer.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedBOLT12: Update recurrence to latest spec draft.by Rusty Russell · 54444e43 · Oct 1, 2025 · 20 filesMessage 68 · AdequateTriage 7Details
Commit message · Rusty Russell
BOLT12: Update recurrence to latest spec draft.
Changes: * Fields renumbered to their draft values + billion. * offer_recurrence now comes in compulsory or optional (backwards compat) flavors. * `proportional_amount` is now inside `offer_recurrence_base` not `offer_recurrence_paywindow`. * New field `invreq_recurrence_cancel`.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Changelog-EXPERIMENTAL: Draft specification for recurring offers changed: old recurring offers will no longer work.
68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
parser or protocol pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI review queuedgossipd: remove gossmap_fetch_tail.by Rusty Russell · f882b69d · Oct 1, 2025 · 3 filesMessage 58 · ThinTriage 0Details
Commit message · Rusty Russell
gossipd: remove gossmap_fetch_tail.
It only gets called for diagnostics when something goes wrong (and we were going to exit anyway), and it's only useful with mmap (which we now disable on error) but it shouldn't crash:
