lightningd crashes calling `bkpr-listbalances` after performing an emergencyrecover

[enaples]

core-lightning v25.12

Step to reproduce

1. Compile core-lightning v25.12
2. Add to /tests/test_misc.py:test_emergencyrecover on line 3151 a call to RPC bkpr-listbalances (an example follows):

l1.stop()
time.sleep(5)
l1.start()
# Call bookeeper before withdrawing funds
l1.rpc.bkpr_listbalances()

lightning/tests/test_misc.py

Lines 3149 to 3156 in d5f66ce

	wait_for(lambda: l1.rpc.listfunds()["channels"][0]["state"] == "ONCHAIN")
	wait_for(lambda: l2.rpc.listfunds()["channels"][0]["state"] == "ONCHAIN")
	withdraw = l1.rpc.withdraw(l2.rpc.newaddr('bech32')['bech32'], 'all')
	# Should have two inputs
	assert len(bitcoind.rpc.decoderawtransaction(withdraw['tx'])['vin']) == 2
	bitcoind.generate_block(1, wait_for_mempool=withdraw['txid'])

Note that lightningd craches after calling bkpr-listbalances on both before and after withdrawing funds.

3. Call EXPERIMENTAL_DUAL_FUND=0 uv python -m pytest -vvvv tests/test_misc.py::test_emergencyrecover

For your convenience, I attach logs:

bookkeeper: plugins/bkpr/recorder.c:178: find_txo_chain: Assertion `acct->open_event_db_id' failed.

bookkeeper: FATAL SIGNAL 6 (version v25.12)

0xaaaab7d51a7f send_backtrace

	common/daemon.c:38

0xaaaab7d51b2b crashdump

	common/daemon.c:83

0xffff8c0b07cf ???

	???:0

0xffff8bdf7608 __pthread_kill_implementation

	./nptl/pthread_kill.c:44

0xffff8bdacb3b __GI_raise

	../sysdeps/posix/raise.c:26

0xffff8bd97dff __GI_abort

	./stdlib/abort.c:79

0xffff8bda5cbf __assert_fail_base

	./assert/assert.c:96

0xffff8bda5d2f __assert_fail

	./assert/assert.c:105

0xaaaab7d41fd7 find_txo_chain

	plugins/bkpr/recorder.c:178

0xaaaab7d421fb account_onchain_closeheight

	plugins/bkpr/recorder.c:291

0xaaaab7d37687 do_account_close_checks

	plugins/bkpr/bookkeeper.c:884

0xaaaab7d38203 parse_and_log_chain_move

	plugins/bkpr/bookkeeper.c:1261

0xaaaab7d3871f listchainmoves_done

	plugins/bkpr/bookkeeper.c:171

0xaaaab7d4811f handle_rpc_reply

	plugins/libplugin.c:1073

0xaaaab7d4827b rpc_conn_read_response

	plugins/libplugin.c:1377

0xaaaab7d889a7 next_plan

	ccan/ccan/io/io.c:60

0xaaaab7d88f7b do_plan

	ccan/ccan/io/io.c:422

0xaaaab7d89053 io_ready

	ccan/ccan/io/io.c:439

0xaaaab7d8b01f io_loop

	ccan/ccan/io/poll.c:470

0xaaaab7d4987b plugin_main

	plugins/libplugin.c:2429

0xaaaab7d3a8d7 main

	plugins/bkpr/bookkeeper.c:1572

0xffff8bd984c3 __libc_start_call_main

	../sysdeps/nptl/libc_start_call_main.h:58

0xffff8bd98597 __libc_start_main_impl

	../csu/libc-start.c:360

0xaaaab7d35bef ???

	_start+0x2f:0

0xffffffffffffffff ???

	???:0
2026-01-20T14:02:16.509Z INFO    plugin-bookkeeper: Killing plugin: exited during normal operation

2026-01-20T14:02:16.509Z **BROKEN** plugin-bookkeeper: Plugin marked as important, shutting down lightningd!

2026-01-20T14:02:16.509Z DEBUG   lightningd: io_break: lightningd_exit

2026-01-20T14:02:16.509Z DEBUG   lightningd: io_loop_with_timers: main

2026-01-20T14:02:16.509Z DEBUG   connectd: REPLY WIRE_CONNECTD_START_SHUTDOWN_REPLY with 0 fds

2026-01-20T14:02:16.509Z DEBUG   lightningd: io_break: connectd_start_shutdown_reply

2026-01-20T14:02:16.509Z DEBUG   0349c3d6f856372409e3b55e28b914156deb5ec5c7c8f86d46783932438ba2b740-onchaind-chan#1: Status closed, but not exited. Killing

2026-01-20T14:02:16.510Z DEBUG   plugin-autoclean: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-bcli: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-funder: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-recover: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-chanbackup: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-recklessrpc: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-txprepare: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-keysend: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-offers: Killing plugin: exited during normal operation

2026-01-20T14:02:16.510Z DEBUG   plugin-commando: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-cln-askrene: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-cln-xpay: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-topology: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-spenderp: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-cln-renepay: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-exposesecret: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-pay: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-clnrest: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   plugin-sql: Killing plugin: exited during normal operation

2026-01-20T14:02:16.511Z DEBUG   lightningd: io_break: destroy_plugin

2026-01-20T14:02:16.511Z DEBUG   lightningd: Command returned result after jcon close

2026-01-20T14:02:16.511Z DEBUG   connectd: Shutting down

2026-01-20T14:02:16.511Z DEBUG   gossipd: Shutting down

2026-01-20T14:02:16.511Z DEBUG   hsmd: Shutting down

[MNGlobalInvest]

⚡ BoltBrain24 – Support Fix ⚡

This is a bookkeeper (bkpr) invariant bug triggered during emergency recovery.

Root cause (working theory):
bkpr_listbalances walks account history assuming acct->open_event_db_id exists. During test_emergencyrecover, the channel transitions to ONCHAIN without a corresponding open event recorded in bkpr yet. Calling bkpr in this window violates the assumption and hits the assert in find_txo_chain().

This is not user error—it’s an internal state mismatch between:
• channel recovery / onchain accounting
• bkpr’s expectation of a fully linked event chain

Why it crashes lightningd:
Bookkeeper is marked as an important plugin, so its SIGABRT forces a full shutdown.

Immediate workarounds:
• Do not call bkpr-listbalances during emergency recovery
• Delay bkpr RPCs until after withdraw + block confirmation
• For testing: disable bkpr (--disable-plugin=bookkeeper)

Proper fix (upstream):
find_txo_chain() must gracefully handle accounts without open_event_db_id during recovery paths. Replace the assert with a conditional fallback (skip chain walk or mark as incomplete). Similar guards already exist elsewhere in bkpr.

Action:
File upstream issue referencing test_emergencyrecover + this reproduction. This is a logic bug, not a config issue, and should be fixed with a small defensive patch.

You found a real edge case. That’s valuable signal.