Skip to content
Bitcoin Roots

v31.1-roots.1 · Commit 2: [PATCH 02/17] feat(policy): preserve Roots parsing and local transaction checks

doc/roots-v31-port-review.md

Before: doc/roots-v31-port-review.md · After: doc/roots-v31-port-review.md

File metadata
index 62f5cb6c57c70a2641fa6ef084f2d44f8f59b95c..2796361ade6b2488e3e8b82ace51eba606ff45dc 100644

Download original patch · Release notes

Diff rows 1–229 of 229. Line numbers refer to the original before/after files.

+ Added− RemovedUnmarked lines are context.

Scroll the code area horizontally to read long lines. Before is on the left; after is on the right. Unified view fits narrow screens more easily.

doc/roots-v31-port-review.md CHANGED
@@ -57,7 +57,9 @@ not a Roots-series merge.
57
 
58
  ## Proposed smaller series and dependencies
59
 
60
- Retain the seven-theme target: **7 instead of 72 commits**. Historical fixes,
 
 
61
  tests and documentation travel with the behavior they correct; release/CI work
62
  travels with maintenance, rather than recreating chronological fixup commits.
63
  No broad compatibility layer is proposed.
@@ -65,28 +67,35 @@ No broad compatibility layer is proposed.
65
  | Theme | Owning scope and prerequisite |
66
  | --- | --- |
67
  | L6 build/portability | Dependency probes and supported switches; contract documents and this review. Establishes the foundation only. |
68
- | L7 local policy/mining | Admission, replacement, carrier/dust/coinage/reuse, strict parsing, mining, interaction/fuzz coverage. Requires L6. |
69
- | L8 peers | Resource/permission controls and current-connection health; GUI/functional coverage. Requires L7 and L6. |
70
- | L9 wallet | Database/signer boundaries, per-send RBF, sweep authorization/secrets and coin-control facts. Requires L8. |
71
- | L10 operator/runtime | Read/write config, effective-policy RPC and platform resource support; dormant stats remain dormant. Requires L7 state and L9. |
72
- | L11 integration | Identity/icons/QR/taskbar, generated help artifacts, CI and release/export tools. Requires L10. |
73
- | L12 evidence | Final preservation review, range comparison and exact-candidate supported gates. Requires L6–L11. |
74
-
75
- The largest adaptation is L7: v31 uses `TxGraph` clusters and chunk-based mining,
76
- not the old ancestor-index selection model. L9 carries distinct security
77
- boundaries but its L2 divisions separate foundation from sweep/coin control.
78
- The old-to-upstream aggregate wallet/Qt diff includes thousands of unrelated
79
- upstream lines and is not a port-size estimate. No implementation has established
80
- that these themes need a split yet. Reassess the actual proposed diff and
81
- feature-owned tests before L7/L9 execution; revise milestones first if their
82
- independent risks cannot be reviewed safely in one thematic commit. Seven is
83
- a target, not permission to hide unreviewable coupling.
84
-
85
- `runtime-config` is an L10 implementation dependency of L7 parsing and L9 sweep.
 
 
 
 
 
 
 
86
  Until then, feature tests must cover Core CLI/config semantics and explicitly
87
  defer Roots `confrw` precedence cases; they cannot claim those cases passed.
88
- The full precedence gate runs when L10 lands. Feature-local tests still ship
89
- with each implementation; L12 is additional aggregate evidence.
90
 
91
  ## Contract dispositions against actual v31.1 APIs
92
 
@@ -99,30 +108,30 @@ contract with remaining Roots behavior. Existing source gaps remain explicit.
99
 
100
  | Contract | Disposition / theme | Upstream comparison, adaptation and acceptance gate |
101
  | --- | --- | --- |
102
- | policy-parsing | adapted / L7 | `node::ApplyArgsManOptions` now consumes cluster limits; Roots policy parser and grammar are absent. Preserve L2's complete-token/range/diagnostic decisions, quarter-vbyte rounding and CLI/config precedence. Port parser unit/startup tests and L5 fuzz boundaries; complete read/write precedence in L10. |
103
- | effective-policy | adapted / L10 | `getmempoolinfo` has cluster-era size/fee information but no Roots `policy` object. Read authoritative initialized v31 state plus synchronized dynamic dust; retain L3's schema, units and enforcement gates. Port `rpc_effective_policy.py`, help and admission parity assertions. L4 supplied no snapshot refactor to carry. |
104
  | policy-standardness | adapted / L7 | Core `IsStandardTx` takes carrier budget, bare-multisig flag and dust rate. Core permits bare multisig by default and lacks Roots configurable script/witness, strict sigop, CAT21/token and ephemeral modes. Preserve Roots limits/defaults/reasons solely in local gates. Run transaction/sigop/TRUC cases and valid-block fixtures; do not change script consensus. |
105
- | policy-carrier | adapted / L7 | Core defaults to a 100,000-vbyte OP_RETURN budget, not Roots' aggregate 83-byte budget, and lacks recognized input/witness carriers and cost weighting. Adapt detection/extra policy weight to `TxGraph` fee/weight accounting. Retain Roots `multi-op-return` rejection despite source help conflict. Port `mempool_datacarrier.py`, extra-weight boundaries, tapscript and L5 dust-cost interactions. |
106
- | policy-dust | adapted / L7 | Core retains `GetDustThreshold` and a 3,000 sat/kvB floor, but has a fixed initialized rate and no `dustdynamic` publication. Retain scheduler, estimator/floor behavior and synchronized snapshots; adapt mempool-position estimation to clusters. Run `mempool_dust.py` and changing-publication unit cases. Estimator-unavailable and extreme-multiplier gaps are not passes. |
107
- | policy-subdust | adapted / L7 | No upstream deficit penalty. Preserve worked contract units, saturation, exemptions and modified-fee accounting without changing actual fee rewards. Adapt policy weight/modified fees consistently through cluster admission, replacement and mining. Port sub-dust tests and L5 arithmetic fuzz/valid-block cases. |
108
- | policy-replacement | adapted / L7 | Core has unconditional full RBF and cluster feerate-diagram replacement, with enforced TRUC; Roots Never/OptIn/TRUC mode controls are absent. Default full RBF alone is not equivalence. Preserve configured modes, v3 opt-in behavior, fee/resource gates and truthful `fullrbf`; adapt to current replacement algorithms without restoring ancestor indexes. Run RBF/TRUC/package/sibling and policy-block tests. |
109
- | policy-coinage | adapted / L7 | Relay coin-block age and maturity controls are absent. Reuse available coin heights; add local gates and bounded age arithmetic, never alter consensus coinbase maturity. Preserve disabled defaults and add/retain enabled, boundary and valid-block acceptance cases; prior dedicated relay coverage remains a gap. |
110
- | policy-reuse | adapted / L7 | No upstream `spkreuse` creation/spend tracking or conflict mode. Preserve default allow and explicitly configured local tracking across admission, replacement and reorg. Dedicated functional mode/reorg coverage is still required before claiming equivalence. |
111
- | mining-template | adapted / L7 | `BlockAssembler::addChunks` replaces ancestor-index assembly. Core's default weight is 4,000,000 with reserved-weight handling and minimum fee 1 sat/kvB, not Roots' 1,200,000 weight / 1,000 sat/kvB / 100,000-byte priority area. Preserve size/weight normalization and coin-age priority while avoiding duplicates and charging ancestor/chunk resources correctly. Port miner boundaries and L5 priority/fee/block-acceptance cases. |
112
- | peer-controls | adapted / L8 | Core compact reconstruction extras default to 100 entries, with no Roots 10 MB memory bound; orphanage is `node::TxOrphanage`, not the former pool layout. Core whitelist/upload/BIP permissions do not establish forceinbound, explicit compact-filter permission, subnet disconnect or clearnet-v2-only equivalence. Preserve each documented default, malformed-input bound, Tor-bind isolation and SOCKS secret boundary; run extra-tx, permissions, filter, eviction and invalid-message tests. |
113
- | peer-health | adapted / L8 | Core has current-peer stats/table/details but lacks the complete Roots extra fields and unavailable-state contract. Use existing refresh/interfaces; port stale-detail reset, sort/selection and bounded CPU reporting. Run `rpc_net.py`/Qt apptests and required resolution/font-scale matrix; no collector/history feature. |
114
- | wallet-foundation | adapted / L9 | Descriptor/SQLite and external signing remain upstream. v31 database enumeration still recursively traverses directories; Roots directory/reparse/permission safeguards remain necessary. `RunCommandParseJSON` now takes an argv vector instead of a shell command string; preserve child-FD closure on this API. Port multiwallet/signer/unit cases, retaining no-BDB-build and locking boundaries. |
115
- | wallet-rbf | adapted / L9 | Core has a per-send checkbox and sequence override, but initializes the checkbox checked rather than from wallet `walletrbf`. A similar UI is insufficient. Preserve wallet-derived preference, explicit overrides, confirmation and PSBT signaling tests. |
116
- | wallet-sweep | adapted / L9 | No Core `sweepprivkeys` RPC/dialog. Adapt wallet fee/coin APIs and cancellation through interfaces; preserve WIF/script scope, selected local-key descriptor destination, no import, preview default, locked fee snapshot, transient secure cache/redaction and final broadcast authorization. Run sweep functional/Qt/security-structure tests plus runtime cancellation and visual evidence. |
117
- | wallet-coin-control | adapted / L9 | Core retains ordinary coin-control/listLockedCoins; it lacks Roots effective/reuse/grouping facts and full invalidation contract. Adapt current wallet output/input-size APIs, preserve visibility/selection filters and conspicuous change validation. Run wallet-send/Qt selection/invalidation/source checks and populated GUI matrix. |
118
- | runtime-config | adapted / L10 | `common::MergeSettings` contains forced/CLI/JSON/config sources, but no Roots read/write text configuration layer or `confrw`. Insert the existing layer and typed writes into current ArgsManager without a duplicate policy store; preserve network-file/default/negation/list rules. Run getarg/config functional and deferred L7 precedence cases. |
119
- | operator-stats | kept; uptime adopted-upstream / L10 | `uptime` still returns `TicksSeconds(GetUptime())`; `GetUptime` uses `SteadyClock` initialized at app startup. Its function/schema/clock/defaults are identical in relevant source; upstream adds a wall-clock-jump regression. Both the exact pinned-source acceptance test and current upstream `rpc_uptime.py` pass on the authenticated base. Independent review accepted this narrow sub-aspect, not retirement of the whole contract. Core has no Roots stats model/RPC. Keep the retained stats source dormant: do not register, sample or advertise `getmempoolstats` without a separate compatibility decision. Source GUI/default/help conflict remains a gap. |
120
- | runtime-resources | adapted / L10 | Core has `GetTotalRAM` and RAM-aware cache sizing, so helper-name similarity cannot retire Roots sizing semantics. Compare exact cache thresholds/units and failure defaults before sub-aspect retirement; preserve Roots byte-safe allocation, FD bounds and platform-scoped advisory helpers where needed. Run RAM/FS/util tests and actual supported-platform checks; unused helpers are not a cross-platform service. |
121
  | build-portability | adapted / L6 | Core remains CMake/C++20 with wallet/tests enabled, GUI off, embedded LevelDB/secp256k1, optional signer/QR and IPC. It raises GCC/Clang minimums and supplies Qt6-only CMake targets. Carry Roots Qt5/6 selection, required system-library usability probes and native crypto flags on these APIs; missing optional dependencies are explicit gaps. A declared Tor-subprocess switch has no source consumer and must stay a non-feature, not become an automatic launcher. MiniUPnPc build support must not imply a missing runtime consumer. |
122
- | identity-desktop | adapted / L11 | Core version/icons/help remain Core; Roots identity, QR-PNG export and Windows taskbar support are not equivalent. Port limited identity/desktop changes while preserving upstream names/protocol attribution. Generate manuals/config from final help only; run version, Qt QR/icon and Windows/platform/visual gates. |
123
- | maintenance-ci | adapted / L11 | Core's v31 compiler/platform/cluster fixtures supersede old job assumptions; Roots classifier, exact promotion proof and platform/fuzz scheduling need adaptation. Retain actual exact-candidate CI gates and bounded corpora scheduling; run maintained tool tests and supported candidate profiles. |
124
- | maintenance-release | adapted / L11 | Upstream does not provide Roots immutable source/tag/assets, signed new-draft-only five-platform release, portable export or contributor-credit rules. Adapt version/base validation and replay without publishing/tagging. Retain `.github` exclusions and `git am -3 --keep-cr`; test temporary export/replay and all release tools. Expanded notices remain deferred. |
125
- | maintenance-docs | adapted / L6,L11,L12 | Carry accepted contracts first with explicit deferred status, reconcile catalog/privacy/provenance to actual candidate, generate help artifacts when interfaces land, and complete review evidence last. Historical release notes are provenance, not a v31 feature claim. Check links/doc lint/whitespace and generated-output parity. |
126
  | maintenance-native | adapted / owning theme | Inspect every surviving source hunk; keep behavior-preserving C++/empty-write/test hooks only where needed on v31 APIs. Port test fixtures with their features rather than overwriting newer Core tests. Transient reverted script work is not a new consensus feature. Run affected unit/functional/fuzz gates. |
127
 
128
  The shared consensus-neutral and no-RDTS boundaries apply to every row. Contract
@@ -141,31 +150,31 @@ instructions to replay whole commits. Aggregate commits must include the full
141
 
142
  | Source commits | Owning themes and treatment |
143
  | --- | --- |
144
- | `5c210e17fb` | L6 build/dependency support; L11 platform CI/release integration. Adapt required probes, not old generated summaries. |
145
- | `85257a0986`, `724f8c2ee7` | L7 policy utility dependencies; L8 peer diagnostics; L9 signer boundary; L10 config/runtime/stats support. Split mixed runtime content by contract; preserve dormant status. |
146
- | `1b73fe3d21`, `ec9db369f5` | L7 policy/mining/dust/replacement and broad functional fixtures; L8 peer controls; L9 wallet boundary fixes/fixtures; L10 runtime dependencies; L11 CI test-script integration. Adapt actual surviving deltas to clusters/interfaces. |
147
- | `dd03dcb989` | L9 database/SQLite/signer hardening, adapted. |
148
- | `c592888088` | L6 Qt build support; L8 peer view; L9 wallet GUI support; L11 identity/QR/taskbar. Split mixed GUI content without importing incidental upstream text. |
149
- | `fc0dc945d0` | L7 feature-owned dust/sub-dust/sigop/TRUC tests, plus L8 peer fixtures and L10 operator tests where present. Preserve tests' actual feature ownership. |
150
- | `9f1780f330`, `4570a6a547` | L6 necessary build registration; L11 assurance/CI/release tooling and fixtures; owning-feature tests across L7–L10. No replacement maintenance state system. |
151
- | `9da5851410`, `26b691e4f3`, `201927c151`, `e819a07a4a`, `56e2894760` | L11 CI scheduling, apt-retry, optional-feature selection and branded archive checks; adapt to v31 jobs. |
152
- | `83fa42a963`, `f5182f0e3a`, `7791eede50`, `11c84c39ef`, `0efa437e29`, `f2595557d9`, `38bc7ec2ce`, `df8aa8e2b7`, `ddae467a78`, `778ff50d19`, `c474825f96`, `17e1d484ab` | L11 release/rehearsal/source/archives/signing/new-draft/promotion CI and notice deferral; preserve final safeguards, fold corrective history. `f5182f0e3a` also supplies L9 sweep/privacy boundary tests and L10 safe-empty-stream writes/tests, plus L11 apt/sanitizer checks. No releases dispatched. |
153
- | `25f889f97e`, `3e13c1f213` | L11 Windows icon and QR QString-size corrections, kept/adapted with identity. |
154
- | `b0b235d6a1`, `f4066e5282`, `30f673a4bc`, `a13f28e2f4`, `1517d925b2`, `628bdf4e38`, `02464df449`, `089888acdd` | L6/L11/L12 catalog, scope, historical notes and provenance; rewrite candidate claims for actual implementation, retain relevant history/credit. |
155
- | `bbd7339af2`, `9b778b9a23` | L8 peer stale-state fix/apptests; L10 streams assertion fixtures and L11 QR/build GUI assertions from the mixed test commit. |
156
- | `e4b26462de`, `0e3ae72d89` | L9 wallet-derived per-send RBF and locked Qt assertions, adapted. |
157
  | `5e2d79e937` | L7 `node/mempool_args.cpp` string-view prefix modernization, adapted only where the parser remains; no consensus feature. |
158
- | `fb21288879`, `dc1b217cbd`, `9a216bc389`, `7c70374050`, `f3cd7da535`, `96fecfd411`, `a1748ccc64`, `f9e9a36cd1` | L9 sweep RPC/GUI, coin-control facts, documentation, asynchronous authorization, locked fee snapshot and secret cleansing. Fold security corrections into final feature. |
159
- | `875fa15829`, `9ab60f217b`, `9d9c125d9e` | L7 priority-selected ancestor/resource correctness and locale-independent regression fixtures, adapted to chunk mining. |
160
- | `aa27c9117a`, `48f3b3bbe8`, `a6f35e915c` | L7 configured RBF/TRUC semantics and tests; L10 truthful RPC field; L11 final generated help. |
161
- | `30e7eac266`, `12d67ba60a`, `e6d4abc704`, `085a84a7cb`, `8cb07ef1b9` | L7/L8/L10 feature-owned full-suite, Taproot-carrier, fee-estimator and startup fixtures; adapt to current APIs without erasing upstream regressions. |
162
- | `1f7cfce176` | L11 regenerate manuals/example configuration from final help, not source-byte replay. |
163
- | `16b2198275`, `47329c00dd`, `1b2431c74c` | L6 native crypto flags, exact MiniUPnPc dependency patch and usable system LevelDB memory environment; the Chain interface include and mempool/1p1c lint fixtures follow L7/L8. |
164
- | `784b2af17a`, `f74cc0433b`, `73c97862e2` | L7 synchronized dynamic-dust publication/snapshot and changing-rate tests; consumers in L10 report the same authoritative state. |
165
  | `f66eca4ae4` | L6 accepted stable contract collection and source/provenance reconciliation. |
166
  | `87c950de92` | L7 strict policy grammar, scoped help/diagnostics and parser/startup tests; distinct source behavior change. |
167
- | `b60a6e04d0` | L10 additive effective-policy RPC/schema/parity tests; distinct source API change. |
168
- | `10d772eb7f` | L7 valid-block/carrier/penalty/priority interactions and parser/arithmetic fuzz boundaries; L6 retains documented gaps until tests are ported. |
169
 
170
  Source-range authors are Jaromil and devjoinedthechat. Preserve their existing
171
  copyright/credit and upstream Core/Knots lineage; use retained source authorship
@@ -290,3 +299,59 @@ because `capnp` is unavailable, so IPC interface runtime coverage is not claimed
290
  Documentation option lint, local links/anchors and whitespace checks pass.
291
  The required real Qt 5/6 GUI configure/build/test gate now passes. Foundation
292
  changes remain uncommitted for independent review.
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
57
 
58
  ## Proposed smaller series and dependencies
59
 
60
+ The user approved a nine-theme target: **9 instead of 72 commits**. The former
61
+ policy/mining theme is split into independently reviewed local checks, graph
62
+ accounting, and mining adaptations. Historical fixes,
63
  tests and documentation travel with the behavior they correct; release/CI work
64
  travels with maintenance, rather than recreating chronological fixup commits.
65
  No broad compatibility layer is proposed.
 
67
  | Theme | Owning scope and prerequisite |
68
  | --- | --- |
69
  | L6 build/portability | Dependency probes and supported switches; contract documents and this review. Establishes the foundation only. |
70
+ | L7 parsing/local checks | Scoped parsing, script/witness/sigop standardness, carrier detection/budgets, fixed dust/ephemeral and relay age/maturity. Requires L6. |
71
+ | L8 graph policy | Carrier policy weight, sub-dust modified fees, replacement/TRUC/reuse and authorized dynamic-dust repair. Requires L7. |
72
+ | L9 mining | Coin-age priority, template normalization, residual chunk assembly and joint interactions. Requires L8. |
73
+ | L10 peers | Resource/permission controls and current-connection health; GUI/functional coverage. Requires L7 and L6. |
74
+ | L11 wallet | Database/signer boundaries, per-send RBF, sweep authorization/secrets and coin-control facts. Requires L10. |
75
+ | L12 operator/runtime | Read/write config, effective-policy RPC and platform resource support; dormant stats remain dormant. Requires L7 state and L11. |
76
+ | L13 integration | Identity/icons/QR/taskbar, generated help artifacts, CI and release/export tools. Requires L12. |
77
+ | L14 evidence | Final preservation review, range comparison and exact-candidate supported gates. Requires L6–L13. |
78
+
79
+ Preimplementation review found distinct algorithm risks: v31's block builder
80
+ can include or skip only the current whole chunk, while Roots selects an
81
+ individual priority prefix before fee-selected descendants. Graph policy
82
+ weight/modified-fee consistency across staging, diagrams, replacement and
83
+ trimming needs its own review before that mining adaptation. The approved
84
+ split separates those risks without restoring ancestor indexes or retiring
85
+ any intended contract. Existing accepted commits are unchanged.
86
+
87
+ The user also authorized a bounded L8 repair of the documented non-off
88
+ dynamic-dust startup defect: node-owned scheduling after final successful
89
+ chainstate load, safe retry/shutdown lifetime, configured-floor fallback when
90
+ estimates are unavailable and overflow-safe multiplier scaling, all with
91
+ regressions. Default remains off. This authorization does not enable dormant
92
+ statistics or permit unrelated repairs. Dynamic runtime is still deferred.
93
+
94
+ `runtime-config` is an L12 implementation dependency of L7 parsing and L11 sweep.
95
  Until then, feature tests must cover Core CLI/config semantics and explicitly
96
  defer Roots `confrw` precedence cases; they cannot claim those cases passed.
97
+ The full precedence gate runs when L12 lands. Feature-local tests still ship
98
+ with each implementation; L14 is additional aggregate evidence.
99
 
100
  ## Contract dispositions against actual v31.1 APIs
101
 
 
108
 
109
  | Contract | Disposition / theme | Upstream comparison, adaptation and acceptance gate |
110
  | --- | --- | --- |
111
+ | policy-parsing | adapted / L7 | `node::ApplyArgsManOptions` now consumes cluster limits; L7 carries scoped grammar; graph/mining options are labelled parsing-only until L8/L9 enforcement lands. Preserve L2's complete-token/range/diagnostic decisions, quarter-vbyte rounding and CLI/config precedence. Port parser unit/startup tests and L5 fuzz boundaries; complete read/write precedence in L12. |
112
+ | effective-policy | adapted / L12 | `getmempoolinfo` has cluster-era size/fee information but no Roots `policy` object. Read authoritative initialized v31 state plus synchronized dynamic dust; retain L3's schema, units and enforcement gates. Port `rpc_effective_policy.py`, help and admission parity assertions. L4 supplied no snapshot refactor to carry. |
113
  | policy-standardness | adapted / L7 | Core `IsStandardTx` takes carrier budget, bare-multisig flag and dust rate. Core permits bare multisig by default and lacks Roots configurable script/witness, strict sigop, CAT21/token and ephemeral modes. Preserve Roots limits/defaults/reasons solely in local gates. Run transaction/sigop/TRUC cases and valid-block fixtures; do not change script consensus. |
114
+ | policy-carrier | adapted / L7,L8 | Core defaults to a 100,000-vbyte OP_RETURN budget, not Roots' aggregate 83-byte budget, and lacks recognized input/witness carriers and cost weighting. L7 adapts detection/budgets; L8 adapts extra policy weight to `TxGraph` fee/weight accounting. Retain Roots `multi-op-return` rejection despite source help conflict. Port `mempool_datacarrier.py`, extra-weight boundaries, tapscript and L5 dust-cost interactions. |
115
+ | policy-dust | adapted / L7,L8 | Core retains `GetDustThreshold` and a 3,000 sat/kvB floor, but has a fixed initialized rate and no `dustdynamic` publication. L7 preserves fixed dust/ephemeral checks. L8 repairs scheduler lifetime and retains estimator/floor behavior and synchronized snapshots; adapt mempool-position estimation to clusters. Run `mempool_dust.py` and changing-publication unit cases. Estimator-unavailable and extreme-multiplier gaps are not passes. |
116
+ | policy-subdust | adapted / L8 | No upstream deficit penalty. Preserve worked contract units, saturation, exemptions and modified-fee accounting without changing actual fee rewards. Adapt policy weight/modified fees consistently through cluster admission, replacement and mining. Port sub-dust tests and L5 arithmetic fuzz/valid-block cases. |
117
+ | policy-replacement | adapted / L8 | Core has unconditional full RBF and cluster feerate-diagram replacement, with enforced TRUC; Roots Never/OptIn/TRUC mode controls are absent. Default full RBF alone is not equivalence. Preserve configured modes, v3 opt-in behavior, fee/resource gates and truthful `fullrbf`; adapt to current replacement algorithms without restoring ancestor indexes. Run RBF/TRUC/package/sibling and policy-block tests. |
118
+ | policy-coinage | adapted / L7 | Relay coin-block age and maturity controls are absent. Reuse available coin heights; add local gates and bounded age arithmetic, never alter consensus coinbase maturity. Preserve disabled defaults and add/retain enabled, boundary and valid-block acceptance cases; the historical dedicated-relay coverage gap is addressed by candidate enabled/disabled, boundary, tip-reorg and valid-block tests. |
119
+ | policy-reuse | adapted / L8 | No upstream `spkreuse` creation/spend tracking or conflict mode. Preserve default allow and explicitly configured local tracking across admission, replacement and reorg. Dedicated functional mode/reorg coverage is still required before claiming equivalence. |
120
+ | mining-template | adapted / L9 | `BlockAssembler::addChunks` replaces ancestor-index assembly. Core's default weight is 4,000,000 with reserved-weight handling and minimum fee 1 sat/kvB, not Roots' 1,200,000 weight / 1,000 sat/kvB / 100,000-byte priority area. Preserve size/weight normalization and coin-age priority while avoiding duplicates and charging ancestor/chunk resources correctly. Port miner boundaries and L5 priority/fee/block-acceptance cases. |
121
+ | peer-controls | adapted / L10 | Core compact reconstruction extras default to 100 entries, with no Roots 10 MB memory bound; orphanage is `node::TxOrphanage`, not the former pool layout. Core whitelist/upload/BIP permissions do not establish forceinbound, explicit compact-filter permission, subnet disconnect or clearnet-v2-only equivalence. Preserve each documented default, malformed-input bound, Tor-bind isolation and SOCKS secret boundary; run extra-tx, permissions, filter, eviction and invalid-message tests. |
122
+ | peer-health | adapted / L10 | Core has current-peer stats/table/details but lacks the complete Roots extra fields and unavailable-state contract. Use existing refresh/interfaces; port stale-detail reset, sort/selection and bounded CPU reporting. Run `rpc_net.py`/Qt apptests and required resolution/font-scale matrix; no collector/history feature. |
123
+ | wallet-foundation | adapted / L11 | Descriptor/SQLite and external signing remain upstream. v31 database enumeration still recursively traverses directories; Roots directory/reparse/permission safeguards remain necessary. `RunCommandParseJSON` now takes an argv vector instead of a shell command string; preserve child-FD closure on this API. Port multiwallet/signer/unit cases, retaining no-BDB-build and locking boundaries. |
124
+ | wallet-rbf | adapted / L11 | Core has a per-send checkbox and sequence override, but initializes the checkbox checked rather than from wallet `walletrbf`. A similar UI is insufficient. Preserve wallet-derived preference, explicit overrides, confirmation and PSBT signaling tests. |
125
+ | wallet-sweep | adapted / L11 | No Core `sweepprivkeys` RPC/dialog. Adapt wallet fee/coin APIs and cancellation through interfaces; preserve WIF/script scope, selected local-key descriptor destination, no import, preview default, locked fee snapshot, transient secure cache/redaction and final broadcast authorization. Run sweep functional/Qt/security-structure tests plus runtime cancellation and visual evidence. |
126
+ | wallet-coin-control | adapted / L11 | Core retains ordinary coin-control/listLockedCoins; it lacks Roots effective/reuse/grouping facts and full invalidation contract. Adapt current wallet output/input-size APIs, preserve visibility/selection filters and conspicuous change validation. Run wallet-send/Qt selection/invalidation/source checks and populated GUI matrix. |
127
+ | runtime-config | adapted / L12 | `common::MergeSettings` contains forced/CLI/JSON/config sources, but no Roots read/write text configuration layer or `confrw`. Insert the existing layer and typed writes into current ArgsManager without a duplicate policy store; preserve network-file/default/negation/list rules. Run getarg/config functional and deferred L7 precedence cases. |
128
+ | operator-stats | kept; uptime adopted-upstream / L12 | `uptime` still returns `TicksSeconds(GetUptime())`; `GetUptime` uses `SteadyClock` initialized at app startup. Its function/schema/clock/defaults are identical in relevant source; upstream adds a wall-clock-jump regression. Both the exact pinned-source acceptance test and current upstream `rpc_uptime.py` pass on the authenticated base. Independent review accepted this narrow sub-aspect, not retirement of the whole contract. Core has no Roots stats model/RPC. Keep the retained stats source dormant: do not register, sample or advertise `getmempoolstats` without a separate compatibility decision. Source GUI/default/help conflict remains a gap. |
129
+ | runtime-resources | adapted / L12 | Core has `GetTotalRAM` and RAM-aware cache sizing, so helper-name similarity cannot retire Roots sizing semantics. Compare exact cache thresholds/units and failure defaults before sub-aspect retirement; preserve Roots byte-safe allocation, FD bounds and platform-scoped advisory helpers where needed. Run RAM/FS/util tests and actual supported-platform checks; unused helpers are not a cross-platform service. |
130
  | build-portability | adapted / L6 | Core remains CMake/C++20 with wallet/tests enabled, GUI off, embedded LevelDB/secp256k1, optional signer/QR and IPC. It raises GCC/Clang minimums and supplies Qt6-only CMake targets. Carry Roots Qt5/6 selection, required system-library usability probes and native crypto flags on these APIs; missing optional dependencies are explicit gaps. A declared Tor-subprocess switch has no source consumer and must stay a non-feature, not become an automatic launcher. MiniUPnPc build support must not imply a missing runtime consumer. |
131
+ | identity-desktop | adapted / L13 | Core version/icons/help remain Core; Roots identity, QR-PNG export and Windows taskbar support are not equivalent. Port limited identity/desktop changes while preserving upstream names/protocol attribution. Generate manuals/config from final help only; run version, Qt QR/icon and Windows/platform/visual gates. |
132
+ | maintenance-ci | adapted / L13 | Core's v31 compiler/platform/cluster fixtures supersede old job assumptions; Roots classifier, exact promotion proof and platform/fuzz scheduling need adaptation. Retain actual exact-candidate CI gates and bounded corpora scheduling; run maintained tool tests and supported candidate profiles. |
133
+ | maintenance-release | adapted / L13 | Upstream does not provide Roots immutable source/tag/assets, signed new-draft-only five-platform release, portable export or contributor-credit rules. Adapt version/base validation and replay without publishing/tagging. Retain `.github` exclusions and `git am -3 --keep-cr`; test temporary export/replay and all release tools. Expanded notices remain deferred. |
134
+ | maintenance-docs | adapted / L6,L13,L14 | Carry accepted contracts first with explicit deferred status, reconcile catalog/privacy/provenance to actual candidate, generate help artifacts when interfaces land, and complete review evidence last. Historical release notes are provenance, not a v31 feature claim. Check links/doc lint/whitespace and generated-output parity. |
135
  | maintenance-native | adapted / owning theme | Inspect every surviving source hunk; keep behavior-preserving C++/empty-write/test hooks only where needed on v31 APIs. Port test fixtures with their features rather than overwriting newer Core tests. Transient reverted script work is not a new consensus feature. Run affected unit/functional/fuzz gates. |
136
 
137
  The shared consensus-neutral and no-RDTS boundaries apply to every row. Contract
 
150
 
151
  | Source commits | Owning themes and treatment |
152
  | --- | --- |
153
+ | `5c210e17fb` | L6 build/dependency support; L13 platform CI/release integration. Adapt required probes, not old generated summaries. |
154
+ | `85257a0986`, `724f8c2ee7` | L7–L9 policy utility dependencies; L10 peer diagnostics; L11 signer boundary; L12 config/runtime/stats support. Split mixed runtime content by contract; preserve dormant status. |
155
+ | `1b73fe3d21`, `ec9db369f5` | L7 local checks; L8 accounting/dynamic dust/replacement; L9 mining and broad functional fixtures; L10 peer controls; L11 wallet boundary fixes/fixtures; L12 runtime dependencies; L13 CI test-script integration. Adapt actual surviving deltas to clusters/interfaces. |
156
+ | `dd03dcb989` | L11 database/SQLite/signer hardening, adapted. |
157
+ | `c592888088` | L6 Qt build support; L10 peer view; L11 wallet GUI support; L13 identity/QR/taskbar. Split mixed GUI content without importing incidental upstream text. |
158
+ | `fc0dc945d0` | L7 fixed-dust/sigop tests; L8 sub-dust/TRUC tests, plus L10 peer fixtures and L12 operator tests where present. Preserve tests' actual feature ownership. |
159
+ | `9f1780f330`, `4570a6a547` | L6 necessary build registration; L13 assurance/CI/release tooling and fixtures; owning-feature tests across L7–L12. No replacement maintenance state system. |
160
+ | `9da5851410`, `26b691e4f3`, `201927c151`, `e819a07a4a`, `56e2894760` | L13 CI scheduling, apt-retry, optional-feature selection and branded archive checks; adapt to v31 jobs. |
161
+ | `83fa42a963`, `f5182f0e3a`, `7791eede50`, `11c84c39ef`, `0efa437e29`, `f2595557d9`, `38bc7ec2ce`, `df8aa8e2b7`, `ddae467a78`, `778ff50d19`, `c474825f96`, `17e1d484ab` | L13 release/rehearsal/source/archives/signing/new-draft/promotion CI and notice deferral; preserve final safeguards, fold corrective history. `f5182f0e3a` also supplies L11 sweep/privacy boundary tests and L12 safe-empty-stream writes/tests, plus L13 apt/sanitizer checks. No releases dispatched. |
162
+ | `25f889f97e`, `3e13c1f213` | L13 Windows icon and QR QString-size corrections, kept/adapted with identity. |
163
+ | `b0b235d6a1`, `f4066e5282`, `30f673a4bc`, `a13f28e2f4`, `1517d925b2`, `628bdf4e38`, `02464df449`, `089888acdd` | L6/L13/L14 catalog, scope, historical notes and provenance; rewrite candidate claims for actual implementation, retain relevant history/credit. |
164
+ | `bbd7339af2`, `9b778b9a23` | L10 peer stale-state fix/apptests; L12 streams assertion fixtures and L13 QR/build GUI assertions from the mixed test commit. |
165
+ | `e4b26462de`, `0e3ae72d89` | L11 wallet-derived per-send RBF and locked Qt assertions, adapted. |
166
  | `5e2d79e937` | L7 `node/mempool_args.cpp` string-view prefix modernization, adapted only where the parser remains; no consensus feature. |
167
+ | `fb21288879`, `dc1b217cbd`, `9a216bc389`, `7c70374050`, `f3cd7da535`, `96fecfd411`, `a1748ccc64`, `f9e9a36cd1` | L11 sweep RPC/GUI, coin-control facts, documentation, asynchronous authorization, locked fee snapshot and secret cleansing. Fold security corrections into final feature. |
168
+ | `875fa15829`, `9ab60f217b`, `9d9c125d9e` | L9 priority-selected ancestor/resource correctness and locale-independent regression fixtures, adapted to chunk mining. |
169
+ | `aa27c9117a`, `48f3b3bbe8`, `a6f35e915c` | L8 configured RBF/TRUC semantics and tests; L12 truthful RPC field; L13 final generated help. |
170
+ | `30e7eac266`, `12d67ba60a`, `e6d4abc704`, `085a84a7cb`, `8cb07ef1b9` | L7–L10/L12 feature-owned full-suite, Taproot-carrier, fee-estimator and startup fixtures; adapt to current APIs without erasing upstream regressions. |
171
+ | `1f7cfce176` | L13 regenerate manuals/example configuration from final help, not source-byte replay. |
172
+ | `16b2198275`, `47329c00dd`, `1b2431c74c` | L6 native crypto flags, exact MiniUPnPc dependency patch and usable system LevelDB memory environment; the Chain interface include and mempool/1p1c lint fixtures follow L7/L10. |
173
+ | `784b2af17a`, `f74cc0433b`, `73c97862e2` | L8 synchronized dynamic-dust publication/snapshot and changing-rate tests; consumers in L12 report the same authoritative state. |
174
  | `f66eca4ae4` | L6 accepted stable contract collection and source/provenance reconciliation. |
175
  | `87c950de92` | L7 strict policy grammar, scoped help/diagnostics and parser/startup tests; distinct source behavior change. |
176
+ | `b60a6e04d0` | L12 additive effective-policy RPC/schema/parity tests; distinct source API change. |
177
+ | `10d772eb7f` | L7 local valid-block/carrier interactions and parser fuzz; L8 penalty/carrier arithmetic and fuzz; L9 priority/fee/template interactions; L6 retains documented gaps until tests are ported. |
178
 
179
  Source-range authors are Jaromil and devjoinedthechat. Preserve their existing
180
  copyright/credit and upstream Core/Knots lineage; use retained source authorship
 
299
  Documentation option lint, local links/anchors and whitespace checks pass.
300
  The required real Qt 5/6 GUI configure/build/test gate now passes. Foundation
301
  changes remain uncommitted for independent review.
302
+
303
+ ## L7 local policy verification
304
+
305
+ The approved narrowed L7 adapts scoped parsing and local checks. Candidate
306
+ links are collected in [the policy catalog](roots-features.md#local-policy-and-mining)
307
+ and [the parsing contract](feature-contracts/policy-parsing.md). The source
308
+ `policy_args` fuzz harness from
309
+ `10d772eb7f4b00b5193428a0dde4c06558d6c297` is retained, and native transaction
310
+ fuzzing now calls carrier recognition. Native overloads keep their existing
311
+ signatures and use the Roots defaults; their non-production callers are unit
312
+ and fuzz tests. Production admission supplies the initialized option snapshot.
313
+
314
+ Admission maturity uses next-block depth, with unconfirmed inputs contributing
315
+ zero age. Coin-block accumulation caps at the configured bound before each
316
+ multiplication/addition, preserving the integer boundary without floating-point
317
+ rounding or an ancestor/priority cache. Fresh admission after a tip reorg is
318
+ covered. Carrier checks remain independent of the general standardness switch;
319
+ full counting and nonstandard-carrier permission are tested separately.
320
+
321
+ All added rejection paths stay in local policy or `MemPoolAccept::PreChecks`.
322
+ `ConnectBlock`, consensus input/script checks and flags, actual fee/reward
323
+ accounting, native TxGraph and mining implementations have no L7 changes.
324
+ Consensus-valid block fixtures cover locally rejected CAT21, bare pubkey,
325
+ unknown-witness outputs, token markers, multiple OP_RETURN, dust, carrier and
326
+ relay-age transactions. Native script/package/cache/wallet-notification tests
327
+ retain their assertions with explicit raw-pubkey fixture allowances and precise
328
+ rejection reasons. Resource tests retain their upstream cluster/package/TRUC/RBF
329
+ and mining assertions with explicit carrier/script budgets across restarts;
330
+ multi-OP_RETURN tests assert Roots rejection and Core's nonstandard override.
331
+ Fee-estimator and RBF low-feerate fixtures explicitly select their sampling range.
332
+
333
+ The remaining default headless functional suite is also covered, beyond the
334
+ selected policy filter. Its block resurrection, CSV/DER, orphan/package,
335
+ burn-accounting RPC and large wallet-script fixtures retain their original
336
+ assertions with explicit allowances for their constructed outputs and padding.
337
+ The IBD fee-filter fixture uses the buckets produced by the unchanged native
338
+ rounder from the Roots default relay fee. Full native units, non-Boost CTest
339
+ gates, and the applicable functional tests pass; optional-feature/environment
340
+ skips remain gaps. The bounded Clang ASan/UBSan campaigns cover parser,
341
+ transaction/carrier and native input/witness callers, not the L8/L9 extensions.
342
+
343
+ L5 interaction ownership remains bounded:
344
+
345
+ | Source coverage | Candidate disposition/remaining owner |
346
+ | --- | --- |
347
+ | Parser grammar, types, negation, cost and dynamic syntax round trips | L7 unit/startup and actual sanitizer fuzz; no dynamic runtime claim. |
348
+ | Fixed dust thresholds, ephemeral/local standardness, carrier budgets and valid blocks | L7 focused tests and broader native regression fixtures. |
349
+ | Subdust deficit rounding/saturation, carrier extra weight, fee deltas, replacement/package/TRUC/reuse combinations | L8; existing source methods and arithmetic fuzz remain required gates. L7's native regression runs do not establish these Roots extensions. |
350
+ | Dynamic startup, publication, estimator fallback, extreme scaling and retry/shutdown | Authorized bounded L8 repair, still deferred; default off remains unchanged. |
351
+ | Priority ancestors, residual mining, template normalization, actual-versus-modified reward interactions | L9, including source L5 joint mining/block fixtures; native mining passes are regression evidence only. |
352
+ | Integrated Roots confrw precedence | L12 only; ordinary CLI/config/JSON cases run in L7. |
353
+
354
+ Prior-release mempool compatibility remains skipped because release fixtures are
355
+ unavailable. External script-assets and other previously recorded optional
356
+ matrix dependencies are not represented as passes. Final L7 acceptance and the
357
+ later full candidate integration matrix remain separate review gates.