fix: stop auto-accepting stale monitors

[ben-kaufman]

Description

This PR restores fail-closed Lightning startup when stored channel monitors are stale relative to the channel manager.

• Removes the automatic DangerousValue retry that enabled stale-monitor recovery.

The retry was added in 2.1.2 to recover wallets affected by the 2.1.0 RN monitor overwrite. Current ldk-node versions protect newer stored monitors from stale migration data, and those affected wallets are assumed recovered. A future storage mismatch now fails node construction before startup or chain processing. Stale-monitor acceptance stays at the ldk-node default (false).

Related: https://github.com/synonymdev/audit/issues/55
Companion: synonymdev/bitkit-ios#664

Preview

N/A, no UI changes.

QA Notes

Manual Tests

• 1.regression: Launch an existing wallet with channels: Lightning node starts normally and balances/channels appear.
• 2.regression: Force-quit and relaunch: node starts without a stale-monitor recovery log.
• 3. Start with a monitor older than the channel manager: startup fails with DangerousValue and no node starts.

Automated Checks

• CI: standard compile, unit test, detekt, and E2E checks run by the PR bot.

[greptile-apps]

Greptile Summary

This PR removes the Lightning node startup fallback that disabled LDK’s stale-channel-monitor safety check after a DangerousValue build failure.

• Builds the node once using the configured VSS store and lets monitor/manager mismatches fail normally.
• Preserves conversion of LDK BuildException failures into the existing LdkError flow.
• Adds a security changelog entry documenting the behavior change.

Confidence Score: 5/5

The PR appears safe to merge, with the newly enforced startup failure matching the stated security objective.

The change removes only the explicit stale-monitor bypass; ordinary node construction and existing BuildException-to-LdkError propagation remain intact, and no actionable regression was identified.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/LightningService.kt	Removes the intentional stale-monitor recovery retry while retaining existing builder selection and build-error propagation.
changelog.d/next/stale-monitor.security.md	Accurately documents that storage mismatches no longer cause startup with outdated channel monitors.

_{Reviews (1): Last reviewed commit: "fix: stop auto-accepting stale monitors" | Re-trigger Greptile}

[jvsena42]

Migration check

https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[jvsena42]

Self contained PR, migrations passing https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[ben-kaufman]

Description

This PR restores fail-closed Lightning startup when stored channel monitors are stale relative to the channel manager.

• Removes the automatic DangerousValue retry that enabled stale-monitor recovery.

The retry was added in 2.1.2 to recover wallets affected by the 2.1.0 RN monitor overwrite. Current ldk-node versions protect newer stored monitors from stale migration data, and those affected wallets are assumed recovered. A future storage mismatch now fails node construction before startup or chain processing. Stale-monitor acceptance stays at the ldk-node default (false).

Related: https://github.com/synonymdev/audit/issues/55
Companion: synonymdev/bitkit-ios#664

Preview

N/A, no UI changes.

QA Notes

Manual Tests

• 1.regression: Launch an existing wallet with channels: Lightning node starts normally and balances/channels appear.
• 2.regression: Force-quit and relaunch: node starts without a stale-monitor recovery log.
• 3. Start with a monitor older than the channel manager: startup fails with DangerousValue and no node starts.

Automated Checks

• CI: standard compile, unit test, detekt, and E2E checks run by the PR bot.

[greptile-apps]

Greptile Summary

This PR removes the Lightning node startup fallback that disabled LDK’s stale-channel-monitor safety check after a DangerousValue build failure.

• Builds the node once using the configured VSS store and lets monitor/manager mismatches fail normally.
• Preserves conversion of LDK BuildException failures into the existing LdkError flow.
• Adds a security changelog entry documenting the behavior change.

Confidence Score: 5/5

The PR appears safe to merge, with the newly enforced startup failure matching the stated security objective.

The change removes only the explicit stale-monitor bypass; ordinary node construction and existing BuildException-to-LdkError propagation remain intact, and no actionable regression was identified.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/LightningService.kt	Removes the intentional stale-monitor recovery retry while retaining existing builder selection and build-error propagation.
changelog.d/next/stale-monitor.security.md	Accurately documents that storage mismatches no longer cause startup with outdated channel monitors.

_{Reviews (1): Last reviewed commit: "fix: stop auto-accepting stale monitors" | Re-trigger Greptile}

[jvsena42]

Migration check

https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[jvsena42]

Self contained PR, migrations passing https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[ben-kaufman]

Description

This PR restores fail-closed Lightning startup when stored channel monitors are stale relative to the channel manager.

• Removes the automatic DangerousValue retry that enabled stale-monitor recovery.

The retry was added in 2.1.2 to recover wallets affected by the 2.1.0 RN monitor overwrite. Current ldk-node versions protect newer stored monitors from stale migration data, and those affected wallets are assumed recovered. A future storage mismatch now fails node construction before startup or chain processing. Stale-monitor acceptance stays at the ldk-node default (false).

Related: https://github.com/synonymdev/audit/issues/55
Companion: synonymdev/bitkit-ios#664

Preview

N/A, no UI changes.

QA Notes

Manual Tests

• 1.regression: Launch an existing wallet with channels: Lightning node starts normally and balances/channels appear.
• 2.regression: Force-quit and relaunch: node starts without a stale-monitor recovery log.
• 3. Start with a monitor older than the channel manager: startup fails with DangerousValue and no node starts.

Automated Checks

• CI: standard compile, unit test, detekt, and E2E checks run by the PR bot.

[greptile-apps]

Greptile Summary

This PR removes the Lightning node startup fallback that disabled LDK’s stale-channel-monitor safety check after a DangerousValue build failure.

• Builds the node once using the configured VSS store and lets monitor/manager mismatches fail normally.
• Preserves conversion of LDK BuildException failures into the existing LdkError flow.
• Adds a security changelog entry documenting the behavior change.

Confidence Score: 5/5

The PR appears safe to merge, with the newly enforced startup failure matching the stated security objective.

The change removes only the explicit stale-monitor bypass; ordinary node construction and existing BuildException-to-LdkError propagation remain intact, and no actionable regression was identified.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/LightningService.kt	Removes the intentional stale-monitor recovery retry while retaining existing builder selection and build-error propagation.
changelog.d/next/stale-monitor.security.md	Accurately documents that storage mismatches no longer cause startup with outdated channel monitors.

_{Reviews (1): Last reviewed commit: "fix: stop auto-accepting stale monitors" | Re-trigger Greptile}

[jvsena42]

Migration check

https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[jvsena42]

Self contained PR, migrations passing https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[ben-kaufman]

Description

This PR restores fail-closed Lightning startup when stored channel monitors are stale relative to the channel manager.

• Removes the automatic DangerousValue retry that enabled stale-monitor recovery.

The retry was added in 2.1.2 to recover wallets affected by the 2.1.0 RN monitor overwrite. Current ldk-node versions protect newer stored monitors from stale migration data, and those affected wallets are assumed recovered. A future storage mismatch now fails node construction before startup or chain processing. Stale-monitor acceptance stays at the ldk-node default (false).

Related: https://github.com/synonymdev/audit/issues/55
Companion: synonymdev/bitkit-ios#664

Preview

N/A, no UI changes.

QA Notes

Manual Tests

• 1.regression: Launch an existing wallet with channels: Lightning node starts normally and balances/channels appear.
• 2.regression: Force-quit and relaunch: node starts without a stale-monitor recovery log.
• 3. Start with a monitor older than the channel manager: startup fails with DangerousValue and no node starts.

Automated Checks

• CI: standard compile, unit test, detekt, and E2E checks run by the PR bot.

[greptile-apps]

Greptile Summary

This PR removes the Lightning node startup fallback that disabled LDK’s stale-channel-monitor safety check after a DangerousValue build failure.

• Builds the node once using the configured VSS store and lets monitor/manager mismatches fail normally.
• Preserves conversion of LDK BuildException failures into the existing LdkError flow.
• Adds a security changelog entry documenting the behavior change.

Confidence Score: 5/5

The PR appears safe to merge, with the newly enforced startup failure matching the stated security objective.

The change removes only the explicit stale-monitor bypass; ordinary node construction and existing BuildException-to-LdkError propagation remain intact, and no actionable regression was identified.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/LightningService.kt	Removes the intentional stale-monitor recovery retry while retaining existing builder selection and build-error propagation.
changelog.d/next/stale-monitor.security.md	Accurately documents that storage mismatches no longer cause startup with outdated channel monitors.

_{Reviews (1): Last reviewed commit: "fix: stop auto-accepting stale monitors" | Re-trigger Greptile}

[jvsena42]

Migration check

https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[jvsena42]

Self contained PR, migrations passing https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[ben-kaufman]

Description

This PR restores fail-closed Lightning startup when stored channel monitors are stale relative to the channel manager.

• Removes the automatic DangerousValue retry that enabled stale-monitor recovery.

The retry was added in 2.1.2 to recover wallets affected by the 2.1.0 RN monitor overwrite. Current ldk-node versions protect newer stored monitors from stale migration data, and those affected wallets are assumed recovered. A future storage mismatch now fails node construction before startup or chain processing. Stale-monitor acceptance stays at the ldk-node default (false).

Related: https://github.com/synonymdev/audit/issues/55
Companion: synonymdev/bitkit-ios#664

Preview

N/A, no UI changes.

QA Notes

Manual Tests

• 1.regression: Launch an existing wallet with channels: Lightning node starts normally and balances/channels appear.
• 2.regression: Force-quit and relaunch: node starts without a stale-monitor recovery log.
• 3. Start with a monitor older than the channel manager: startup fails with DangerousValue and no node starts.

Automated Checks

• CI: standard compile, unit test, detekt, and E2E checks run by the PR bot.

[greptile-apps]

Greptile Summary

This PR removes the Lightning node startup fallback that disabled LDK’s stale-channel-monitor safety check after a DangerousValue build failure.

• Builds the node once using the configured VSS store and lets monitor/manager mismatches fail normally.
• Preserves conversion of LDK BuildException failures into the existing LdkError flow.
• Adds a security changelog entry documenting the behavior change.

Confidence Score: 5/5

The PR appears safe to merge, with the newly enforced startup failure matching the stated security objective.

The change removes only the explicit stale-monitor bypass; ordinary node construction and existing BuildException-to-LdkError propagation remain intact, and no actionable regression was identified.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/LightningService.kt	Removes the intentional stale-monitor recovery retry while retaining existing builder selection and build-error propagation.
changelog.d/next/stale-monitor.security.md	Accurately documents that storage mismatches no longer cause startup with outdated channel monitors.

_{Reviews (1): Last reviewed commit: "fix: stop auto-accepting stale monitors" | Re-trigger Greptile}

[jvsena42]

Migration check

https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[jvsena42]

Self contained PR, migrations passing https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[ben-kaufman]

Description

This PR restores fail-closed Lightning startup when stored channel monitors are stale relative to the channel manager.

• Removes the automatic DangerousValue retry that enabled stale-monitor recovery.

The retry was added in 2.1.2 to recover wallets affected by the 2.1.0 RN monitor overwrite. Current ldk-node versions protect newer stored monitors from stale migration data, and those affected wallets are assumed recovered. A future storage mismatch now fails node construction before startup or chain processing. Stale-monitor acceptance stays at the ldk-node default (false).

Related: https://github.com/synonymdev/audit/issues/55
Companion: synonymdev/bitkit-ios#664

Preview

N/A, no UI changes.

QA Notes

Manual Tests

• 1.regression: Launch an existing wallet with channels: Lightning node starts normally and balances/channels appear.
• 2.regression: Force-quit and relaunch: node starts without a stale-monitor recovery log.
• 3. Start with a monitor older than the channel manager: startup fails with DangerousValue and no node starts.

Automated Checks

• CI: standard compile, unit test, detekt, and E2E checks run by the PR bot.

[greptile-apps]

Greptile Summary

This PR removes the Lightning node startup fallback that disabled LDK’s stale-channel-monitor safety check after a DangerousValue build failure.

• Builds the node once using the configured VSS store and lets monitor/manager mismatches fail normally.
• Preserves conversion of LDK BuildException failures into the existing LdkError flow.
• Adds a security changelog entry documenting the behavior change.

Confidence Score: 5/5

The PR appears safe to merge, with the newly enforced startup failure matching the stated security objective.

The change removes only the explicit stale-monitor bypass; ordinary node construction and existing BuildException-to-LdkError propagation remain intact, and no actionable regression was identified.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/LightningService.kt	Removes the intentional stale-monitor recovery retry while retaining existing builder selection and build-error propagation.
changelog.d/next/stale-monitor.security.md	Accurately documents that storage mismatches no longer cause startup with outdated channel monitors.

_{Reviews (1): Last reviewed commit: "fix: stop auto-accepting stale monitors" | Re-trigger Greptile}

[jvsena42]

Migration check

https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[jvsena42]

Self contained PR, migrations passing https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[ben-kaufman]

Description

This PR restores fail-closed Lightning startup when stored channel monitors are stale relative to the channel manager.

• Removes the automatic DangerousValue retry that enabled stale-monitor recovery.

The retry was added in 2.1.2 to recover wallets affected by the 2.1.0 RN monitor overwrite. Current ldk-node versions protect newer stored monitors from stale migration data, and those affected wallets are assumed recovered. A future storage mismatch now fails node construction before startup or chain processing. Stale-monitor acceptance stays at the ldk-node default (false).

Related: https://github.com/synonymdev/audit/issues/55
Companion: synonymdev/bitkit-ios#664

Preview

N/A, no UI changes.

QA Notes

Manual Tests

• 1.regression: Launch an existing wallet with channels: Lightning node starts normally and balances/channels appear.
• 2.regression: Force-quit and relaunch: node starts without a stale-monitor recovery log.
• 3. Start with a monitor older than the channel manager: startup fails with DangerousValue and no node starts.

Automated Checks

• CI: standard compile, unit test, detekt, and E2E checks run by the PR bot.

[greptile-apps]

Greptile Summary

This PR removes the Lightning node startup fallback that disabled LDK’s stale-channel-monitor safety check after a DangerousValue build failure.

• Builds the node once using the configured VSS store and lets monitor/manager mismatches fail normally.
• Preserves conversion of LDK BuildException failures into the existing LdkError flow.
• Adds a security changelog entry documenting the behavior change.

Confidence Score: 5/5

The PR appears safe to merge, with the newly enforced startup failure matching the stated security objective.

The change removes only the explicit stale-monitor bypass; ordinary node construction and existing BuildException-to-LdkError propagation remain intact, and no actionable regression was identified.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/LightningService.kt	Removes the intentional stale-monitor recovery retry while retaining existing builder selection and build-error propagation.
changelog.d/next/stale-monitor.security.md	Accurately documents that storage mismatches no longer cause startup with outdated channel monitors.

_{Reviews (1): Last reviewed commit: "fix: stop auto-accepting stale monitors" | Re-trigger Greptile}

[jvsena42]

Migration check

https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[jvsena42]

Self contained PR, migrations passing https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[ben-kaufman]

Description

This PR restores fail-closed Lightning startup when stored channel monitors are stale relative to the channel manager.

• Removes the automatic DangerousValue retry that enabled stale-monitor recovery.

The retry was added in 2.1.2 to recover wallets affected by the 2.1.0 RN monitor overwrite. Current ldk-node versions protect newer stored monitors from stale migration data, and those affected wallets are assumed recovered. A future storage mismatch now fails node construction before startup or chain processing. Stale-monitor acceptance stays at the ldk-node default (false).

Related: https://github.com/synonymdev/audit/issues/55
Companion: synonymdev/bitkit-ios#664

Preview

N/A, no UI changes.

QA Notes

Manual Tests

• 1.regression: Launch an existing wallet with channels: Lightning node starts normally and balances/channels appear.
• 2.regression: Force-quit and relaunch: node starts without a stale-monitor recovery log.
• 3. Start with a monitor older than the channel manager: startup fails with DangerousValue and no node starts.

Automated Checks

• CI: standard compile, unit test, detekt, and E2E checks run by the PR bot.

[greptile-apps]

Greptile Summary

This PR removes the Lightning node startup fallback that disabled LDK’s stale-channel-monitor safety check after a DangerousValue build failure.

• Builds the node once using the configured VSS store and lets monitor/manager mismatches fail normally.
• Preserves conversion of LDK BuildException failures into the existing LdkError flow.
• Adds a security changelog entry documenting the behavior change.

Confidence Score: 5/5

The PR appears safe to merge, with the newly enforced startup failure matching the stated security objective.

The change removes only the explicit stale-monitor bypass; ordinary node construction and existing BuildException-to-LdkError propagation remain intact, and no actionable regression was identified.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/services/LightningService.kt	Removes the intentional stale-monitor recovery retry while retaining existing builder selection and build-error propagation.
changelog.d/next/stale-monitor.security.md	Accurately documents that storage mismatches no longer cause startup with outdated channel monitors.

_{Reviews (1): Last reviewed commit: "fix: stop auto-accepting stale monitors" | Re-trigger Greptile}

[jvsena42]

Migration check

https://github.com/synonymdev/bitkit-android/actions/runs/31701528479

[jvsena42]

Self contained PR, migrations passing https://github.com/synonymdev/bitkit-android/actions/runs/31701528479