v31.1-roots.1 · Commit 10: [PATCH 10/17] docs(roots): record v31 contract preservation evidence

doc/roots-v31-port-review.md

Before: doc/roots-v31-port-review.md · After: doc/roots-v31-port-review.md

File metadata

index 2732a300ad5d2aeabe2a811531685bb69ba0bcbb..3c884d320c6e229806526260e86c8fe52dc7b9f5 100644

Download original patch · Release notes

Diff rows 401–502 of 502. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.

doc/roots-v31-port-review.md CHANGED Viewed

	@@ -1007,3 +1018,353 @@ binary/tool-test/export hashes are local evidence under (continued)

+## L15.2 provenance, observed failures and approved handoff
+The evidence-only working tree is based on implementation HEAD
+`8e7ffad5d932e07c0c80f3756f7c3a442786877e` and Core base
+`9be056a8a72b624dae9623b2f7bded92c2a21c91`. The current reuse check compares
+all eight L14 repair-source hashes, thirteen binary hashes, four build-cache
+hashes, 453 fixture hashes (389 functional, 60 maintained-tool, one native-stream
+and three Qt) and seventeen command-log hashes with the accepted repair snapshot.
+Matched evidence retains its original commands, skips and profile limitations;
+no full unit, functional, Qt or sanitizer suite was rerun for this documentation
+change. The older dynamic-dust arithmetic-closure pass remains historical,
+limited evidence and does not supersede the current failures below.
+| Matched accepted evidence | Result and scope |
+| --- | --- |
+| Native unit suite | 774 passing cases. |
+| CTest | 156 passes; one external-assets skip. |
+| Functional suite | 278 passes; 17 prerequisite skips, detailed below. |
+| Qt5 and Qt6 | 22 passing result rows per major, including fresh-process persistence probes; no skips. |
+| Maintained tools | 125 passing cases. |
+| Stream ASan/UBSan smoke | 20 passing cases with leak detection disabled; prior bounded stream evidence only. |
+| Compact-block benchmark | Three one-iteration smokes; no throughput claim. |
+The 17 functional skips comprise uncompiled benchmark and chainstate tools
+(two), missing Python ZMQ (one), disabled USDT tracepoints (five), unavailable
+previous releases (five), external routable-address prerequisites (two) and
+uncompiled IPC (two). Previous-release cases are
+`wallet_backwards_compatibility.py`, `mempool_compatibility.py`,
+`feature_unsupported_utxo_db.py`, `feature_coinstatsindex_compatibility.py` and
+`wallet_migration.py`; IPC cases are `interface_ipc.py` and
+`interface_ipc_mining.py`. The earlier functional benchmark skip remains recorded
+although a later configured benchmark build and three smokes passed.
+### Existing current-target diagnostic results
+Before the reduced-verification instruction, the current-source local fast run
+completed all nine selected targets with five-second per-target budgets, seed 1,
+maximum input length 4096 and a 2048 MiB RSS limit. Its preserved result record
+reports **seven passes and two failures**, with no omitted target in that run:
+| Target | Observed exit | Result |
+| --- | --- | --- |
+| `dynamic_dust_fee` | 1 | Fail: Boost multiprecision signed-bound conversion in the reference oracle reports unsigned-integer-overflow. |
+| `policy_args` | 1 | Fail: decimal-validator char conversion reports implicit-integer-sign-change at `src/test/fuzz/policy_args.cpp:37`. |
+| `process_message` | 0 | Pass within the bounded local run. |
+| `psbt` | 0 | Pass within the bounded local run. |
+| `script` | 0 | Pass within the bounded local run. |
+| `string` | 0 | Pass within the bounded local run. |
+| `subdust_fee_penalty` | 0 | Pass within the bounded local run. |
+| `tx_pool` | 0 | Pass within the bounded local run. |
+| `txgraph` | 0 | Pass within the bounded local run. |
+These results belong to the existing local Clang 19 current-source build with
+`fuzzer,address,undefined,float-divide-by-zero,integer` instrumentation,
+`-ftrivial-auto-var-init=pattern` and IPC disabled. Hosted CI uses Clang 22;
+matching sanitizer names do not establish compiler/profile equivalence. The
+Boost diagnostic is in `cpp_int/misc.hpp:1303`, reached by the oracle conversion
+at `src/test/fuzz/tx_pool.cpp:574`; it is not a demonstrated production-policy
+failure. These observed failures are preserved, unresolved at the L15 tree,
+and cannot be relabeled as passing by using the older arithmetic-only binary.
+No failing input was replayed during this documentation reconciliation.
+The preserved hosted observation for draft PR 49 is fuzz job `114814967702`
+in run `38249608708`, exit 1, with no uploaded per-target diagnostics. The
+historical hosted failing target remains unidentified. Existing inspection found
+per-target output in container scratch while artifact upload searched a host
+path; L16 owns diagnostic transport repair. The local failures do not establish
+the cause of that hosted failure. Hosted lint success is separate from the two
+accepted preexisting global include-lint findings disclosed above.
+### Reduced verification and remaining ownership
+On 2026-10-12 the user explicitly removed further fuzz execution, sanitizer
+campaigns and saved-input reproducer replays from remaining work and acceptance.
+No hosted substitute is authorized for those omitted actions. Reduced coverage
+is an accepted limitation, not a passing result. The existing nine-target
+results and failure logs remain evidence; no new instrumented pass is required
+or asserted. Following the planned L16 repairs, the affected targets must be
+reported as **not rerun under instrumentation**.
+L16 separately owns safe signed-bound handling including `INT64_MIN` in the
+independent dynamic-dust reference oracle, explicit decimal-validator character
+conversion, host-visible failure artifacts and bounded console diagnostics.
+Its required verification uses ordinary focused unit/maintenance/CI-helper tests,
+source review, relevant lint, matched prior full-suite evidence and portable
+export/replay parity. Neither production-policy changes nor broad sanitizer
+suppression are part of this disposition. Final candidate acceptance belongs
+to L16 followed by fresh terminal review; acceptance of L15 only approves the
+accuracy and integrity of this documentation.
+Current documentation checks verify the complete source/author ledger, 25
+contract dispositions, local links, option documentation, whitespace and exact
+single-document dirty scope with an empty index. An isolated disposable clone
+snapshots the intended documentation tree for portable export/replay using
+`git am -3 --keep-cr`: product paths match that snapshot, `.github/**` remains
+excluded from the patch and at the Core base on replay, and Jaromil and
+devjoinedthechat credit remains present. All temporary snapshot commits, refs
+and the export fixture tag belong to that clone; candidate refs are unchanged.
+After an eventual accepted L15 commit, documentation tree/artifact identity is
+checked again. This is export integrity evidence, not release, signing,
+promotion, hosted-matrix or whole-candidate acceptance.