v31.1-roots.1 · Commit 2: [PATCH 02/17] feat(policy): preserve Roots parsing and local transaction checks
doc/roots-v31-port-review.md
Before: doc/roots-v31-port-review.md · After: doc/roots-v31-port-review.md
File metadata
index 62f5cb6c57c70a2641fa6ef084f2d44f8f59b95c..2796361ade6b2488e3e8b82ace51eba606ff45dc 100644
Download original patch · Release notes
Diff rows 1–229 of 229. Line numbers refer to the original before/after files.
+ Added− RemovedUnmarked lines are context.
Scroll the code area horizontally to read long lines. The two line-number columns refer to before and after.
doc/roots-v31-port-review.md
CHANGED
|
@@ -57,7 +57,9 @@ not a Roots-series merge.
|
|
|
57
57
|
|
|
58
58
|
## Proposed smaller series and dependencies
|
|
59
59
|
|
|
60
|
-
Retain the seven-theme target: **7 instead of 72 commits**. Historical fixes,
|
|
60
|
+
The user approved a nine-theme target: **9 instead of 72 commits**. The former
|
|
61
|
+
policy/mining theme is split into independently reviewed local checks, graph
|
|
62
|
+
accounting, and mining adaptations. Historical fixes,
|
|
61
63
|
tests and documentation travel with the behavior they correct; release/CI work
|
|
62
64
|
travels with maintenance, rather than recreating chronological fixup commits.
|
|
63
65
|
No broad compatibility layer is proposed.
|
|
@@ -65,28 +67,35 @@ No broad compatibility layer is proposed.
|
|
|
65
67
|
| Theme | Owning scope and prerequisite |
|
|
66
68
|
| --- | --- |
|
|
67
69
|
| L6 build/portability | Dependency probes and supported switches; contract documents and this review. Establishes the foundation only. |
|
|
68
|
-
| L7 local policy/mining | Admission, replacement, carrier/dust/coinage/reuse, strict parsing, mining, interaction/fuzz coverage. Requires L6. |
|
|
69
|
-
| L8 peers | Resource/permission controls and current-connection health; GUI/functional coverage. Requires L7 and L6. |
|
|
70
|
-
| L9 wallet | Database/signer boundaries, per-send RBF, sweep authorization/secrets and coin-control facts. Requires L8. |
|
|
71
|
-
| L10 operator/runtime | Read/write config, effective-policy RPC and platform resource support; dormant stats remain dormant. Requires L7 state and L9. |
|
|
72
|
-
| L11 integration | Identity/icons/QR/taskbar, generated help artifacts, CI and release/export tools. Requires L10. |
|
|
73
|
-
| L12 evidence | Final preservation review, range comparison and exact-candidate supported gates. Requires L6–L11. |
|
|
74
|
-
|
|
75
|
-
The largest adaptation is L7: v31 uses `TxGraph` clusters and chunk-based mining,
|
|
76
|
-
not the old ancestor-index selection model. L9 carries distinct security
|
|
77
|
-
boundaries but its L2 divisions separate foundation from sweep/coin control.
|
|
78
|
-
The old-to-upstream aggregate wallet/Qt diff includes thousands of unrelated
|
|
79
|
-
upstream lines and is not a port-size estimate. No implementation has established
|
|
80
|
-
that these themes need a split yet. Reassess the actual proposed diff and
|
|
81
|
-
feature-owned tests before L7/L9 execution; revise milestones first if their
|
|
82
|
-
independent risks cannot be reviewed safely in one thematic commit. Seven is
|
|
83
|
-
a target, not permission to hide unreviewable coupling.
|
|
84
|
-
|
|
85
|
-
`runtime-config` is an L10 implementation dependency of L7 parsing and L9 sweep.
|
|
70
|
+
| L7 parsing/local checks | Scoped parsing, script/witness/sigop standardness, carrier detection/budgets, fixed dust/ephemeral and relay age/maturity. Requires L6. |
|
|
71
|
+
| L8 graph policy | Carrier policy weight, sub-dust modified fees, replacement/TRUC/reuse and authorized dynamic-dust repair. Requires L7. |
|
|
72
|
+
| L9 mining | Coin-age priority, template normalization, residual chunk assembly and joint interactions. Requires L8. |
|
|
73
|
+
| L10 peers | Resource/permission controls and current-connection health; GUI/functional coverage. Requires L7 and L6. |
|
|
74
|
+
| L11 wallet | Database/signer boundaries, per-send RBF, sweep authorization/secrets and coin-control facts. Requires L10. |
|
|
75
|
+
| L12 operator/runtime | Read/write config, effective-policy RPC and platform resource support; dormant stats remain dormant. Requires L7 state and L11. |
|
|
76
|
+
| L13 integration | Identity/icons/QR/taskbar, generated help artifacts, CI and release/export tools. Requires L12. |
|
|
77
|
+
| L14 evidence | Final preservation review, range comparison and exact-candidate supported gates. Requires L6–L13. |
|
|
78
|
+
|
|
79
|
+
Preimplementation review found distinct algorithm risks: v31's block builder
|
|
80
|
+
can include or skip only the current whole chunk, while Roots selects an
|
|
81
|
+
individual priority prefix before fee-selected descendants. Graph policy
|
|
82
|
+
weight/modified-fee consistency across staging, diagrams, replacement and
|
|
83
|
+
trimming needs its own review before that mining adaptation. The approved
|
|
84
|
+
split separates those risks without restoring ancestor indexes or retiring
|
|
85
|
+
any intended contract. Existing accepted commits are unchanged.
|
|
86
|
+
|
|
87
|
+
The user also authorized a bounded L8 repair of the documented non-off
|
|
88
|
+
dynamic-dust startup defect: node-owned scheduling after final successful
|
|
89
|
+
chainstate load, safe retry/shutdown lifetime, configured-floor fallback when
|
|
90
|
+
estimates are unavailable and overflow-safe multiplier scaling, all with
|
|
91
|
+
regressions. Default remains off. This authorization does not enable dormant
|
|
92
|
+
statistics or permit unrelated repairs. Dynamic runtime is still deferred.
|
|
93
|
+
|
|
94
|
+
`runtime-config` is an L12 implementation dependency of L7 parsing and L11 sweep.
|
|
86
95
|
Until then, feature tests must cover Core CLI/config semantics and explicitly
|
|
87
96
|
defer Roots `confrw` precedence cases; they cannot claim those cases passed.
|
|
88
|
-
The full precedence gate runs when L10 lands. Feature-local tests still ship
|
|
89
|
-
with each implementation; L12 is additional aggregate evidence.
|
|
97
|
+
The full precedence gate runs when L12 lands. Feature-local tests still ship
|
|
98
|
+
with each implementation; L14 is additional aggregate evidence.
|
|
90
99
|
|
|
91
100
|
## Contract dispositions against actual v31.1 APIs
|
|
92
101
|
|
|
@@ -99,30 +108,30 @@ contract with remaining Roots behavior. Existing source gaps remain explicit.
|
|
|
99
108
|
|
|
100
109
|
| Contract | Disposition / theme | Upstream comparison, adaptation and acceptance gate |
|
|
101
110
|
| --- | --- | --- |
|
|
102
|
-
| policy-parsing | adapted / L7 | `node::ApplyArgsManOptions` now consumes cluster limits; Roots policy parser and grammar are absent. Preserve L2's complete-token/range/diagnostic decisions, quarter-vbyte rounding and CLI/config precedence. Port parser unit/startup tests and L5 fuzz boundaries; complete read/write precedence in L10. |
|
|
103
|
-
| effective-policy | adapted / L10 | `getmempoolinfo` has cluster-era size/fee information but no Roots `policy` object. Read authoritative initialized v31 state plus synchronized dynamic dust; retain L3's schema, units and enforcement gates. Port `rpc_effective_policy.py`, help and admission parity assertions. L4 supplied no snapshot refactor to carry. |
|
|
111
|
+
| policy-parsing | adapted / L7 | `node::ApplyArgsManOptions` now consumes cluster limits; L7 carries scoped grammar; graph/mining options are labelled parsing-only until L8/L9 enforcement lands. Preserve L2's complete-token/range/diagnostic decisions, quarter-vbyte rounding and CLI/config precedence. Port parser unit/startup tests and L5 fuzz boundaries; complete read/write precedence in L12. |
|
|
112
|
+
| effective-policy | adapted / L12 | `getmempoolinfo` has cluster-era size/fee information but no Roots `policy` object. Read authoritative initialized v31 state plus synchronized dynamic dust; retain L3's schema, units and enforcement gates. Port `rpc_effective_policy.py`, help and admission parity assertions. L4 supplied no snapshot refactor to carry. |
|
|
104
113
|
| policy-standardness | adapted / L7 | Core `IsStandardTx` takes carrier budget, bare-multisig flag and dust rate. Core permits bare multisig by default and lacks Roots configurable script/witness, strict sigop, CAT21/token and ephemeral modes. Preserve Roots limits/defaults/reasons solely in local gates. Run transaction/sigop/TRUC cases and valid-block fixtures; do not change script consensus. |
|
|
105
|
-
| policy-carrier | adapted / L7 | Core defaults to a 100,000-vbyte OP_RETURN budget, not Roots' aggregate 83-byte budget, and lacks recognized input/witness carriers and cost weighting. Adapt detection/extra policy weight to `TxGraph` fee/weight accounting. Retain Roots `multi-op-return` rejection despite source help conflict. Port `mempool_datacarrier.py`, extra-weight boundaries, tapscript and L5 dust-cost interactions. |
|
|
106
|
-
| policy-dust | adapted / L7 | Core retains `GetDustThreshold` and a 3,000 sat/kvB floor, but has a fixed initialized rate and no `dustdynamic` publication. Retain scheduler, estimator/floor behavior and synchronized snapshots; adapt mempool-position estimation to clusters. Run `mempool_dust.py` and changing-publication unit cases. Estimator-unavailable and extreme-multiplier gaps are not passes. |
|
|
107
|
-
| policy-subdust | adapted / L7 | No upstream deficit penalty. Preserve worked contract units, saturation, exemptions and modified-fee accounting without changing actual fee rewards. Adapt policy weight/modified fees consistently through cluster admission, replacement and mining. Port sub-dust tests and L5 arithmetic fuzz/valid-block cases. |
|
|
108
|
-
| policy-replacement | adapted / L7 | Core has unconditional full RBF and cluster feerate-diagram replacement, with enforced TRUC; Roots Never/OptIn/TRUC mode controls are absent. Default full RBF alone is not equivalence. Preserve configured modes, v3 opt-in behavior, fee/resource gates and truthful `fullrbf`; adapt to current replacement algorithms without restoring ancestor indexes. Run RBF/TRUC/package/sibling and policy-block tests. |
|
|
109
|
-
| policy-coinage | adapted / L7 | Relay coin-block age and maturity controls are absent. Reuse available coin heights; add local gates and bounded age arithmetic, never alter consensus coinbase maturity. Preserve disabled defaults and add/retain enabled, boundary and valid-block acceptance cases; prior dedicated relay coverage remains a gap. |
|
|
110
|
-
| policy-reuse | adapted / L7 | No upstream `spkreuse` creation/spend tracking or conflict mode. Preserve default allow and explicitly configured local tracking across admission, replacement and reorg. Dedicated functional mode/reorg coverage is still required before claiming equivalence. |
|
|
111
|
-
| mining-template | adapted / L7 | `BlockAssembler::addChunks` replaces ancestor-index assembly. Core's default weight is 4,000,000 with reserved-weight handling and minimum fee 1 sat/kvB, not Roots' 1,200,000 weight / 1,000 sat/kvB / 100,000-byte priority area. Preserve size/weight normalization and coin-age priority while avoiding duplicates and charging ancestor/chunk resources correctly. Port miner boundaries and L5 priority/fee/block-acceptance cases. |
|
|
112
|
-
| peer-controls | adapted / L8 | Core compact reconstruction extras default to 100 entries, with no Roots 10 MB memory bound; orphanage is `node::TxOrphanage`, not the former pool layout. Core whitelist/upload/BIP permissions do not establish forceinbound, explicit compact-filter permission, subnet disconnect or clearnet-v2-only equivalence. Preserve each documented default, malformed-input bound, Tor-bind isolation and SOCKS secret boundary; run extra-tx, permissions, filter, eviction and invalid-message tests. |
|
|
113
|
-
| peer-health | adapted / L8 | Core has current-peer stats/table/details but lacks the complete Roots extra fields and unavailable-state contract. Use existing refresh/interfaces; port stale-detail reset, sort/selection and bounded CPU reporting. Run `rpc_net.py`/Qt apptests and required resolution/font-scale matrix; no collector/history feature. |
|
|
114
|
-
| wallet-foundation | adapted / L9 | Descriptor/SQLite and external signing remain upstream. v31 database enumeration still recursively traverses directories; Roots directory/reparse/permission safeguards remain necessary. `RunCommandParseJSON` now takes an argv vector instead of a shell command string; preserve child-FD closure on this API. Port multiwallet/signer/unit cases, retaining no-BDB-build and locking boundaries. |
|
|
115
|
-
| wallet-rbf | adapted / L9 | Core has a per-send checkbox and sequence override, but initializes the checkbox checked rather than from wallet `walletrbf`. A similar UI is insufficient. Preserve wallet-derived preference, explicit overrides, confirmation and PSBT signaling tests. |
|
|
116
|
-
| wallet-sweep | adapted / L9 | No Core `sweepprivkeys` RPC/dialog. Adapt wallet fee/coin APIs and cancellation through interfaces; preserve WIF/script scope, selected local-key descriptor destination, no import, preview default, locked fee snapshot, transient secure cache/redaction and final broadcast authorization. Run sweep functional/Qt/security-structure tests plus runtime cancellation and visual evidence. |
|
|
117
|
-
| wallet-coin-control | adapted / L9 | Core retains ordinary coin-control/listLockedCoins; it lacks Roots effective/reuse/grouping facts and full invalidation contract. Adapt current wallet output/input-size APIs, preserve visibility/selection filters and conspicuous change validation. Run wallet-send/Qt selection/invalidation/source checks and populated GUI matrix. |
|
|
118
|
-
| runtime-config | adapted / L10 | `common::MergeSettings` contains forced/CLI/JSON/config sources, but no Roots read/write text configuration layer or `confrw`. Insert the existing layer and typed writes into current ArgsManager without a duplicate policy store; preserve network-file/default/negation/list rules. Run getarg/config functional and deferred L7 precedence cases. |
|
|
119
|
-
| operator-stats | kept; uptime adopted-upstream / L10 | `uptime` still returns `TicksSeconds(GetUptime())`; `GetUptime` uses `SteadyClock` initialized at app startup. Its function/schema/clock/defaults are identical in relevant source; upstream adds a wall-clock-jump regression. Both the exact pinned-source acceptance test and current upstream `rpc_uptime.py` pass on the authenticated base. Independent review accepted this narrow sub-aspect, not retirement of the whole contract. Core has no Roots stats model/RPC. Keep the retained stats source dormant: do not register, sample or advertise `getmempoolstats` without a separate compatibility decision. Source GUI/default/help conflict remains a gap. |
|
|
120
|
-
| runtime-resources | adapted / L10 | Core has `GetTotalRAM` and RAM-aware cache sizing, so helper-name similarity cannot retire Roots sizing semantics. Compare exact cache thresholds/units and failure defaults before sub-aspect retirement; preserve Roots byte-safe allocation, FD bounds and platform-scoped advisory helpers where needed. Run RAM/FS/util tests and actual supported-platform checks; unused helpers are not a cross-platform service. |
|
|
114
|
+
| policy-carrier | adapted / L7,L8 | Core defaults to a 100,000-vbyte OP_RETURN budget, not Roots' aggregate 83-byte budget, and lacks recognized input/witness carriers and cost weighting. L7 adapts detection/budgets; L8 adapts extra policy weight to `TxGraph` fee/weight accounting. Retain Roots `multi-op-return` rejection despite source help conflict. Port `mempool_datacarrier.py`, extra-weight boundaries, tapscript and L5 dust-cost interactions. |
|
|
115
|
+
| policy-dust | adapted / L7,L8 | Core retains `GetDustThreshold` and a 3,000 sat/kvB floor, but has a fixed initialized rate and no `dustdynamic` publication. L7 preserves fixed dust/ephemeral checks. L8 repairs scheduler lifetime and retains estimator/floor behavior and synchronized snapshots; adapt mempool-position estimation to clusters. Run `mempool_dust.py` and changing-publication unit cases. Estimator-unavailable and extreme-multiplier gaps are not passes. |
|
|
116
|
+
| policy-subdust | adapted / L8 | No upstream deficit penalty. Preserve worked contract units, saturation, exemptions and modified-fee accounting without changing actual fee rewards. Adapt policy weight/modified fees consistently through cluster admission, replacement and mining. Port sub-dust tests and L5 arithmetic fuzz/valid-block cases. |
|
|
117
|
+
| policy-replacement | adapted / L8 | Core has unconditional full RBF and cluster feerate-diagram replacement, with enforced TRUC; Roots Never/OptIn/TRUC mode controls are absent. Default full RBF alone is not equivalence. Preserve configured modes, v3 opt-in behavior, fee/resource gates and truthful `fullrbf`; adapt to current replacement algorithms without restoring ancestor indexes. Run RBF/TRUC/package/sibling and policy-block tests. |
|
|
118
|
+
| policy-coinage | adapted / L7 | Relay coin-block age and maturity controls are absent. Reuse available coin heights; add local gates and bounded age arithmetic, never alter consensus coinbase maturity. Preserve disabled defaults and add/retain enabled, boundary and valid-block acceptance cases; the historical dedicated-relay coverage gap is addressed by candidate enabled/disabled, boundary, tip-reorg and valid-block tests. |
|
|
119
|
+
| policy-reuse | adapted / L8 | No upstream `spkreuse` creation/spend tracking or conflict mode. Preserve default allow and explicitly configured local tracking across admission, replacement and reorg. Dedicated functional mode/reorg coverage is still required before claiming equivalence. |
|
|
120
|
+
| mining-template | adapted / L9 | `BlockAssembler::addChunks` replaces ancestor-index assembly. Core's default weight is 4,000,000 with reserved-weight handling and minimum fee 1 sat/kvB, not Roots' 1,200,000 weight / 1,000 sat/kvB / 100,000-byte priority area. Preserve size/weight normalization and coin-age priority while avoiding duplicates and charging ancestor/chunk resources correctly. Port miner boundaries and L5 priority/fee/block-acceptance cases. |
|
|
121
|
+
| peer-controls | adapted / L10 | Core compact reconstruction extras default to 100 entries, with no Roots 10 MB memory bound; orphanage is `node::TxOrphanage`, not the former pool layout. Core whitelist/upload/BIP permissions do not establish forceinbound, explicit compact-filter permission, subnet disconnect or clearnet-v2-only equivalence. Preserve each documented default, malformed-input bound, Tor-bind isolation and SOCKS secret boundary; run extra-tx, permissions, filter, eviction and invalid-message tests. |
|
|
122
|
+
| peer-health | adapted / L10 | Core has current-peer stats/table/details but lacks the complete Roots extra fields and unavailable-state contract. Use existing refresh/interfaces; port stale-detail reset, sort/selection and bounded CPU reporting. Run `rpc_net.py`/Qt apptests and required resolution/font-scale matrix; no collector/history feature. |
|
|
123
|
+
| wallet-foundation | adapted / L11 | Descriptor/SQLite and external signing remain upstream. v31 database enumeration still recursively traverses directories; Roots directory/reparse/permission safeguards remain necessary. `RunCommandParseJSON` now takes an argv vector instead of a shell command string; preserve child-FD closure on this API. Port multiwallet/signer/unit cases, retaining no-BDB-build and locking boundaries. |
|
|
124
|
+
| wallet-rbf | adapted / L11 | Core has a per-send checkbox and sequence override, but initializes the checkbox checked rather than from wallet `walletrbf`. A similar UI is insufficient. Preserve wallet-derived preference, explicit overrides, confirmation and PSBT signaling tests. |
|
|
125
|
+
| wallet-sweep | adapted / L11 | No Core `sweepprivkeys` RPC/dialog. Adapt wallet fee/coin APIs and cancellation through interfaces; preserve WIF/script scope, selected local-key descriptor destination, no import, preview default, locked fee snapshot, transient secure cache/redaction and final broadcast authorization. Run sweep functional/Qt/security-structure tests plus runtime cancellation and visual evidence. |
|
|
126
|
+
| wallet-coin-control | adapted / L11 | Core retains ordinary coin-control/listLockedCoins; it lacks Roots effective/reuse/grouping facts and full invalidation contract. Adapt current wallet output/input-size APIs, preserve visibility/selection filters and conspicuous change validation. Run wallet-send/Qt selection/invalidation/source checks and populated GUI matrix. |
|
|
127
|
+
| runtime-config | adapted / L12 | `common::MergeSettings` contains forced/CLI/JSON/config sources, but no Roots read/write text configuration layer or `confrw`. Insert the existing layer and typed writes into current ArgsManager without a duplicate policy store; preserve network-file/default/negation/list rules. Run getarg/config functional and deferred L7 precedence cases. |
|
|
128
|
+
| operator-stats | kept; uptime adopted-upstream / L12 | `uptime` still returns `TicksSeconds(GetUptime())`; `GetUptime` uses `SteadyClock` initialized at app startup. Its function/schema/clock/defaults are identical in relevant source; upstream adds a wall-clock-jump regression. Both the exact pinned-source acceptance test and current upstream `rpc_uptime.py` pass on the authenticated base. Independent review accepted this narrow sub-aspect, not retirement of the whole contract. Core has no Roots stats model/RPC. Keep the retained stats source dormant: do not register, sample or advertise `getmempoolstats` without a separate compatibility decision. Source GUI/default/help conflict remains a gap. |
|
|
129
|
+
| runtime-resources | adapted / L12 | Core has `GetTotalRAM` and RAM-aware cache sizing, so helper-name similarity cannot retire Roots sizing semantics. Compare exact cache thresholds/units and failure defaults before sub-aspect retirement; preserve Roots byte-safe allocation, FD bounds and platform-scoped advisory helpers where needed. Run RAM/FS/util tests and actual supported-platform checks; unused helpers are not a cross-platform service. |
|
|
121
130
|
| build-portability | adapted / L6 | Core remains CMake/C++20 with wallet/tests enabled, GUI off, embedded LevelDB/secp256k1, optional signer/QR and IPC. It raises GCC/Clang minimums and supplies Qt6-only CMake targets. Carry Roots Qt5/6 selection, required system-library usability probes and native crypto flags on these APIs; missing optional dependencies are explicit gaps. A declared Tor-subprocess switch has no source consumer and must stay a non-feature, not become an automatic launcher. MiniUPnPc build support must not imply a missing runtime consumer. |
|
|
122
|
-
| identity-desktop | adapted / L11 | Core version/icons/help remain Core; Roots identity, QR-PNG export and Windows taskbar support are not equivalent. Port limited identity/desktop changes while preserving upstream names/protocol attribution. Generate manuals/config from final help only; run version, Qt QR/icon and Windows/platform/visual gates. |
|
|
123
|
-
| maintenance-ci | adapted / L11 | Core's v31 compiler/platform/cluster fixtures supersede old job assumptions; Roots classifier, exact promotion proof and platform/fuzz scheduling need adaptation. Retain actual exact-candidate CI gates and bounded corpora scheduling; run maintained tool tests and supported candidate profiles. |
|
|
124
|
-
| maintenance-release | adapted / L11 | Upstream does not provide Roots immutable source/tag/assets, signed new-draft-only five-platform release, portable export or contributor-credit rules. Adapt version/base validation and replay without publishing/tagging. Retain `.github` exclusions and `git am -3 --keep-cr`; test temporary export/replay and all release tools. Expanded notices remain deferred. |
|
|
125
|
-
| maintenance-docs | adapted / L6,L11,L12 | Carry accepted contracts first with explicit deferred status, reconcile catalog/privacy/provenance to actual candidate, generate help artifacts when interfaces land, and complete review evidence last. Historical release notes are provenance, not a v31 feature claim. Check links/doc lint/whitespace and generated-output parity. |
|
|
131
|
+
| identity-desktop | adapted / L13 | Core version/icons/help remain Core; Roots identity, QR-PNG export and Windows taskbar support are not equivalent. Port limited identity/desktop changes while preserving upstream names/protocol attribution. Generate manuals/config from final help only; run version, Qt QR/icon and Windows/platform/visual gates. |
|
|
132
|
+
| maintenance-ci | adapted / L13 | Core's v31 compiler/platform/cluster fixtures supersede old job assumptions; Roots classifier, exact promotion proof and platform/fuzz scheduling need adaptation. Retain actual exact-candidate CI gates and bounded corpora scheduling; run maintained tool tests and supported candidate profiles. |
|
|
133
|
+
| maintenance-release | adapted / L13 | Upstream does not provide Roots immutable source/tag/assets, signed new-draft-only five-platform release, portable export or contributor-credit rules. Adapt version/base validation and replay without publishing/tagging. Retain `.github` exclusions and `git am -3 --keep-cr`; test temporary export/replay and all release tools. Expanded notices remain deferred. |
|
|
134
|
+
| maintenance-docs | adapted / L6,L13,L14 | Carry accepted contracts first with explicit deferred status, reconcile catalog/privacy/provenance to actual candidate, generate help artifacts when interfaces land, and complete review evidence last. Historical release notes are provenance, not a v31 feature claim. Check links/doc lint/whitespace and generated-output parity. |
|
|
126
135
|
| maintenance-native | adapted / owning theme | Inspect every surviving source hunk; keep behavior-preserving C++/empty-write/test hooks only where needed on v31 APIs. Port test fixtures with their features rather than overwriting newer Core tests. Transient reverted script work is not a new consensus feature. Run affected unit/functional/fuzz gates. |
|
|
127
136
|
|
|
128
137
|
The shared consensus-neutral and no-RDTS boundaries apply to every row. Contract
|
|
@@ -141,31 +150,31 @@ instructions to replay whole commits. Aggregate commits must include the full
|
|
|
141
150
|
|
|
142
151
|
| Source commits | Owning themes and treatment |
|
|
143
152
|
| --- | --- |
|
|
144
|
-
| `5c210e17fb` | L6 build/dependency support; L11 platform CI/release integration. Adapt required probes, not old generated summaries. |
|
|
145
|
-
| `85257a0986`, `724f8c2ee7` | L7 policy utility dependencies; L8 peer diagnostics; L9 signer boundary; L10 config/runtime/stats support. Split mixed runtime content by contract; preserve dormant status. |
|
|
146
|
-
| `1b73fe3d21`, `ec9db369f5` | L7 policy/mining/dust/replacement and broad functional fixtures; L8 peer controls; L9 wallet boundary fixes/fixtures; L10 runtime dependencies; L11 CI test-script integration. Adapt actual surviving deltas to clusters/interfaces. |
|
|
147
|
-
| `dd03dcb989` | L9 database/SQLite/signer hardening, adapted. |
|
|
148
|
-
| `c592888088` | L6 Qt build support; L8 peer view; L9 wallet GUI support; L11 identity/QR/taskbar. Split mixed GUI content without importing incidental upstream text. |
|
|
149
|
-
| `fc0dc945d0` | L7 feature-owned dust/sub-dust/sigop/TRUC tests, plus L8 peer fixtures and L10 operator tests where present. Preserve tests' actual feature ownership. |
|
|
150
|
-
| `9f1780f330`, `4570a6a547` | L6 necessary build registration; L11 assurance/CI/release tooling and fixtures; owning-feature tests across L7–L10. No replacement maintenance state system. |
|
|
151
|
-
| `9da5851410`, `26b691e4f3`, `201927c151`, `e819a07a4a`, `56e2894760` | L11 CI scheduling, apt-retry, optional-feature selection and branded archive checks; adapt to v31 jobs. |
|
|
152
|
-
| `83fa42a963`, `f5182f0e3a`, `7791eede50`, `11c84c39ef`, `0efa437e29`, `f2595557d9`, `38bc7ec2ce`, `df8aa8e2b7`, `ddae467a78`, `778ff50d19`, `c474825f96`, `17e1d484ab` | L11 release/rehearsal/source/archives/signing/new-draft/promotion CI and notice deferral; preserve final safeguards, fold corrective history. `f5182f0e3a` also supplies L9 sweep/privacy boundary tests and L10 safe-empty-stream writes/tests, plus L11 apt/sanitizer checks. No releases dispatched. |
|
|
153
|
-
| `25f889f97e`, `3e13c1f213` | L11 Windows icon and QR QString-size corrections, kept/adapted with identity. |
|
|
154
|
-
| `b0b235d6a1`, `f4066e5282`, `30f673a4bc`, `a13f28e2f4`, `1517d925b2`, `628bdf4e38`, `02464df449`, `089888acdd` | L6/L11/L12 catalog, scope, historical notes and provenance; rewrite candidate claims for actual implementation, retain relevant history/credit. |
|
|
155
|
-
| `bbd7339af2`, `9b778b9a23` | L8 peer stale-state fix/apptests; L10 streams assertion fixtures and L11 QR/build GUI assertions from the mixed test commit. |
|
|
156
|
-
| `e4b26462de`, `0e3ae72d89` | L9 wallet-derived per-send RBF and locked Qt assertions, adapted. |
|
|
153
|
+
| `5c210e17fb` | L6 build/dependency support; L13 platform CI/release integration. Adapt required probes, not old generated summaries. |
|
|
154
|
+
| `85257a0986`, `724f8c2ee7` | L7–L9 policy utility dependencies; L10 peer diagnostics; L11 signer boundary; L12 config/runtime/stats support. Split mixed runtime content by contract; preserve dormant status. |
|
|
155
|
+
| `1b73fe3d21`, `ec9db369f5` | L7 local checks; L8 accounting/dynamic dust/replacement; L9 mining and broad functional fixtures; L10 peer controls; L11 wallet boundary fixes/fixtures; L12 runtime dependencies; L13 CI test-script integration. Adapt actual surviving deltas to clusters/interfaces. |
|
|
156
|
+
| `dd03dcb989` | L11 database/SQLite/signer hardening, adapted. |
|
|
157
|
+
| `c592888088` | L6 Qt build support; L10 peer view; L11 wallet GUI support; L13 identity/QR/taskbar. Split mixed GUI content without importing incidental upstream text. |
|
|
158
|
+
| `fc0dc945d0` | L7 fixed-dust/sigop tests; L8 sub-dust/TRUC tests, plus L10 peer fixtures and L12 operator tests where present. Preserve tests' actual feature ownership. |
|
|
159
|
+
| `9f1780f330`, `4570a6a547` | L6 necessary build registration; L13 assurance/CI/release tooling and fixtures; owning-feature tests across L7–L12. No replacement maintenance state system. |
|
|
160
|
+
| `9da5851410`, `26b691e4f3`, `201927c151`, `e819a07a4a`, `56e2894760` | L13 CI scheduling, apt-retry, optional-feature selection and branded archive checks; adapt to v31 jobs. |
|
|
161
|
+
| `83fa42a963`, `f5182f0e3a`, `7791eede50`, `11c84c39ef`, `0efa437e29`, `f2595557d9`, `38bc7ec2ce`, `df8aa8e2b7`, `ddae467a78`, `778ff50d19`, `c474825f96`, `17e1d484ab` | L13 release/rehearsal/source/archives/signing/new-draft/promotion CI and notice deferral; preserve final safeguards, fold corrective history. `f5182f0e3a` also supplies L11 sweep/privacy boundary tests and L12 safe-empty-stream writes/tests, plus L13 apt/sanitizer checks. No releases dispatched. |
|
|
162
|
+
| `25f889f97e`, `3e13c1f213` | L13 Windows icon and QR QString-size corrections, kept/adapted with identity. |
|
|
163
|
+
| `b0b235d6a1`, `f4066e5282`, `30f673a4bc`, `a13f28e2f4`, `1517d925b2`, `628bdf4e38`, `02464df449`, `089888acdd` | L6/L13/L14 catalog, scope, historical notes and provenance; rewrite candidate claims for actual implementation, retain relevant history/credit. |
|
|
164
|
+
| `bbd7339af2`, `9b778b9a23` | L10 peer stale-state fix/apptests; L12 streams assertion fixtures and L13 QR/build GUI assertions from the mixed test commit. |
|
|
165
|
+
| `e4b26462de`, `0e3ae72d89` | L11 wallet-derived per-send RBF and locked Qt assertions, adapted. |
|
|
157
166
|
| `5e2d79e937` | L7 `node/mempool_args.cpp` string-view prefix modernization, adapted only where the parser remains; no consensus feature. |
|
|
158
|
-
| `fb21288879`, `dc1b217cbd`, `9a216bc389`, `7c70374050`, `f3cd7da535`, `96fecfd411`, `a1748ccc64`, `f9e9a36cd1` | L9 sweep RPC/GUI, coin-control facts, documentation, asynchronous authorization, locked fee snapshot and secret cleansing. Fold security corrections into final feature. |
|
|
159
|
-
| `875fa15829`, `9ab60f217b`, `9d9c125d9e` | L7 priority-selected ancestor/resource correctness and locale-independent regression fixtures, adapted to chunk mining. |
|
|
160
|
-
| `aa27c9117a`, `48f3b3bbe8`, `a6f35e915c` | L7 configured RBF/TRUC semantics and tests; L10 truthful RPC field; L11 final generated help. |
|
|
161
|
-
| `30e7eac266`, `12d67ba60a`, `e6d4abc704`, `085a84a7cb`, `8cb07ef1b9` | L7/L8/L10 feature-owned full-suite, Taproot-carrier, fee-estimator and startup fixtures; adapt to current APIs without erasing upstream regressions. |
|
|
162
|
-
| `1f7cfce176` | L11 regenerate manuals/example configuration from final help, not source-byte replay. |
|
|
163
|
-
| `16b2198275`, `47329c00dd`, `1b2431c74c` | L6 native crypto flags, exact MiniUPnPc dependency patch and usable system LevelDB memory environment; the Chain interface include and mempool/1p1c lint fixtures follow L7/L8. |
|
|
164
|
-
| `784b2af17a`, `f74cc0433b`, `73c97862e2` | L7 synchronized dynamic-dust publication/snapshot and changing-rate tests; consumers in L10 report the same authoritative state. |
|
|
167
|
+
| `fb21288879`, `dc1b217cbd`, `9a216bc389`, `7c70374050`, `f3cd7da535`, `96fecfd411`, `a1748ccc64`, `f9e9a36cd1` | L11 sweep RPC/GUI, coin-control facts, documentation, asynchronous authorization, locked fee snapshot and secret cleansing. Fold security corrections into final feature. |
|
|
168
|
+
| `875fa15829`, `9ab60f217b`, `9d9c125d9e` | L9 priority-selected ancestor/resource correctness and locale-independent regression fixtures, adapted to chunk mining. |
|
|
169
|
+
| `aa27c9117a`, `48f3b3bbe8`, `a6f35e915c` | L8 configured RBF/TRUC semantics and tests; L12 truthful RPC field; L13 final generated help. |
|
|
170
|
+
| `30e7eac266`, `12d67ba60a`, `e6d4abc704`, `085a84a7cb`, `8cb07ef1b9` | L7–L10/L12 feature-owned full-suite, Taproot-carrier, fee-estimator and startup fixtures; adapt to current APIs without erasing upstream regressions. |
|
|
171
|
+
| `1f7cfce176` | L13 regenerate manuals/example configuration from final help, not source-byte replay. |
|
|
172
|
+
| `16b2198275`, `47329c00dd`, `1b2431c74c` | L6 native crypto flags, exact MiniUPnPc dependency patch and usable system LevelDB memory environment; the Chain interface include and mempool/1p1c lint fixtures follow L7/L10. |
|
|
173
|
+
| `784b2af17a`, `f74cc0433b`, `73c97862e2` | L8 synchronized dynamic-dust publication/snapshot and changing-rate tests; consumers in L12 report the same authoritative state. |
|
|
165
174
|
| `f66eca4ae4` | L6 accepted stable contract collection and source/provenance reconciliation. |
|
|
166
175
|
| `87c950de92` | L7 strict policy grammar, scoped help/diagnostics and parser/startup tests; distinct source behavior change. |
|
|
167
|
-
| `b60a6e04d0` | L10 additive effective-policy RPC/schema/parity tests; distinct source API change. |
|
|
168
|
-
| `10d772eb7f` | L7 valid-block/carrier/penalty/priority interactions and parser/arithmetic fuzz boundaries; L6 retains documented gaps until tests are ported. |
|
|
176
|
+
| `b60a6e04d0` | L12 additive effective-policy RPC/schema/parity tests; distinct source API change. |
|
|
177
|
+
| `10d772eb7f` | L7 local valid-block/carrier interactions and parser fuzz; L8 penalty/carrier arithmetic and fuzz; L9 priority/fee/template interactions; L6 retains documented gaps until tests are ported. |
|
|
169
178
|
|
|
170
179
|
Source-range authors are Jaromil and devjoinedthechat. Preserve their existing
|
|
171
180
|
copyright/credit and upstream Core/Knots lineage; use retained source authorship
|
|
@@ -290,3 +299,59 @@ because `capnp` is unavailable, so IPC interface runtime coverage is not claimed
|
|
|
290
299
|
Documentation option lint, local links/anchors and whitespace checks pass.
|
|
291
300
|
The required real Qt 5/6 GUI configure/build/test gate now passes. Foundation
|
|
292
301
|
changes remain uncommitted for independent review.
|
|
302
|
+
|
|
303
|
+
## L7 local policy verification
|
|
304
|
+
|
|
305
|
+
The approved narrowed L7 adapts scoped parsing and local checks. Candidate
|
|
306
|
+
links are collected in [the policy catalog](roots-features.md#local-policy-and-mining)
|
|
307
|
+
and [the parsing contract](feature-contracts/policy-parsing.md). The source
|
|
308
|
+
`policy_args` fuzz harness from
|
|
309
|
+
`10d772eb7f4b00b5193428a0dde4c06558d6c297` is retained, and native transaction
|
|
310
|
+
fuzzing now calls carrier recognition. Native overloads keep their existing
|
|
311
|
+
signatures and use the Roots defaults; their non-production callers are unit
|
|
312
|
+
and fuzz tests. Production admission supplies the initialized option snapshot.
|
|
313
|
+
|
|
314
|
+
Admission maturity uses next-block depth, with unconfirmed inputs contributing
|
|
315
|
+
zero age. Coin-block accumulation caps at the configured bound before each
|
|
316
|
+
multiplication/addition, preserving the integer boundary without floating-point
|
|
317
|
+
rounding or an ancestor/priority cache. Fresh admission after a tip reorg is
|
|
318
|
+
covered. Carrier checks remain independent of the general standardness switch;
|
|
319
|
+
full counting and nonstandard-carrier permission are tested separately.
|
|
320
|
+
|
|
321
|
+
All added rejection paths stay in local policy or `MemPoolAccept::PreChecks`.
|
|
322
|
+
`ConnectBlock`, consensus input/script checks and flags, actual fee/reward
|
|
323
|
+
accounting, native TxGraph and mining implementations have no L7 changes.
|
|
324
|
+
Consensus-valid block fixtures cover locally rejected CAT21, bare pubkey,
|
|
325
|
+
unknown-witness outputs, token markers, multiple OP_RETURN, dust, carrier and
|
|
326
|
+
relay-age transactions. Native script/package/cache/wallet-notification tests
|
|
327
|
+
retain their assertions with explicit raw-pubkey fixture allowances and precise
|
|
328
|
+
rejection reasons. Resource tests retain their upstream cluster/package/TRUC/RBF
|
|
329
|
+
and mining assertions with explicit carrier/script budgets across restarts;
|
|
330
|
+
multi-OP_RETURN tests assert Roots rejection and Core's nonstandard override.
|
|
331
|
+
Fee-estimator and RBF low-feerate fixtures explicitly select their sampling range.
|
|
332
|
+
|
|
333
|
+
The remaining default headless functional suite is also covered, beyond the
|
|
334
|
+
selected policy filter. Its block resurrection, CSV/DER, orphan/package,
|
|
335
|
+
burn-accounting RPC and large wallet-script fixtures retain their original
|
|
336
|
+
assertions with explicit allowances for their constructed outputs and padding.
|
|
337
|
+
The IBD fee-filter fixture uses the buckets produced by the unchanged native
|
|
338
|
+
rounder from the Roots default relay fee. Full native units, non-Boost CTest
|
|
339
|
+
gates, and the applicable functional tests pass; optional-feature/environment
|
|
340
|
+
skips remain gaps. The bounded Clang ASan/UBSan campaigns cover parser,
|
|
341
|
+
transaction/carrier and native input/witness callers, not the L8/L9 extensions.
|
|
342
|
+
|
|
343
|
+
L5 interaction ownership remains bounded:
|
|
344
|
+
|
|
345
|
+
| Source coverage | Candidate disposition/remaining owner |
|
|
346
|
+
| --- | --- |
|
|
347
|
+
| Parser grammar, types, negation, cost and dynamic syntax round trips | L7 unit/startup and actual sanitizer fuzz; no dynamic runtime claim. |
|
|
348
|
+
| Fixed dust thresholds, ephemeral/local standardness, carrier budgets and valid blocks | L7 focused tests and broader native regression fixtures. |
|
|
349
|
+
| Subdust deficit rounding/saturation, carrier extra weight, fee deltas, replacement/package/TRUC/reuse combinations | L8; existing source methods and arithmetic fuzz remain required gates. L7's native regression runs do not establish these Roots extensions. |
|
|
350
|
+
| Dynamic startup, publication, estimator fallback, extreme scaling and retry/shutdown | Authorized bounded L8 repair, still deferred; default off remains unchanged. |
|
|
351
|
+
| Priority ancestors, residual mining, template normalization, actual-versus-modified reward interactions | L9, including source L5 joint mining/block fixtures; native mining passes are regression evidence only. |
|
|
352
|
+
| Integrated Roots confrw precedence | L12 only; ordinary CLI/config/JSON cases run in L7. |
|
|
353
|
+
|
|
354
|
+
Prior-release mempool compatibility remains skipped because release fixtures are
|
|
355
|
+
unavailable. External script-assets and other previously recorded optional
|
|
356
|
+
matrix dependencies are not represented as passes. Final L7 acceptance and the
|
|
357
|
+
later full candidate integration matrix remain separate review gates.
|