dual_open_control: check dualopend liveness before validating PSBT signatures

[vincenzopalazzo]

Summary

• When the peer disconnects during the openchannel2_sign hook, the disconnect notification races with the hook in the funder plugin, causing it to clean up state and return the PSBT unsigned
• The signature validation check then fires first, logging a spurious BROKEN message before discovering that dualopend had already died
• Move the dualopend liveness check before PSBT validation -- if the daemon is gone there is no point checking signatures since we cannot send them anyway
• Add test_inflight_dbload regression test that triggers the race condition

Fixes #8902
Changelog-None

Test plan

• CI passes
• test_inflight_dbload triggers the disconnect race and verifies no spurious BROKEN from the signature check (only the expected daemon-death BROKEN)

[madelinevibes]

@vincenzopalazzo can you rebase please? Hoping @niftynei can review by the end of this week to add into 26.06 Release Candidate planned for 11 May

[niftynei]

There's a few things here. The linked issue (#8902) shows two BROKEN messages.

The first BROKEN messages is the result of a race condition between the peer disconnect message firing when the disconnect happens (which in funder.c cleans up all the in-progress channels for this node -- not a good idea), and the open_channel_sign_psbt hook. The notification arrives before the hook does, and the psbt is removed/cleaned up before the signature can be produced. This should be fixed.

The other BROKEN message is due to the fact that lightningd can send a WIRE_DUALOPEND_FAIL message in addition to a WIRE_DUALOPEND_SEND_TX_SIGS. The receiving path in dualopend.c is not expecting the FAIL message, so it doesn't handle this correctly.

Given the root cause of the two BROKEN messages, the following notes are incorrect.

The signature validation check then fires first, logging a spurious BROKEN message before discovering that dualopend had already died

Move the dualopend liveness check before PSBT validation -- if the daemon is gone there is no point checking signatures since we cannot send them anyway

Were these correct, the proposed fixes would be sound but as is this set of commits doesn't solve the the issues as described in #8902.

[niftynei]

This doesn't address the core issues identified in #8902. See #9394 for more details.

[vincenzopalazzo]

Oh i do not remember what this is anymore, thanks to pick this up lisa!