(+) #36521 sipa Keep witness stacks in serialized form in CScriptWitness P1 · DoS protection Needs rebase 0 (+1) -1 Blocked 502 + 752 tests Protect nodes from memory exhaustion and slow deserialization caused by crafted witness data Stop peers from inducing large memory allocations with malformed transactions or blocks P1 because it closes a denial-of-service vector where peers trigger large allocations before rejection Untrusted peers can no longer force nodes to allocate excess memory for oversized payloads Review is worthwhile now as nothing is known to invalidate it Broad concept support for mitigating exceptional transaction memory bloat (furszy, 0xB10C, instagibbs) Verified by testing on Windows after initial efficiency suggestions were addressed (Yudis-bit) Unaddressed objection: memory allocation remains high for unknown witness versions (fametrano) Approach objection: excessive churn across 76 files before abstracting data access (purpleKarrot) 502 lines added or modified outside tests 752 lines added or modified in tests 279 lines removed in total 76 files, 17 commits (+) #36015 brunoerg txorphanage: bound orphan memory by storing transactions serialized P1 · DoS protection Waiting on author 1 (+1) Strong 193 + 241 tests Prevent peers from bypassing orphan memory limits and mounting remote memory exhaustion attacks Keep actual orphan memory usage in line with accounted limits by storing transactions serialized P1 because it prevents remote DoS memory exhaustion attacks against nodes Peers can bypass orphanage caps with witness-heavy transactions that use 28x their accounted weight Substantive support from multiple reviewers based on review and functional testing (jeanpablojp, nervana21) Concept approval without detailed reviews (w0xlt, l0rinc, Crypt-iQ) Approach objection: prefers alternative PR #36521 Author is willing to close if #36521 193 lines added or modified outside tests 241 lines added or modified in tests 146 lines removed in total 10 files, 7 commits (+) #36437 instagibbs orphanage: Fix orphan reconsideration disconnect hole, add 1p1c invariant harness P1 · bug fix Ready 1 Strong 21 + 619 tests Prevent orphan transactions from getting stranded when an announcing peer disconnects or is evicted Ensure CPFP child transactions relay reliably instead of being stalled out of the mempool P1 because it fixes an exploitable transaction relay liveness hole Peers could deliberately disconnect to stall CPFP child transactions until orphan eviction Ready to review; nothing known that would invalidate a review Serves as the base for follow-up PR #36506 Strong support with no open objections Verified by reproducing the disconnect hole end-to-end and checking iterator safety (fametrano) Concept approval without stated reasons (w0xlt) 21 lines added or modified outside tests 619 lines added or modified in tests 10 lines removed in total 6 files, 2 commits (+) #36506 instagibbs p2p: plug "tier 1" 1p1c liveness holes P1 · DoS protection Review #36437 1 Strong 110 + 993 tests Prevent peers from stalling or blocking honest fee-bump packages from entering the mempool Ensure orphan transactions are retried even when announcing peers disconnect or misbehave P1 after comparing with the other PRs here (assessed alone as P2): Promoted to P1: it contains #36437 P2 because peers can intentionally block honest fee-bump packages from entering the mempool Prevents adversaries from dropping valid fee-paying orphans across peer disconnections Verified each fix with extended test coverage (fametrano) Confirmed the updated handling resolves the remaining package gap (fametrano) 110 lines added or modified outside tests 993 lines added or modified in tests 22 lines removed in total 15 files, 5 commits (+) #36628 instagibbs net: reimplement private broadcast as jobs isolated from the node P1 · bug fix Needs rebase 0 Mild 4,728 + 1,613 tests Prevent transaction deanonymization by fully isolating private broadcasts from regular node peer state Clean up core peer-to-peer networking by removing complex special cases from connection management P1 because existing private broadcast risks IP linkage and transaction deanonymization via shared node state Active network adversaries can exploit current peer tracking and connection logic to link transactions Eliminating these correlation leaks resolves a critical privacy flaw in transaction relay Worth reviewing now even with conflicts because the needed rebase on master is mechanical Support because isolating broadcasts from node state prevents clearnet correlation leaks (darosior) Unaddressed objection: relying permanently on DNS seeds creates a single point of failure (vasild) Unaddressed objection: sending only to IP peers over Tor harms network privacy and lacks fallback (vasild) Suggests deprecating in-node private broadcast in favor of external broadcast tools or hooks (ajtowns) 4,728 lines added or modified outside tests 1,613 lines added or modified in tests 3,046 lines removed in total 78 files, 16 commits (+) #36608 instagibbs Reimplement private broadcast as node state-less jobs + package relay support P1 · bug fix Needs rebase 0 Crickets 7,403 + 9,808 tests Eliminate deanonymization risks and timing leaks when broadcasting private transactions Allow broadcasting low-fee private transactions that rely on child-pays-for-parent package relay P1 because it eliminates critical deanonymization risks and timing oracles in private broadcasting Removes reliance on node state that peers could probe or manipulate via address gossip Ranking pass: Ranked just below its base #36628 Author directed review to slimmed-down PR #36628 No review verdicts recorded No substantive discussion or review comments yet Author noted that reviewers should look at PR #36628 7,403 lines added or modified outside tests 9,808 lines added or modified in tests 4,442 lines removed in total 121 files, 35 commits (+) #35888 l0rinc net: reject oversized outbound messages P1 · bug fix Ready 0 Positive 18 + 61 tests Prevent memory corruption and crashes caused by queueing oversized outbound message types or payloads Fail early with an RPC error in sendmsgtopeer instead of sending invalid payloads that disconnect peers P1 because it fixes an out-of-bounds write buffer bug in V2 transport encoding Also prevents aborts in V1 transport and disconnects from peers receiving oversized payloads Concept approval without stated reasons (ajtowns, naiyoma) Resolved objection: returning false in production would stall connections for minutes (mzumsande) Addressed suggestion to bound copy size by explaining rejection happens earlier (naiyoma) 18 lines added or modified outside tests 61 lines added or modified in tests 13 lines removed in total 7 files, 4 commits (+) #36350 0xShadowX net_processing: count presync work in chain sync eviction P2 · bug fix CI failing 1 Strong 31 + 161 tests Prevent nodes on high-latency networks from repeatedly evicting active peers during headers sync Stop slow peers on Tor or I2P from losing all headers sync progress to a premature 22-minute timeout P2 because it fixes a chain sync liveness failure for nodes operating over high-latency networks Slow outbound peers on Tor or I2P can stall or restart headers sync indefinitely on master CI is failing, so verify whether the failure is related before a deep review Strong support after resolving concerns about stalled peers and unbounded renewals (cyb3ralbert) Verified by testing that timeout renewals are strictly bounded in the functional test (cyb3ralbert) 31 lines added or modified outside tests 161 lines added or modified in tests 2 lines removed in total 3 files, 4 commits (+) #35558 davidgumberg p2p: Prefill compact blocks P2 · speedup Needs rebase 0 (+2) Strong 548 + 83 tests Speed up block propagation by prefilling missing compact block transactions within TCP window limits Eliminate round-trips to retrieve missing transactions, lowering stale block and orphan risks network-wide P2 because it cuts block propagation delays by avoiding extra application round-trips Immediate compact block reconstruction rose from 56.9% to 89.7% in live telemetry Reduces orphan risk and stale block rates across the entire network Broad support for the concept and backwards compatibility (0xB10C, josibake, johnnyasantoss) Verified on live nodes with telemetry confirming higher immediate reconstruction (m4ycon) Verified against compact block unit and functional test suites (s00ly) Past objections on use-after-free, locking, and unnecessary TCP syscalls were resolved (andrewtoth) 548 lines added or modified outside tests 83 lines added or modified in tests 146 lines removed in total 16 files, 13 commits (+) #35642 sipa headersync: do parameter search at runtime P2 · DoS protection Ready 2 (+1) Strong 346 + 310 tests Compute headers presync DoS parameters dynamically at runtime when sync starts Avoid maintainer toil and prediction errors from precomputing parameters per release Adapt memory bounds accurately over time and tolerate post-boot clock corrections P2 because it keeps headers presync DoS resistance and memory limits optimal over time Prevents up to 50x inflated memory bounds if system clocks are corrected after boot Fixes an attack model flaw where an attacker strategically aborts mid-batch Broad support with multiple verified ACKs and all prior objections addressed Support for calculation model and loosened upper bound tradeoff (darosior) Support after verifying parameters adapt on headers sync and fix clock skew (l0rinc) Verified optimal parameter output across chains and dates against Python model (fametrano) Concept approval without detailed review (sedited, fjahr, ajtowns, hodlinator) 346 lines added or modified outside tests 310 lines added or modified in tests 424 lines removed in total 13 files, 5 commits (+) #36244 w0xlt validation, net: Process blocks asynchronously and reduce cs_main contention P2 · speedup Needs rebase 0 Crickets 895 + 2,265 tests Keep peer message processing responsive during block validation and chain activation Prevent peer stalls, ping latency spikes, and slow block serving during heavy block processing P2 because peer message processing will no longer stall while blocks are being validated Drops ping latency by 98% and cuts block-serving latency by up to 45% in benchmarks No review verdicts recorded No substantive review comments either way yet Asked whether steady-state responsiveness is the primary motivation, author confirmed (andrewtoth) 895 lines added or modified outside tests 2,265 lines added or modified in tests 294 lines removed in total 42 files, 20 commits (+) #34533 vasild wallet: resubmit transactions with private broadcast if enabled P2 · bug fix Waiting on author 0 (+2) Mild 11 + 43 tests Prevent wallet rebroadcasts from leaking node IP addresses when private broadcast is enabled Route periodic rebroadcasts through anonymized connections instead of public broadcast P2 after comparing with the other PRs here (assessed alone as P1): Demoted to P2: the same rebroadcast leak is addressed by #36330 #36607 P1 because periodic rebroadcasts bypass private broadcast and leak node IP addresses It fixes a critical privacy break for users relying on anonymized origin connections Author silent for 159 days; reviews may wait a long time for a response Support for routing wallet rebroadcasts through the private broadcast mechanism (pablomartin4btc, w0xlt) Approval without stated reasons (andrewtoth) Unaddressed objection: attacker can send dust to force public rebroadcasts unless IsMine is handled (mzumsande) Answered objection: private broadcast to random peers delays dependent transactions like CPFP (achow101) 11 lines added or modified outside tests 43 lines added or modified in tests 11 lines removed in total 2 files, 2 commits (+) #36330 instagibbs wallet: don't resubmit transactions under -privatebroadcast P2 · bug fix Waiting on author 3 -2 Blocked 10 + 21 tests Stop unconfirmed wallet transactions from being resubmitted when private broadcast is enabled Prevent nodes from leaking their identity as transaction senders or receivers over clearnet P2 because it fixes an origin privacy leak when private broadcast is configured Serving an evicted transaction that no other peer holds marks the node as its origin Unaddressed objection: removing rebroadcast drops useful functionality and needs a general fix (polespinasa) Objection: coupling rebroadcast to private broadcast contradicts docs and disables a wallet feature (vasild) Supports preventing unexpected rebroadcast of wallet-associated transactions over clearnet (andrewtoth) Simple fix that is suitable for backporting (davidgumberg) 10 lines added or modified outside tests 21 lines added or modified in tests 0 lines removed in total 3 files, 1 commits (+) #36607 optout21 private broadcast: Extra guard against unintended non-private broadcast of private transactions P2 · bug fix Review #36477 0 Crickets 149 + 353 tests Prevent transactions intended for private broadcast from inadvertently leaking to public peers Safeguards node origin privacy when local triggers like wallet rebroadcasts or RPCs re-announce them P2 because it prevents node origin privacy leaks by ensuring private transactions stay off public peers Eliminates recurring leak vectors from local triggers like wallet resends, GUI broadcasts, and retry timers No review verdicts recorded No substantive comments either way Addressed test determinism suggestion by disabling trickle delay globally (maflcko) 149 lines added or modified outside tests 353 lines added or modified in tests 78 lines removed in total 13 files, 4 commits (+) #35354 randomlogin net: wait for validation queue flush for missing compact filter for an already known block P2 · bug fix Ready 0 Strong 176 + 387 tests Prevent BIP 157 light clients from disconnecting or banning nodes when requesting new block filters Defer serving filter requests for known blocks until the filter index catches up instead of dropping them P2 because it fixes an interoperability bug where light clients disconnect or ban Core nodes Clients interpret non-response for an advertised block as protocol misbehavior Resolves recurring connection drops seen by Neutrino and other light client wallets No review verdicts recorded Support for deferring racing filter requests in net processing to avoid disconnects (ajtowns, mzumsande) Approves the peer-pausing design with suggestions on request timeouts and retry timers (ajtowns) Prior objections to touching index internals were resolved by keeping logic in P2P code (sedited, mzumsande) 176 lines added or modified outside tests 387 lines added or modified in tests 13 lines removed in total 3 files, 3 commits (+) #35874 l0rinc p2p: prevent BIP35 requesters from bypassing inbound tx-relay capacity P2 · DoS protection Needs rebase 0 Neutral 12 + 28 tests Prevent inbound peers from bypassing transaction-relay capacity limits by requesting mempool inventory Keep nodes from serving full mempool inventory to connections not counted toward relay limits P2 because it fixes an evasion of inbound transaction-relay capacity limits Prevents uncounted peers from requesting full mempool inventory and undermining DoS defenses No review verdicts recorded Neutral sentiment with previous objections resolved and no explicit support yet Concern that peers would receive unintended unfiltered announcements resolved with a test (darosior) Objection to allowing mempool requests when relay is disabled resolved by ignoring them (gmaxwell) Verified SPV sequencing compatibility with existing client implementations (schildbach) 12 lines added or modified outside tests 28 lines added or modified in tests 3 lines removed in total 5 files, 3 commits (+) #36675 instagibbs bugfix: send shortened IPv6 addresses to SOCKS5 proxies in full P2 · bug fix Ready 0 Positive 28 + 52 tests Prevent outbound connection drops to IPv6 peers when using Tor SOCKS5 proxies Ensures Tor exit relays properly parse destination addresses and ports P2 because it fixes outbound connection drops to 20% to 30% of IPv6 peers reached via Tor Tor exit nodes misparse compressed IPv6 addresses and drop connections with general failure Ranking pass: A concrete connectivity failure against 20-30% of IPv6 peers via Tor outranks the opt-in features later in the band. Concept approval without stated reasons (darosior) Author resolved an initial query by noting Tor already tracks the upstream issue (darosior) 28 lines added or modified outside tests 52 lines added or modified in tests 3 lines removed in total 3 files, 1 commits (+) #36142 l0rinc net: validate Tor onion service replies and cached keys P2 · bug fix Ready 3 Strong 35 + 106 tests Validate Tor onion service IDs and private keys received from the control port and disk Prevent command and argument injection into Tor control sockets on reconnect P2 because it prevents Tor control command injection from malicious or malformed keys Closes a stability and security risk that could trigger unintended Tor shutdowns Substantive support across reviewers with no open objections Advocated strict character whitelisting over blacklisting (vasild) Identified argument injection via spaces and suggested cached key checks (jeanpablojp) Tested on FreeBSD with Clang 19 (winterrdog) ACKed without stated reasons (jpk68) 35 lines added or modified outside tests 106 lines added or modified in tests 24 lines removed in total 3 files, 5 commits (+) #36170 l0rinc net: require a dedicated bind for automatic Tor P2 · bug fix Ready 3 Strong 22 + 24 tests Require a dedicated bind for automatic Tor listening when explicit bind arguments are used Prevents inbound Tor peers from being misclassified by IP and inheriting local whitelist permissions P2 because it prevents inbound Tor connections from inheriting local IP whitelist permissions Stops peer misclassification when automatic onion routing forwards through shared listeners Ready for review, with no blockers or unaddressed concerns Strong support with no remaining open objections (vasild, winterrdog) Tested on FreeBSD 15 targeting x86_64 (winterrdog) Thinks adding dedicated container config options is overkill since Docker can set specific IPs (vasild) Answered concern that container environments with dynamic IPs rely on wildcard binds (schildbach) 22 lines added or modified outside tests 24 lines added or modified in tests 11 lines removed in total 7 files, 5 commits (+) #36716 Sjors net: stop monitoring select exceptions outside Windows P2 · DoS protection Ready 0 Crickets 23 Prevent node event loops on POSIX platforms from spinning in busy loops when peers send TCP urgent data Keep connection failure detection working on Windows without stalling the network thread P2 because incoming TCP urgent data can leave socket exceptions pending on POSIX systems Fixing this avoids a potential denial of service from the P2P event loop spinning continuously No review verdicts recorded No substantive review comments yet Suggested extending the same socket exception logic to the HTTP server (pinheadmz) 23 lines added or modified outside tests 0 lines added or modified in tests 0 lines removed in total 3 files, 2 commits (+) #36445 w0xlt net: Skip cs_main when a peer has no orphan work P2 · speedup Ready 0 Crickets 2 + 36 tests Prevent peer message processing from blocking on cs_main when a peer has no orphan work queued Avoid unnecessary latency in handling P2P messages while validation, RPC, or wallet threads hold the lock P2 because it eliminates unconditional cs_main lock contention during routine peer message processing Prevents validation and RPC activity from stalling message loops when no orphan work is pending Microbenchmarks show ping handling latency dropping from 50 ms to 0.02 ms under lock contention Ranking pass: Measured responsiveness win in the message loop; grouped with the other cs_main contention work. Ready to review Small two-line change with an accompanying unit test No review verdicts recorded No substantive reviews yet Suggested only pursuing this if refactoring in #36244 Author replied that avoiding cs_main contention has standalone value on master today 2 lines added or modified outside tests 36 lines added or modified in tests 0 lines removed in total 2 files, 1 commits (+) #36305 winterrdog net: Use exclusive P2P listen sockets on Windows P2 · platform fix Ready 2 Strong 12 + 19 tests Prevent local processes on Windows from hijacking or intercepting incoming P2P connections Ensure bitcoind exclusively binds its P2P listen port and fails startup if the port is already in use P2 because it prevents local connection hijacking on Windows nodes Stops other processes under the same user account from binding the P2P listen port Ranking pass: Supported-platform hijacking risk kept adjacent to the other security fixes in the band. Ready to review No open blockers or pending author updates Strong support with all requested adjustments addressed Verified by running functional tests on Windows (hodlinator) Suggested handling socket option errors as fatal and adding conflict tests, which were applied (hodlinator) Concept approval and suggestion on commit ordering (hebasto) Approval without stated reasons (jpk68) 12 lines added or modified outside tests 19 lines added or modified in tests 0 lines removed in total 2 files, 2 commits (+) #36372 fjahr p2p: replace full outbound peers that don't support tx relay (take 2) P2 · new feature Waiting on author 1 Blocked 62 + 134 tests Ensure outbound full-relay slots are occupied by peers that actually relay transactions Avoid degraded transaction broadcast when outbound connections fill with blocksonly peers P2 because it keeps outbound full-relay slots active for transaction broadcast across the network Addresses longstanding issues where nodes can end up with too few transaction-relaying outbound peers Reviewing now is worthwhile with no known blockers to invalidate review Unaddressed objection: functional test checks for non-eviction cannot fail (fametrano) Questioned whether replacements should be validated first and asked for evidence of problem (instagibbs) Questioned eviction priority for silent peers and suggested more test coverage (Bicaru20) Concept approval for resuming earlier work (mzumsande, Bicaru20) 62 lines added or modified outside tests 134 lines added or modified in tests 17 lines removed in total 8 files, 4 commits (+) #34322 andrewtoth node: Persist private broadcast transactions over node restarts P2 · bug fix Author silent 244d 0 Mild 243 + 134 tests Prevent loss of pending private broadcast transactions when a node shuts down or restarts Ensure transactions submitted for private broadcast over Tor or I2P are relayed after reboot P2 because it prevents silent transaction loss across restarts for nodes using private broadcast Protects relay reliability and liveness for transactions waiting for Tor or I2P broadcast Ranking pass: Ranked below the leak fixes because the private broadcast rework (#36628 Needs rebase Author silent for over 200 days Concept support for avoiding transaction loss across restarts (vasild, craigraw) Unaddressed objection: unrestricted file permissions could leak private broadcast data (vasild) Privacy concern that storing broadcast data on disk expands the attack surface (tankyleo) Suggested a full broadcast pool would better handle crashes and mempool eviction (craigraw) 243 lines added or modified outside tests 134 lines added or modified in tests 0 lines removed in total 14 files, 5 commits (+) #36566 andrewtoth private broadcast: wait synchronously for mempool acceptance P2 · unblocks #N Waiting on author 0 Blocked 107 + 152 tests Ensure transactions sent via private broadcast are accepted into the mempool before returning success Prevent third-party wallet failures and unblock future private broadcast support in the wallet P2 because it unblocks private transaction broadcast integration in the wallet It provides the synchronization needed by external broadcast clients No review verdicts recorded Unaddressed objection: synchronous waiting could cause wallet hangs leading to double payments (instagibbs) Asks which third-party software currently requires synchronous mempool acceptance (instagibbs) 107 lines added or modified outside tests 152 lines added or modified in tests 42 lines removed in total 17 files, 4 commits (+) #30951 stratospher net: option to disallow v1 connection on ipv4 and ipv6 peers P2 · new feature Ready 0 Strong 99 + 99 tests Allow node operators to enforce encrypted BIP324 transport on clearnet peers Prevent passive ISP snooping and cleartext leaks without disabling clearnet entirely P2 because it lets operators protect clearnet peer traffic from passive observers and packet inspection Avoids unencrypted v1 fallback connections while preserving clearnet connectivity Ranking pass: Opt-in operator hardening ranks below the correctness, DoS and privacy fixes in the same band. Approach ACK: ajtowns Concept ACK: mzumsande , dergoegge , fjahr , sipa , kristapsk , laanwj , sedited , pinigapic-lang , davidgumberg , danielabrozzoni , ViniciusCestarii , l0rinc Strong support for letting nodes avoid plaintext clearnet leaks (mzumsande, dergoegge, sipa, laanwj) Addressed objection over partition risks for legacy nodes by tuning peer selection (jonatack) Withdrew concept objection after documentation clarified privacy expectations (vasild) Addressed objection to disabling listening by dropping inbound v1 peers instead (gmaxwell) 99 lines added or modified outside tests 99 lines added or modified in tests 11 lines removed in total 10 files, 8 commits (+) #35591 sr-gi [DO NOT MERGE] Erlay: bandwidth-efficient transaction relay protocol (Full implementation) P2 · new feature Waiting on author 0 Neutral 1,864 + 2,562 tests Replace flood-and-trickle transaction relay with set reconciliation Substantially lower node bandwidth used for transaction announcements Allow nodes to maintain more outbound connections to resist eclipse attacks P2 because it substantially lowers network bandwidth required for transaction announcements Nodes can safely sustain more outbound peers to improve eclipse attack resistance It provides a major protocol upgrade, though delay carries no immediate risk to node safety Ranking pass: Problem is major, but this artifact is marked DO NOT MERGE and will be split; its benefit as a reviewable change is the least certain. Worth reviewing now because the rebase against master is mechanical Needs a rebase before merging No review verdicts recorded Neutral overall with previous concerns addressed and no formal concept approvals yet Resolved objections on test gaps, connection limits, DoS risk, and spec compliance (brunoerg) Open suggestions on const reference usage and vector sizing (bartoli) 1,864 lines added or modified outside tests 2,562 lines added or modified in tests 402 lines removed in total 30 files, 38 commits (+) #35054 fjahr p2p: UTXO set sharing P2 · new feature Waiting on author 0 -5 Blocked 943 + 771 tests Distribute AssumeUTXO snapshots directly over the P2P network instead of requiring out-of-band downloads. Reduces onboarding friction and avoids centralized distribution points for users wanting fast initial sync. P2 because it adds in-band snapshot sharing over P2P, significantly reducing node onboarding friction. Introduces wire protocol extensions that require review of new denial-of-service and bandwidth risks. Ranking pass: Benefit is contested by sustained concept opposition, so it sits last among equally banded features. Needs rebase and CI is failing. Author has been silent for 146 days. Blocked by unaddressed objections while author has been silent (andrewtoth, narula, josibake, nkaretnikov) Unaddressed objection: peer can cause immediate out-of-memory crash via data length field (andrewtoth) Unaddressed objection: activation failure leaves download manager permanently stuck (andrewtoth) Objections to dual chainstate complexity and unvalidated snapshots in P2P (l0rinc, stickies-v, evoskuil) Tested snapshot download, activation, and background validation on mainnet demo node (svanstaa) 943 lines added or modified outside tests 771 lines added or modified in tests 1 lines removed in total 27 files, 13 commits (+) #36486 FlashWayne p2p: keep orphan resolution requests for non-witness 1p1c parents P3 · bug fix Ready 1 Positive 5 + 39 tests Prevent orphan transactions from getting stuck when their non-witness parent is announced by a different peer Ensure nodes still query child announcers for low-feerate legacy parents during opportunistic 1P1C relay P3 because it fixes an orphan relay stall specific to non-witness parents arriving from separate peers Affects opportunistic 1P1C transaction download liveness for legacy transactions Ready to review May be folded into #36437 Support without stated reasons (Yudis-bit) Verified by testing on Windows x86_64 (Yudis-bit) Suggested tackling these orphan cases together in #36437 5 lines added or modified outside tests 39 lines added or modified in tests 1 lines removed in total 2 files, 1 commits (+) #32065 vasild i2p: make a time gap between creating transient sessions and using them P3 · bug fix Author silent 185d 0 Strong 92 + 2 tests Prevent external network observers from correlating I2P session creation with outbound connection timing Improves privacy for nodes making outbound I2P connections without listening mode P3 because it fixes a timing correlation leak that weakens privacy for outbound I2P connections The privacy benefit is real for non-listening I2P users, but the timing leak is reasonably deferrable Needs a rebase and the author has been silent for over six months Concept support for decoupling session creation from use to strengthen anonymity (zzzi2p) Code approval modulo rebase (jonatack) Early objections over resource waste from multiple standby sessions were resolved by keeping just one Nonblocking suggestion to refine when sessions are pre-created remains open (jonatack) 92 lines added or modified outside tests 2 lines added or modified in tests 47 lines removed in total 4 files, 3 commits (+) #36548 l0rinc net: serve `MSG_BLOCK` by stripping witnesses in place P3 · speedup Ready 1 Strong 152 + 330 tests Speed up serving witness-stripped block requests to legacy peers and future witnessless sync clients Reduce CPU and memory overhead by avoiding decoding and re-serializing full blocks from disk P3 because it yields an 8x to 9x speedup and saves heap allocations when serving non-witness blocks Legacy non-witness block traffic is currently low, limiting immediate impact Unblocks proposed witnessless assumevalid initial block download Strong support with thorough testing and benchmarks (fametrano) Verified byte-for-byte output equivalence and 7x to 9x speedups across hundreds of blocks (fametrano) Confirmed serialization on blocks with extreme witness stacks and annexes after rebase (fametrano) 152 lines added or modified outside tests 330 lines added or modified in tests 48 lines removed in total 8 files, 8 commits (+) #35920 ajtowns net_processing: Ignore MSG_WITNESS_TX entries from INV messages P3 · bug fix Waiting on author 2 Strong 14 + 14 tests Disconnect peers that send transaction announcements when transaction relay is disabled Ignore invalid witness transaction announcements on wtxid-relay connections to adhere to BIP 144 P3 because it fixes an edge case where peers announcing txs avoided disconnects on relay-disabled links Brings announcement handling in line with BIP 144 without breaking compatibility for older nodes Ranking pass: Protocol-conformance plus a missed-disconnect path ranks above the test and refactor work that scored near it. Substantive support with no open objections Verified through mutation testing on functional test scripts (fametrano) Code approvals with minor nonblocking suggestions for tests (fjahr, instagibbs) Early compatibility objections regarding Neutrino peers in the wild were addressed (darosior, 0xB10C) 14 lines added or modified outside tests 14 lines added or modified in tests 25 lines removed in total 3 files, 3 commits (+) #36578 instagibbs p2p: clean up a 1p1c package child that is already in the mempool P3 · bug fix Ready 1 (+1) Strong 8 + 25 tests Prevent debug assertion failures when an orphan enters the mempool through RPC or non-peer mechanisms. Ensure 1P1C package relay skips and removes orphans that are already admitted to the mempool. P3 because it fixes an assertion failure triggered in debug builds during an uncommon orphan race. Edge case requires an orphan transaction to enter the mempool via RPC or other non-peer relay. Verified by reproducing the assertion failure on master and testing the fix (fametrano) Prefers reactive cleanup during package selection over adding mempool hooks (fametrano) Suggested proactive cleanup on mempool entry, answered and declined for now (ismaelsadeeq) 8 lines added or modified outside tests 25 lines added or modified in tests 1 lines removed in total 3 files, 1 commits (+) #35936 l0rinc net: reject oversized locators before allocating P3 · DoS protection Ready 0 (+2) Strong 36 + 26 tests Disconnect peers that send oversized block locator requests, even when payloads are truncated Ensure malformed locator messages trigger immediate disconnection instead of being silently dropped P3 because it closes an edge case where peers sending oversized locators evade disconnection Truncated messages with excessive counts are now disconnected rather than silently dropped Ranking pass: Disconnect-evasion edge case grouped with the other message-handling bug fixes rather than with refactors. Substantive support with no open objections Tested and confirmed that truncated oversized locators now trigger disconnects (jeanpablojp) Resolved finding where counts above maximum size bypassed disconnect checks (jeanpablojp) Nonblocking question on using exceptions rather than manual loops answered by author (sedited) Approval without detailed stated reasons (achow101, ajtowns) 36 lines added or modified outside tests 26 lines added or modified in tests 20 lines removed in total 4 files, 4 commits (+) #35003 furszy validation: improve block data I/O error handling in P2P paths P3 · bug fix Waiting on author 1 (+4) -1 Blocked 15 + 533 tests Prevent nodes from hanging or crashing when block storage encounters filesystem errors Ensure fatal storage failures trigger a clean shutdown rather than silently stalling block relay P3 because it fixes edge-case message processing failures during filesystem errors Replaces an ungraceful crash during block transaction requests with a controlled shutdown Addresses silent request drops when relaying blocks to peers under I/O errors Ranking pass: Stability under I/O failure belongs at the top of P3 with the other correctness fixes. Reviewing now is worthwhile as there are no pending changes invalidating review Unaddressed objection: getrawtransaction under txindex masks storage errors as missing txs (w0xlt) Unaddressed objection: introduces index regressions and leaves error handling inconsistent (maflcko) Contested objection: returning nullptr for low-level file errors loses failure context (josibake) Support for improved test coverage and preventing silent hangs during I/O failures (frankomosh, l0rinc) 15 lines added or modified outside tests 533 lines added or modified in tests 7 lines removed in total 10 files, 5 commits (+) #35578 stratospher net: don’t self advertise tor exit node ip addresses in outbound connections P3 · bug fix Ready 0 Strong 21 + 29 tests Prevent nodes connecting through proxies like Tor from advertising proxy exit IPs to peers Stop unreachable proxy addresses from polluting peer address managers across the network P3 because it stops unreachable proxy exit node IPs from polluting peer address managers Evidence showed over half of Tor exit nodes were present in observed addrman snapshots A clear network hygiene improvement that is reasonably deferrable Ranking pass: Broadest effect of the P3 address-handling fixes (network-wide addrman pollution). Reviewing the code now is worthwhile Concept approval because advertising unreachable proxy IPs is unhelpful (0xB10C, naiyoma) Concept approval without stated reasons (mzumsande) Suggested checking proxy status earlier in address selection logic (naiyoma) Suggested verifying an outbound peer does not report its own address back to us (naiyoma) 21 lines added or modified outside tests 29 lines added or modified in tests 1 lines removed in total 5 files, 4 commits (+) #35750 mzumsande addrman: make `m_last_good` network-specific P3 · bug fix Ready 0 (+2) Strong 33 + 102 tests Prevent nodes from wrongly penalizing peer addresses when local connectivity fails on only one network Stop good addresses from being marked terrible and suppressed from relay due to isolated local outages P3 because it fixes misleading failure counts when a node only loses connectivity to one network Prevents legitimate peer addresses on networks like IPv6 or Tor from being wrongly marked terrible Ranking pass: Kept with the other addrman correctness fixes so they can be reviewed coherently. Ready for review as nothing currently invalidates it Strong support with no open objections across reviewers Verified by testing unreachable network failure handling on mainnet with iptables (naiyoma) Concept approval noting this matches the intended failure-tracking behavior (stratospher) Approval with documentation suggestions addressed by the author (fjahr) 33 lines added or modified outside tests 102 lines added or modified in tests 4 lines removed in total 5 files, 2 commits (+) #33663 waketraindev net: Filter addrman during address selection via AddrPolicy to avoid underfill P3 · bug fix Waiting on author 0 (+1) Mild 47 + 39 tests Ensure address queries and P2P responses return the full requested quota even when many peers are banned Avoid underfilling address responses when valid alternative addresses are available P3 because underfilled address responses only manifest under heavy ban or discouragement states Minor privacy benefit by preventing peers from inferring banlist size, but change is deferrable Waiting on author response to design and test coverage feedback Review would repeat open questions (ajtowns, frankomosh, sipa) Concept approval for filtering during selection to avoid leaking banlist size (mzumsande, frankomosh, sipa) Objection: predicate design adds unnecessary complexity over simpler oversampling (fjahr, Bicaru20) Unaddressed suggestion: evict banned addresses directly rather than filtering on query (ajtowns) Unaddressed suggestion: unify all selection parameters into the callback interface (sipa) Unaddressed concern: tests do not verify that a filtered request still meets the target count (frankomosh) 47 lines added or modified outside tests 39 lines added or modified in tests 18 lines removed in total 6 files, 1 commits (+) #36208 mzumsande addrman: apply time penalty in nTime check P3 · bug fix Ready 1 Mild 2 + 13 tests Prevent identical relayed address announcements from artificially inflating address multiplicity Ensure address entries are not given unwarranted presence in the new address table P3 because it fixes unintended multiplicity increases from identical relayed gossip The benefit is modest because it does not stop deliberate manipulation by peers Ranking pass: Grouped with the addrman bookkeeping fixes it interacts with. Support because it reduces inflated address counts on privacy networks (stratospher) Verified by reproducing the duplicate announcement issue in tests (frankomosh) Objection that the check blocks genuinely newer announcements after a refresh (taki-abedesselam, fametrano) Author agreed with the bug report and plans to address it in the next update 2 lines added or modified outside tests 13 lines added or modified in tests 2 lines removed in total 2 files, 1 commits (+) #36477 vasild private broadcast: show finished transactions in getprivatebroadcastinfo P3 · new feature Needs rebase 0 Strong 107 + 90 tests Keep finished private broadcast transactions in memory and expose them in getprivatebroadcastinfo Gives node operators visibility into send history, peer acknowledgments, and network echo details P3 because it improves visibility into private broadcasts without altering core relay protocols Benefit is limited to node operators inspecting local private broadcast send history Ranking pass: Stated prerequisite for P2 #36607 Concept approval because completed transaction info is useful to operators (optout21) Verified fixes for retry exhaustion and peer overwrite logic (frankomosh) Suggests retaining the received flag upon re-request if already in mempool (optout21) Suggests adding a test verifying received_by_us is not overwritten (frankomosh) 107 lines added or modified outside tests 90 lines added or modified in tests 71 lines removed in total 8 files, 1 commits (+) #34486 willcl-ark net: Reduce local network activity when networkactive=0 P3 · bug fix Needs rebase 0 (+1) Mild 139 + 217 tests Stop local NAT-PMP port mapping queries and Tor reconnect attempts when networking is disabled Ensures setting network inactive completely halts background network activity as users expect P3 because it fixes background network queries and retries when networking is toggled off Ensures node operators relying on inactive network mode have complete network isolation Ranking pass: Local-only misbehaviour of an operator toggle; ranks below relay and address correctness fixes. Ready for review Author has open review comments from fjahr to address Broad concept approval for stopping background network activity when inactive Approval based on testing port mapping and Tor teardown (brunoerg) Approach approval after testing backoff behavior (winterrdog) Unaddressed objection: test assertion checks an already passed backoff step (fjahr) Suggests using a wake signal instead of polling and counters for reactivation (fjahr) 139 lines added or modified outside tests 217 lines added or modified in tests 34 lines removed in total 13 files, 6 commits (+) #35600 willcl-ark net: prevent duplication manual connections (take 2) P3 · bug fix Ready 0 (+1) Strong 47 + 118 tests Prevent duplicate manual outbound P2P connections caused by racing startup options or concurrent addnode calls Fixes a long-standing issue where in-flight connection attempts bypass duplicate checks before completing P3 because it resolves an edge-case bug where racing manual connection attempts open duplicate connections Prevents redundant outgoing connections during startup or concurrent addnode invocations Ready to review Author accepted a cleanup suggestion that has not yet been pushed Strong substantive support with no blocking objections Verified by running functional suite, net unit tests, and checking failure modes (8144225309) Concept approval without stated reasons (sedited, w0xlt) Nonblocking suggestion to test addconnection during an in-flight manual connection (8144225309) 47 lines added or modified outside tests 118 lines added or modified in tests 1 lines removed in total 4 files, 2 commits (+) #36637 jpk68 torcontrol: send -torpassword hex-encoded to avoid escaping bugs P3 · bug fix Ready 1 (+1) Strong 3 + 39 tests Prevent Tor control authentication failures when passwords contain backslashes Ensure node operators can use arbitrary Tor control passwords without mangling P3 because it fixes authentication failures for Tor control passwords containing backslashes Only affects node operators configuring Tor control with passwords containing backslashes Ranking pass: Same Tor-auth bug as #36374 Substantive support with no open objections Verified against the Tor control spec documentation (vasild) Concept approval and tested on Windows 10 (winterrdog) Open suggestions on mock server checks and example comments (winterrdog, maflcko) 3 lines added or modified outside tests 39 lines added or modified in tests 6 lines removed in total 2 files, 1 commits (+) #36636 jpk68 netaddress: make .onion suffix check case-insensitive P3 · bug fix Ready 4 Strong 3 + 7 tests Prevent Tor addresses with uppercase suffixes from falling through to standard DNS resolution Avoids potential privacy leaks and connection failures when handling mixed-case onion addresses P3 because it fixes an edge case where uppercase onion addresses fall back to regular DNS resolution Plugs a minor privacy leak and prevents connection failures for mixed-case Tor destinations Ranking pass: Grouped with the other Tor/I2P address-handling fixes. Strong support with no open objections Verified by running net tests confirming failure on unpatched code (AndreaDiazCorreia) Verified by testing the build on Windows MSVC (winterrdog) Nonblocking suggestion to use CaseInsensitiveEqual to avoid a temporary string (Husteem) Approval without stated reasons (vasild) 3 lines added or modified outside tests 7 lines added or modified in tests 2 lines removed in total 2 files, 1 commits (+) #36374 0xShadowX torcontrol: escape backslashes in -torpassword P3 · bug fix Ready 2 Strong 2 + 29 tests Fix Tor control port authentication failing when passwords contain backslashes Ensure node operators with backslashes in -torpassword can create automatic onion services P3 because it fixes authentication failures when Tor control passwords contain backslashes. Prevents failed onion service setup for node operators using backslashes in their password. Ready to review No blocking concerns or pending invalidating changes Strong support with no open objections Verified against Tor spec and tested with live Tor daemon on FreeBSD and Linux (winterrdog) Concept approval without stated reasons (jpk68) 2 lines added or modified outside tests 29 lines added or modified in tests 0 lines removed in total 2 files, 1 commits (+) #36570 jpk68 i2p: pass base32 address directly to stream connect P3 · speedup Ready 0 Crickets 1 Avoid a redundant SAM bridge lookup round trip when making outbound I2P connections Correctly record peer reachability failures when an I2P address fails to resolve P3 because it reduces outbound connection latency by eliminating an extra SAM bridge round trip Ensures unresolvable peers are treated as reachability failures rather than proxy errors Ranking pass: Grouped with the Tor/I2P connection fixes; removes a round trip and corrects failure accounting. No review verdicts recorded No review comments or objections yet Reviewers have been tagged for input (fanquake) 1 lines added or modified outside tests 0 lines added or modified in tests 6 lines removed in total 1 files, 1 commits (+) #36718 Snan0M netaddress: don't treat multicast addresses as routable P3 · bug fix Ready 0 Crickets 7 + 15 tests Stop gossiped multicast IP addresses from entering addrman and being dialed Prevents nodes from wasting outbound connection slots on unreachable multicast targets P3 because filtering unreachable multicast addresses provides address-hygiene benefits that are deferrable Wasting outbound connection slots on multicast peers is a low-severity edge case No review verdicts recorded No substantive review comments yet Asked whether scope should cover existing addrman entries or just new gossip (ValeraFinebits) 7 lines added or modified outside tests 15 lines added or modified in tests 5 lines removed in total 4 files, 1 commits (+) #36014 w0xlt init: ignore repeated `-addnode` startup values P3 · bug fix Waiting on author 0 (+2) Strong 21 + 38 tests Ignore duplicate -addnode startup values to match the deduplication applied by runtime RPC calls Prevents redundant DNS lookups, repeated connection retries, and cluttered node info logs P3 because redundant connection retries and DNS lookups only occur when users configure duplicate entries Benefit is limited to node operators who specify duplicate manual connection targets at startup Ranking pass: Kept adjacent to #35600 Review is worthwhile now with no blocking dependencies or pending reworks Substantive support with no open objections Verified deduplication behavior on regtest with default port (AndreaDiazCorreia) Support for deduplicating startup values and port equivalence (danielabrozzoni, pablomartin4btc) Suggestion to log matched target when duplicate is rejected (pablomartin4btc) Concept approval without stated reasons (RandyMcMillan) 21 lines added or modified outside tests 38 lines added or modified in tests 9 lines removed in total 4 files, 2 commits (+) #34824 w0xlt net: encapsulate TxRelay state and replace recursive mutexes P3 · cleanup Ready 0 (+2) Strong 396 + 407 tests Encapsulate peer transaction relay data and eliminate recursive locking Prevents deadlocks and reduces fragile lock ordering in peer message processing P3 because it is an internal refactoring that cleans up lock boundaries without changing user behavior Reduces deadlock risk and clarifies concurrency invariants in peer message processing Unblocks further lock refactoring work Substantive support with all earlier objections resolved Support for improved encapsulation and replacing recursive mutexes (sedited, pablomartin4btc) Initial safety objections on thread analysis were resolved by avoiding exposed mutexes (maflcko, sedited) Concept approval without stated reasons (hebasto, theuni) 396 lines added or modified outside tests 407 lines added or modified in tests 192 lines removed in total 7 files, 6 commits (+) #30988 vasild Split CConnman P3 · cleanup Author silent 241d 1 (+1) -1 Mild 1,380 + 50 tests Separate low-level socket I/O from P2P protocol rules to simplify network code Allow socket event polling to be reused by services such as Stratum v2 or an embedded HTTP server Speed up peer lookups from linear to constant time P3 after comparing with the other PRs here (assessed alone as P2): Demoted to P3: like #35040 #34824 #35561 P2 because it addresses longstanding structural coupling between socket I/O and P2P connection logic High maintainability leverage across node networking that can unblock modular reuse in other services Needs rebase Author inactive for over 200 days, so review responses may be delayed Architectural objection: wrong abstraction level and ill-suited for HTTP or SV2 (theuni) Unaddressed safety objection: returning raw node pointers risks dangling references (hodlinator) Code review approval finding simplified networking and portable transport logic (ryanofsky) Tested peer connections across multiple platforms and signet (pinheadmz, Sjors) Concept approval without stated reasons (jonatack, tdb3) 1,380 lines added or modified outside tests 50 lines added or modified in tests 751 lines removed in total 20 files, 17 commits (+) #35561 Crypt-iQ net: move some CNodeState fields to Peer P3 · cleanup Needs rebase 0 (+2) Strong 40 + 2 tests Reduce global lock contention and lock inversion risks during P2P message handling and block relay Allow compact block negotiation and peer download tracking to proceed without locking the main mutex P3 because this is an incremental internal locking cleanup rather than a fix for an active bug Reduces main lock scope and avoids lock inversion hazards across message processing codepaths Performance benefit is theoretical without measured bottlenecks in practice Ready for review Clean rebase with no changes to the underlying logic Strong support across multiple reviewers with no open objections Support for reducing main lock scope where locks are unnecessary (davidgumberg) Verified the changes look safe and the atomic download counter is correct (dergoegge) Concept approval citing existing codebase precedent for the atomic pattern (mzumsande) 40 lines added or modified outside tests 2 lines added or modified in tests 42 lines removed in total 4 files, 3 commits (+) #35040 theuni Remove CNode dependency for local address functions and introduce LocalAddressManager P3 · cleanup Author silent 199d 0 Mild 346 + 75 tests Untangle local address tracking and scoring from peer connection handles Enable testing and fuzzing address advertisement logic without manipulating global state Help clean separation between networking code and peer processing P3 because it is an internal refactoring that does not alter peer-to-peer wire protocol behavior Improves testability of address selection and helps untangle networking from peer processing Ranking pass: Ranked with the other net/net_processing restructuring PRs it shares scope with. Needs rebase and CI is failing Author has been silent for 154 days after moving to draft to resolve circular dependencies No review verdicts recorded Limited feedback with no formal approvals yet Nonblocking objection: new node library file belongs in src/node/ rather than top level (maflcko) 346 lines added or modified outside tests 75 lines added or modified in tests 406 lines removed in total 23 files, 23 commits (+) #35027 8144225309 net: add -outboundbind option for outgoing source address P3 · user request Author silent 74d 0 Strong 168 + 391 tests Allow node operators on multi-homed machines to choose the local source address for outbound connections Avoids relying on the operating system routing table to pick the outbound network interface P3 because multi-homed node operators gain control over their outbound IP selection Solves a long-standing configuration request for specialized setups while remaining deferrable Ranking pass: Niche multi-homed configuration need; placed with the other opt-in operator options. Strong support for adding a separate option rather than changing existing bind semantics (vasild) Concept approval without detailed rationale (frankomosh) Approach approval with interest in alternative option naming (winterrdog) Past objections to overloading bind were resolved by using a dedicated option (luke-jr, gmaxwell) 168 lines added or modified outside tests 391 lines added or modified in tests 8 lines removed in total 10 files, 3 commits (+) #35940 w0xlt net: allow selecting BIP152 high-bandwidth peers with `-addnode` P3 · new feature Waiting on author 0 Strong 81 + 108 tests Allow node operators to designate specific peers for persistent high-bandwidth compact block relay Ensure multi-site setups and private peering links announce compact blocks immediately and after reconnects P3 because it offers a niche opt-in improvement for operators with multi-site nodes or private peering Automatic dynamic high-bandwidth peer selection already functions without manual configuration Substantive concept support with no open objections Supports explicit operator control over compact block peer selection and reusing -addnode (jeanpablojp) Concept approval noting advanced operator control, while requesting more functional test coverage (Bicaru20) 81 lines added or modified outside tests 108 lines added or modified in tests 16 lines removed in total 8 files, 4 commits (+) #29418 vasild rpc: provide per message stats for global traffic via new field in 'getnettotals' P3 · user request Ready 0 (+1) Strong 354 + 150 tests Expose cumulative message and byte statistics broken down by direction, network, and connection type Allows node operators and researchers to monitor network bandwidth without continuously polling peer stats P3 because it adds cumulative message accounting without altering relay protocols or connection logic Introduces atomic counters to message send and receive paths without changing peer behavior Ranking pass: Operator observability ranks below behavioural fixes and structural work in this band. Tested on node monitoring dashboards with positive feedback (waketraindev) Support for exposing detailed message metrics with minimal RPC layer logic (stickies-v) Objection to server-side aggregation resolved by dropping the aggregation commit (stickies-v) Concept approval without detailed rationale (danielabrozzoni, epiccurious) 354 lines added or modified outside tests 150 lines added or modified in tests 14 lines removed in total 8 files, 3 commits (+) #35315 maflcko refactor: Use NodeClock::time_point in more places P3 · cleanup Author silent 103d 3 (+2) Strong 148 + 35 tests Standardize absolute time tracking across P2P and networking code using strongly typed time points Eliminate type confusion and second-level truncation that causes arbitrary tie-breaking in peer eviction P3 because it improves type safety and readability across peer-to-peer networking modules Increases precision so peer eviction tie-breaking relies on exact timing rather than arbitrary peer IDs Ranking pass: Mostly type hygiene with only a marginal eviction-precision gain. Needs rebase and author response after 92 days of inactivity Strong support with all objections resolved (ryanofsky, stickies-v) Strong support for type safety and clearer time representation (ryanofsky, stickies-v) Verified by running unit and P2P functional test suites (seduless, jeanpablojp) Rebase requested (sedited) 148 lines added or modified outside tests 35 lines added or modified in tests 181 lines removed in total 24 files, 10 commits (+) #35368 w0xlt tracing: add block header and compact block tracepoints P3 · new feature Needs rebase 0 Strong 99 + 270 tests Expose header arrival and compact block reconstruction events to external diagnostic tools Avoid parsing string-based debug logs for continuous production monitoring and peer attribution P3 because diagnostic observability for compact block relay efficiency is helpful but non-critical Measuring relay performance without log parsing overhead is deferrable tooling instrumentation Ranking pass: Diagnostic tooling, below the behaviour-changing PRs in the band. Ready to review now because the conflict with master is mechanical Strong support for exposing compact block relay data without log parsing (0xB10C) Concept approval without stated reasons (m4ycon) Questioned adding tracepoints ahead of clarifying the IPC tracing approach (stickies-v, maflcko) All questions on tracepoint approach and scope have author or reviewer replies 99 lines added or modified outside tests 270 lines added or modified in tests 6 lines removed in total 6 files, 2 commits (+) #33954 mzumsande test: add functional test for outbound connection management P3 · test coverage Waiting on author 0 (+2) Strong 0 + 398 tests Add functional test coverage for autonomous outbound connection decisions made by bitcoind Enable end-to-end testing of stale tip peers, block-relay rotations, and network diversification P3 because it adds functional test coverage for outbound connection heuristics without node changes Helps developers verify autonomous peer selection rules that previously lacked test coverage Ranking pass: Valuable new coverage but test-only; ranked at the head of the test cluster rather than among bug fixes. Ready to review now because rebase conflicts with master are mechanical Substantive support after running functional tests locally without failures (vasild, Bortlesboat) Concept approval without stated reasons (0xB10C) Unresolved question on whether network connection timing could cause test timeouts (vasild) Open suggestions to pass address data to the factory and clarify a magic number (vasild, Bortlesboat) 0 lines added or modified outside tests 398 lines added or modified in tests 102 lines removed in total 4 files, 3 commits (+) #36470 brunoerg test: make p2p_eviction actually exercise block-time protection P3 · test coverage Ready 1 (+1) Strong 0 + 57 tests Ensure the peer eviction functional test actually exercises block-time protection for block-relaying peers Catch regressions that currently pass unnoticed because connection ordering masked broken eviction logic P3 because it fixes a test gap where inbound peer eviction logic for block relayers was completely bypassed Validates eviction protection without modifying production peer-to-peer code Ready to review All objections and reviewer suggestions have been addressed Substantive support with no open objections Verified with mutation testing that disabled block-time protection now fails as expected (trakshan-mishra) Supported because using mocktime makes the test deterministic and twice as fast (maflcko) 0 lines added or modified outside tests 57 lines added or modified in tests 43 lines removed in total 1 files, 1 commits (+) #36406 fametrano test: make p2p_orphan_handling's never-requested checks able to fail P3 · test coverage Ready 1 Strong 0 + 12 tests Ensure orphan handling tests genuinely verify node behavior instead of passing unconditionally Prevent false passes where request checks compared integers to strings P3 because it restores broken test coverage for orphan request rejection without altering node behavior Prevents regressions in orphan handling that previously bypassed CI checks unconditionally Ranking pass: Test-only repair of a vacuous assertion; ordered inside the test cluster. Support for catching and fixing the invalid test assertions (instagibbs) Suggestions for an assertion footgun check, code comments, and syntax were adopted and approved (instagibbs) 0 lines added or modified outside tests 12 lines added or modified in tests 6 lines removed in total 1 files, 2 commits (+) #36405 fametrano test: look for the wtxid in p2p_blocksonly P3 · test coverage Ready 2 Strong 0 + 5 tests Ensure tests reliably catch improper transaction announcements to block-relay-only peers Prevent tests from vacuously passing when witness transactions are announced P3 because it fixes a vacuous functional test assertion without changing node behavior Ensures future regressions in transaction filtering to block-relay-only peers are caught Ranking pass: Test-only repair of a vacuous assertion; ordered inside the test cluster. Strong support with no open objections Verified by testing failure and control cases across v1 and v2 transport (AndreaDiazCorreia) Approved after suggestions to add a positive receipt check were addressed (maflcko) Concept approval without stated reasons (mercie-ux) 0 lines added or modified outside tests 5 lines added or modified in tests 2 lines removed in total 1 files, 1 commits (+) #36410 fametrano test: cover compact blocks far ahead of the tip P3 · test coverage Ready 0 Crickets 0 + 85 tests Add test coverage for handling compact blocks received far ahead of the chain tip Ensure regression protection for fallback header processing and full-block re-request behavior P3 because it adds missing functional test coverage without touching production code Prevents regressions in compact block fallback handling and getdata re-requests Ranking pass: New coverage only; ordered inside the test cluster. No review verdicts recorded No review comments or discussion yet Awaiting initial feedback 0 lines added or modified outside tests 85 lines added or modified in tests 0 lines removed in total 2 files, 1 commits (+) #36617 maflcko test: Fix intermittent issue in p2p_orphan_handling.py P3 · bug fix Ready 1 Crickets 0 + 2 tests Prevent intermittent CI test failures in orphan transaction handling Ensure peer disconnection state is fully cleaned up before mock time advances P3 because it resolves an intermittent test race condition without altering node p2p behavior Improves CI reliability when testing orphan transaction relay logic Ready to review Nothing known that would invalidate a review No substantive feedback either way Approval without stated rationale from an account with no prior project history (Conradgabe) Resolved question regarding an existing test comment (Conradgabe) 0 lines added or modified outside tests 2 lines added or modified in tests 2 lines removed in total 1 files, 1 commits (+) #36670 frankomosh fuzz: check GetStale() returns exactly the stale private broadcast txs P3 · test coverage Ready 0 Crickets 0 + 26 tests Ensure fuzz testing catches bugs where stale private broadcast transactions are silently omitted Prevents unretried private broadcast transactions from slipping past tests unnoticed P3 because it closes a test gap in private broadcast retry logic without changing production code Mutant testing showed silent omissions of stale transactions previously passed all existing tests No review verdicts recorded Little feedback so far Suggested also asserting that returned stale transactions contain no duplicates (andrewtoth) 0 lines added or modified outside tests 26 lines added or modified in tests 0 lines removed in total 1 files, 1 commits (+) #36429 optout21 [RFC] Delayed transaction broadcast, minimal P4 · new feature Ready 0 Neutral 229 + 259 tests Prevent network observers from correlating transaction broadcast timing with off-chain user activity Allow users to schedule private transaction announcements with randomized delay directly from the node P4 after comparing with the other PRs here (assessed alone as P3): Demoted to P4: speculative RFC with author-only motivation that overlaps the randomized scheduling already part of the private broadcast rework. P3 because reducing timing correlation provides meaningful origin privacy for broadcasting nodes The proposed broadcast jitter mechanism addresses a deferrable privacy enhancement Ready for review with no known blockers or pending changes No review verdicts recorded Neutral overall with initial concerns answered and no explicit endorsements yet Questioned whether broadcast delays belong in client software rather than the node (ismaelsadeeq) Asked for concrete privacy gains and the harm in knowing transaction creation time (ismaelsadeeq) Noted that node restarts drop delayed transactions and nLockTime may reveal creation time (vasild) 229 lines added or modified outside tests 259 lines added or modified in tests 28 lines removed in total 12 files, 6 commits (+) #35502 w0xlt refactor: extract per-message helpers from ProcessMessage (move-only) P4 · cleanup Waiting on author 1 (+3) Strong 1,078 Break up the oversized P2P message handler to make peer processing easier to navigate and review Encapsulate individual message types into dedicated functions to improve code organization P4 after comparing with the other PRs here (assessed alone as P3): Demoted to P4 to match #35522 P3 because it is an internal refactoring that improves code organization without changing behavior It reduces friction for maintainers in peer processing but does not resolve protocol hazards Reviewing now is worthwhile because conflicts with master are mechanical and do not affect the logic Broad support for breaking up the handler to improve navigation and encapsulation (stickies-v, maflcko) Verified pure move-only extractions and thread-safety annotations (pseudoramdom, thomasbuilds) Reimplemented and verified locally with test coverage and color-moved diffs (l0rinc, pablomartin4btc) Conceded initial objection that separate helpers add caller friction (davidgumberg) Open suggestion to add a prepare commit removing function prefixes from debug logs (pablomartin4btc) 1,078 lines added or modified outside tests 0 lines added or modified in tests 1,029 lines removed in total 1 files, 10 commits (+) #35522 pablomartin4btc refactor: Extract per-message helpers from SendMessages() (move-only) P4 · cleanup Ready 0 (+1) Strong 679 Make peer-to-peer message sending logic easier to navigate, review, and analyze for thread safety Break apart monolithic message dispatching and timeout handling into discrete, named steps P4 because it is an internal move-only refactoring of message dispatching logic Brings no behavioral, protocol, or performance changes Aids maintainers navigating the code rather than addressing an active P2P issue Substantive support with no open objections (w0xlt, hodlinator) Approach approval noting it follows a proven cleanup pattern (w0xlt) Concept approval because named helpers make code navigation and review easier (hodlinator) Concerns resolved regarding PR description policy and debug log formatting (maflcko) 679 lines added or modified outside tests 0 lines added or modified in tests 453 lines removed in total 1 files, 19 commits (+) #34271 vasild net_processing: make m_tx_for_private_broadcast optional P4 · cleanup Waiting on author 0 (+1) Mild 91 Avoid constructing unused private broadcast state when the opt-in feature is disabled Cleans up default node startup and memory usage when private broadcast is turned off P4 because it is a minor internal cleanup with negligible runtime impact on default nodes Benefits only default nodes by skipping idle initialization for an opt-in feature Needs rebase Waiting on author to address an open objection before further review is worthwhile Unaddressed objection: does not reduce object size without indirection, no author reply (l0rinc) Questioned whether optional storage conflicts with making private broadcast core (mzumsande) Verified by checking all touched call sites and running unit tests locally (optout21) Concept approval without stated reasons (polespinasa, w0xlt) 91 lines added or modified outside tests 0 lines added or modified in tests 40 lines removed in total 2 files, 1 commits (+) #36451 maflcko refactor: Use NotNull for CreateNewBlock and pimpls P4 · cleanup CI failing 0 Strong 30 + 13 tests Clarify pointer contracts by enforcing non-null semantics for block creation and internal implementations Eliminate confusing null checks and dead error-handling branches in tests and callers P4 because changing internal pimpl pointers across p2p classes is purely internal type hygiene Does not affect network behavior, protocol handling, or attack resistance CI is failing so check whether the failure belongs to this PR before a deep review Concept approval because it adds useful clarity to block template creation (Sjors) Concept approval without stated reasons (sedited, stickies-v) 30 lines added or modified outside tests 13 lines added or modified in tests 34 lines removed in total 20 files, 3 commits (+) #36580 maflcko refactor: Use util::log::FormatString in BaseIndex::FatalErrorf and LogConnectFailure P4 · cleanup Ready 1 Positive 6 Prevent trailing newlines in logging helpers from producing escaped newline characters in log output Catch invalid format strings at compile time rather than letting malformed logs slip into runtime P4 because formatting guards for connection failures do not alter networking logic or reliability Offers minor hygiene benefits with no behavioral change Approval without stated reasons (stickies-v) No open objections or unresolved concerns 6 lines added or modified outside tests 0 lines added or modified in tests 7 lines removed in total 3 files, 1 commits (+) #36707 fanquake net_processing: remove redundant `peer` check in `MaybePunishNodeForBlock` P4 · cleanup Ready 4 Strong 1 Remove a redundant peer null check in block punishment logic Cleans up dead branching and clutter in network processing code P4 because this is a minor cleanup of an already-guarded condition Carries negligible risk and has no behavioral or performance impact Unanimous support with no objections Verified safe because peer cannot be reseated between checks (l0rinc) Approval without stated reasons (Crypt-iQ, jpk68, ViniciusCestarii) 1 lines added or modified outside tests 0 lines added or modified in tests 1 lines removed in total 1 files, 1 commits