{
 "number": 36506,
 "input_hash": "a1cab98a69940a6e",
 "model": "ledger",
 "prompt_hash": null,
 "created": "2026-10-16T01:17:22+00:00",
 "result": {
  "summary": "Plugs several liveness holes in 1-parent-1-child (1p1c) package relay and orphan handling, and introduces an end-to-end fuzz harness (`p2p_1p1c_liveness`) that tests bounded CPFP relay propagation under adversarial conditions. It hands over orphan reconsideration to another peer when the assigned peer disconnects, prevents `TX_CONFLICT` and `DIFFERENT_WITNESS` results from entering the reject filter, retains orphans after package feerate failures, and enables type-specific forgetting in `TxRequestTracker` to prevent witnessless parent rejections from cancelling txid orphan parent requests.",
  "problem": "Peers can exploit orphan management and reject filter edge cases to stall or block honest CPFP fee-bump packages from entering the mempool. An announcer assigned to reconsider an orphan can disconnect without the work being reassigned, reject filters can be poisoned by witnessless copies (where txid equals wtxid) of known transactions, temporary package feerate failures with malleated parents erase the child orphan for all announcers, and rejecting a witnessless parent accidentally cancels pending txid-based parent requests.",
  "card": "This PR fixes several liveness and pinning vulnerabilities in 1-parent-1-child package relay and adds an end-to-end fuzz target verifying bounded CPFP relay propagation against adversarial peers. Adversarial or disconnecting peers could prevent CPFP transactions from reaching the mempool by stranding orphans when assigned announcers disconnect, poisoning reject filters using witnessless copies of known transactions, purging orphans globally on package feerate failures caused by malleated parents, or wiping pending orphan parent requests when txid equals wtxid. The patch reassigns orphan reconsideration upon announcer eviction, excludes conflict results from reject filters, keeps orphans on reconsiderable package errors, and implements typed forgetting in TxRequestTracker. It depends on PR 36437.",
  "evidence": [
   "PR description: 'Resolves two fuzz harness \"holes\" and narrows a third. This is a proposed stopping point on resolving the holes, as it's unclear if further work is worth the churn vs a sender-initiated package relay protocol update that would resolve this directly.'",
   "Commit 65b48ba1f1: 'If that announcer disconnects or is evicted first, the orphan is never retried, and re-announcements by the other announcers don't fetch it again since it is already held. This keeps e.g. a CPFP child of a parent that pays for itself out of the mempool until the orphan is evicted, and an announcer can cause it on purpose.'",
   "Commit feff499de9: 'When a 1p1c package fails the package feerate check, the child gets a TX_RECONSIDERABLE result, and ProcessPackageResult passed it to ProcessInvalidTx, which erased the child from the orphanage for all of its announcers.'"
  ],
  "scope_notes": "The PR adds a major new fuzz target (`p2p_1p1c_liveness.cpp`) of over 500 lines that drives a real `PeerManager` end-to-end to verify transaction liveness invariants.",
  "changed_since_previous": "Dropped earlier changes that introduced a dedicated txid cache for nonstandard-input rejections and re-requested missing parents on failed orphan retry; focused the patch set specifically on the peer handover, reject filter handling of conflicts, orphan retention on package feerate failure, and typed announcements forgetting in TxRequestTracker.",
  "thread": {
   "last_event_at": "2026-10-15T04:04:24Z",
   "events": 5,
   "head_sha": "8d44ac89099393d632ba8e82ca081b6b6c5e7957",
   "schema_floor": 2,
   "schema": 2
  },
  "waiting_on": [
   {
    "at": null,
    "id": "",
    "on": "nothing",
    "url": null,
    "what": "all items addressed and PR has substantive review"
   }
  ],
  "risk": {
   "level": "medium",
   "touches": [
    "p2p",
    "mempool_policy"
   ],
   "why": "Mistakes in orphan lifecycle management, reject filtering, or TxRequestTracker could cause memory leaks in the orphanage or prevent honest transactions from being downloaded and accepted."
  },
  "discussion": {
   "author_status": "last statement processed 2026-10-15",
   "open_concerns": [],
   "resolved_concerns": [
    "fametrano: Address in a follow-up the remaining gap where DIFFERENT_WITNESS still goes through ProcessInvalidTx and puts the parent txid in the reject filter (accepted by fametrano 2026-10-15)"
   ]
  },
  "reviewability": {
   "state": "Ready",
   "label": "Review #36437 first",
   "reason": "Stacked on #36437; the base PR's changes are included in this diff."
  },
  "agreement": {
   "state": "Strong",
   "summary": "Strong: substantive support, no open objection (fametrano, fametrano, fametrano)",
   "reason": "fametrano reACKed after the DIFFERENT_WITNESS gap was addressed in 8d44ac8909 with a test.",
   "evidence": [
    "fametrano: Tested ACK \u2014 each of the four fixes is caught by a test this PR adds or extends",
    "fametrano: ACK \u2014 reviewed the four fixes commit by commit and found nothing blocking",
    "fametrano: ACK \u2014 the new DIFFERENT_WITNESS case resolves the remaining 1p1c gap and passes unit tests"
   ],
   "objections": [
    {
     "reviewer": "fametrano",
     "association": "CONTRIBUTOR",
     "type": "suggestion",
     "kind": "scope",
     "harm": "",
     "request": "Address in a follow-up the remaining gap where DIFFERENT_WITNESS still goes through ProcessInvalidTx and puts the parent txid in the reject filter",
     "question": "",
     "text": "Address in a follow-up the remaining gap where DIFFERENT_WITNESS still goes through ProcessInvalidTx and puts the parent txid in the reject filter",
     "clears_with": "answer",
     "blocking": false,
     "status": "accepted",
     "status_note": "fixed in push 8d44ac8909 and confirmed by fametrano",
     "cleared": true,
     "author_replied": true,
     "others_replied": false,
     "fix_pushed": true,
     "replies": [
      "c:6184133714"
     ],
     "evidence": "2026-10-14: 'One gap remains for a follow-up: in the 1p1c package path, a `DIFFERENT_WITNESS` result still goes through `ProcessInvalidTx`'",
     "url": "https://github.com/bitcoin/bitcoin/pull/36506#issuecomment-6172002083",
     "id": "c:6172002083",
     "at": "2026-10-14",
     "status_at": "2026-10-15",
     "status_by": "fametrano",
     "resolution_evidence": "2026-10-15: fametrano: 'The new `DIFFERENT_WITNESS` case closes the 1p1c gap I noted at c8abd9ee41'",
     "pin": null,
     "from_schema": 2
    }
   ],
   "support": [
    {
     "reviewer": "fametrano",
     "reason": "each of the four fixes is caught by a test this PR adds or extends",
     "substantive": true,
     "verdict": "Tested ACK",
     "id": "c:6171016228",
     "url": "https://github.com/bitcoin/bitcoin/pull/36506#issuecomment-6171016228",
     "at": "2026-10-14",
     "association": "CONTRIBUTOR",
     "evidence": "tested",
     "areas": []
    },
    {
     "reviewer": "fametrano",
     "reason": "reviewed the four fixes commit by commit and found nothing blocking",
     "substantive": true,
     "verdict": "ACK",
     "id": "c:6172002083",
     "url": "https://github.com/bitcoin/bitcoin/pull/36506#issuecomment-6172002083",
     "at": "2026-10-14",
     "association": "CONTRIBUTOR",
     "evidence": "read",
     "areas": []
    },
    {
     "reviewer": "fametrano",
     "reason": "the new DIFFERENT_WITNESS case resolves the remaining 1p1c gap and passes unit tests",
     "substantive": true,
     "verdict": "ACK",
     "id": "c:6183724291",
     "url": "https://github.com/bitcoin/bitcoin/pull/36506#issuecomment-6183724291",
     "at": "2026-10-15",
     "association": "CONTRIBUTOR",
     "evidence": "both",
     "areas": [
      "txdownload_tests",
      "orphanage_tests",
      "txpackage_tests"
     ]
    }
   ],
   "participants": [
    {
     "login": "fametrano",
     "stance": "support",
     "note": "reACKed after the DIFFERENT_WITNESS gap was fixed and covered by unit tests",
     "association": "CONTRIBUTOR",
     "comments": 3,
     "first": "2026-10-14",
     "last": "2026-10-15"
    }
   ],
   "derivation": "substantive support, no open objection (fametrano, fametrano, fametrano)",
   "model_state": null,
   "corrections": [],
   "notes": "fametrano reACKed after the DIFFERENT_WITNESS gap was addressed in 8d44ac8909 with a test."
  },
  "dependencies": {
   "depends_on": [
    "#36437"
   ],
   "enables": []
  },
  "categories": [
   {
    "name": "p2p",
    "member": true,
    "evidence": "Labeled P2P and modifies orphan management, reject filter handling, and transaction request tracking in src/net_processing.cpp, src/node/txorphanage.cpp, and src/txrequest.cpp.",
    "band": "P2",
    "reason_tag": "DoS protection",
    "score": 0.7,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 1
    },
    "rationale": "Plugs multiple adversarial liveness holes where malicious or disconnecting peers can stall or block honest CPFP fee-bump packages. As noted in the description, adversaries could cause a child orphan of an honest fee-paying parent to be withheld until eviction or dropped from all announcers entirely, undermining opportunistic package relay reliability."
   },
   {
    "name": "tests",
    "member": false,
    "evidence": "The added fuzz harness and unit tests specifically validate P2P 1p1c relay behavior rather than general test framework machinery.",
    "band": "Unranked",
    "reason_tag": "test coverage",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 1,
     "performance": 0,
     "security_stability": 2,
     "user_value": 1
    },
    "rationale": "Non-member; category definition excludes tests tailored to pinning the behavior of a specific subsystem."
   }
  ],
  "confidence": "high",
  "uncertainties": [],
  "needs": []
 },
 "cost_usd": 0.0,
 "source": {
  "record": "2026-10-16T01:17:22+00:00",
  "code": "2026-10-16T01:19:03+00:00",
  "judgments": 2
 }
}