#36572 ipc: hold event loop references when using it in `CapnpProtocol`

Guards the IPC event loop in `CapnpProtocol` with a mutex and acquires explicit `EventLoopRef` references across protocol operations. This ensures that methods running on non-IPC threads keep the event loop alive and prevent concurrent destruction while in use.

Problem: In multiprocess `serve()` mode, only the parent connection holds a reference keeping the event loop running. Other `CapnpProtocol` methods called from background threads lack their own loop references and access unprotected loop state, which can cause use-after-free crashes or unexpected termination if the parent connection closes.

Evidence of importance:

• PR description: 'In serve() mode, the parent connection is the only reference keeping the loop running. Other CapnpProtocol methods called from threads not handling parent IPC requests do not hold their own references and therefore depend on the parent connection remaining alive.'

Risk of a mistake: low (other). Mistakes could cause deadlocks or crashes in experimental multiprocess IPC builds without affecting standard monolithic bitcoind builds.

Changed since the previous assessment: Now provides the full patch implementing `m_loop_mutex` and `loopRef()` across `src/ipc/capnp/protocol.cpp`.

Ready · Needs rebase

Conflicts with master; review the logic now, the rebase is mechanical.

Waiting on (from the thread read):

• nothing

Strong

substantive support, no open objection (Hamza1610)

Thread notes: Initial record. Husteem pointed out a minor style nit about a redundant trailing semicolon, which is not an item. Hamza1610 provided a Tested ACK. / Initial record. Hamza1610 provided a Tested ACK. Husteem's comment on a redundant trailing semicolon was excluded from claims as a style nit.

Objections, suggestions, and questions: none recorded.

Support:

• Hamza1610 (none) (Tested ACK, 2026-10-20) [tested: ipc_tests]: tested the changes using `./build/bin/test_bitcoin -t ipc_tests` and confirmed no error is detected

Participants:

• Hamza1610 (none, support, 1 statements 2026-10-20 to 2026-10-20): tested ACK confirming ipc_tests pass
• Husteem (none, neutral, 1 statements 2026-10-20 to 2026-10-20): left a style nit about a redundant trailing semicolon

0 lines under test/bench/ci.

• src/ipc/capnp/protocol.cpp +68/-23

The short text the ranking pass compares across PRs.

Ensures CapnpProtocol methods hold active references to the IPC event loop and guards loop creation and destruction with a mutex. In multiprocess serve mode, only the parent connection previously held a loop reference, causing races or crashes if other threads invoked protocol methods while the parent disconnected or before setup completed. The change introduces a thread-safe loopRef helper that keeps the loop alive during these calls.

P1 · bug fix (assessed alone as P2; Raised to P1: same class of IPC event-loop use-after-free/termination as #35932 and #36520, which are P1.)

Prevents potential use-after-free crashes and unexpected termination in multiprocess `serve()` mode by properly managing event loop references and thread safety. The PR description notes that methods called from background threads 'do not hold their own references and therefore depend on the parent connection remaining alive,' risking crashes if the connection closes.

Membership: Modifies `src/ipc/capnp/protocol.cpp` to fix event loop lifetime and concurrency issues in Cap'n Proto IPC serve mode.

Factors: security/stability 2, bug 2, performance 0, user value 1, leverage 1