(+) #36521 sipa Keep witness stacks in serialized form in CScriptWitness P1 · DoS protection Needs rebase 0 (+1) -1 Blocked 502 + 752 tests Protect nodes from memory exhaustion and slow deserialization caused by crafted witness data Stop peers from inducing large memory allocations with malformed transactions or blocks P1 because it removes a severe block deserialization denial-of-service vulnerability Worst-case block deserialization drops from 279 ms to 19 ms and peak memory drops from 182 MiB to 8 MiB Review is worthwhile now as nothing is known to invalidate it Broad concept support for mitigating exceptional transaction memory bloat (furszy, 0xB10C, instagibbs) Verified by testing on Windows after initial efficiency suggestions were addressed (Yudis-bit) Unaddressed objection: memory allocation remains high for unknown witness versions (fametrano) Approach objection: excessive churn across 76 files before abstracting data access (purpleKarrot) 502 lines added or modified outside tests 752 lines added or modified in tests 279 lines removed in total 76 files, 17 commits (+) #36586 l0rinc coins: warn of low disk space before chainstate compaction P1 · bug fix Ready 2 Disputed 28 Avoid node crashes and shutdown hangs on low-disk systems by deferring background chainstate compaction Keep compaction status logged by default and skip periodic compaction for in-memory databases P1 because it fixes a stability regression causing node crashes or hung shutdowns on tight disks Compaction temporarily doubles database disk usage, risking disk exhaustion on low-margin nodes Support after addressing compaction handling and log phrasing (optout21, stickies-v) Concept approval without stated reasons (sedited) Unaddressed objection: warns on deferred compaction though low-disk users cannot act on it (andrewtoth) Suggests dropping the release note for this change (andrewtoth) 28 lines added or modified outside tests 0 lines added or modified in tests 14 lines removed in total 6 files, 3 commits (+) #35524 winterrdog validation: Avoid rewriting the genesis block during index recovery P1 · bug fix Needs rebase 0 Crickets 40 Prevent reindexing from silently destroying block data on systems without native posix_fallocate Avoid rewriting the genesis block and zeroing subsequent blocks during block index recovery P1 after comparing with the other PRs here (assessed alone as P2): Raised to P1: silent destruction of block data during reindex on supported platforms (*BSD/OmniOS) is data loss, on par with the other P1 crash/reindex bugs here P2 because recovering a missing index destroyed valid blocks and left nodes stuck at height 0 Protects chain data integrity during index recovery on platforms like *BSD and OmniOS No review verdicts recorded No substantive review comments either way yet Suggestion to widen offset type for safety was adopted (thomasbuilds) Author tested an alternative approach and found it did not fix the bug alone (sedited) 40 lines added or modified outside tests 0 lines added or modified in tests 19 lines removed in total 2 files, 2 commits (+) #36149 mzumsande validation: Leave pruned blocks in `m_blocks_unlinked`, fix another `nSequenceId` issue P1 · bug fix Ready 1 Strong 30 + 39 tests Prevent assertion crashes and node inconsistency when pruned blocks receive late parents or are redownloaded Avoid block candidate lookup failures caused by corrupting sort order during redownloads P1 because it resolves block index crashes and internal data structure corruption Fixes assertion failures in block index checks when handling pruned blocks Prevents lookup failures in candidate block sets and ensures accurate chain transaction counts Ready to review Author is exploring an alternative rework in draft, but no blockers are noted Strong support with substantive fuzz testing and review (jeanpablojp, marcofleon) Verified the fuzz target catches candidate set ordering failures without the fix (jeanpablojp) Tested that the fix resolves potential undefined behavior in candidate lookups (marcofleon) Minor suggestions on RPC help text and test coverage remain open (jeanpablojp, marcofleon) 30 lines added or modified outside tests 39 lines added or modified in tests 37 lines removed in total 5 files, 4 commits (+) #36702 shuv-amp validation: don't treat snapshot block as linked on startup P1 · bug fix Ready 0 Strong 8 + 7 tests Prevent an assertion crash on startup during AssumeUTXO background sync if restarting with unlinked blocks Avoid forcing a node reindex that wipes the snapshot chainstate to recover from unlinked snapshot blocks P1 because it fixes a startup assertion crash loop that permanently bricks startup without a reindex Prevents losing background AssumeUTXO sync progress when the snapshot block arrives ahead of its parents No review verdicts recorded Verified by reproducing the startup crash and confirming the fix on Windows x64 (ValeraFinebits) 8 lines added or modified outside tests 7 lines added or modified in tests 0 lines removed in total 3 files, 1 commits (+) #36346 0xShadowX validation: don't accept txs to the mempool while loading a snapshot P1 · bug fix Ready 0 Crickets 28 + 54 tests Prevent node aborts and mandatory reindexing when transactions enter the mempool while loading a snapshot Reject mempool submissions and concurrent snapshot loads while snapshot activation is in progress P1 because transactions entering the mempool during snapshot validation hit an assertion failure Terminates the process after metadata is written to disk, requiring a full reindex to recover No review verdicts recorded Suggested blocking mempool entry during loading instead of failing activation later (fjahr) Author updated the implementation to follow that approach and is waiting for review 28 lines added or modified outside tests 54 lines added or modified in tests 0 lines removed in total 3 files, 1 commits (+) #36452 l0rinc validation: fix false corruption errors after pruning or AssumeUTXO P2 · bug fix Ready 0 Crickets 11 + 20 tests Prevent false database corruption errors and failed restarts on pruned nodes and AssumeUTXO snapshots Treat missing block undo records as unavailable history rather than corruption during chain verification P2 because it fixes false corruption reports that abort startup when refetched blocks lack undo data Prevents spurious node restart failures and unblocks pending pruneassumevalid and pruned txindex work Ranking pass: Moved up: concrete startup-blocking false-corruption bug on pruned/assumeutxo nodes, and it unblocks pruneassumevalid and pruned-txindex work Reviewable now; no open blockers or rebases invalidate review No review verdicts recorded No formal approvals or objections recorded yet Verified through extensive testing on Linux aarch64 (cyb3ralbert) Questions open on AssumeUTXO scope and interaction with #35307 on verifychain behavior (cyb3ralbert) Clarified how this can trigger under default checks with AssumeUTXO (andrewtoth) 11 lines added or modified outside tests 20 lines added or modified in tests 5 lines removed in total 3 files, 3 commits (+) #36049 l0rinc streams: avoid termination on buffered write failure P2 · bug fix Waiting on author 1 Strong 19 + 36 tests Prevent the node from abruptly crashing when disk writes fail during block storage Enable clean error reporting and graceful shutdown instead of sudden process aborts P2 because disk full conditions during block writing cleanly trigger storage error handling Avoids unexpected node crashes when disk space runs out during block storage Ranking pass: Moved up: author observed real std::terminate crashes on disk-full; most certain benefit of the error-handling group Reviewable immediately with nothing known that would invalidate a review Support from a contributor who ran into the same bug while working in this area (w0xlt) Asked why storage write errors should be caught instead of crashing, answered by author (andrewtoth) Suggested finding a wholesale pattern or linter check for destructor exceptions (maflcko) 19 lines added or modified outside tests 36 lines added or modified in tests 5 lines removed in total 3 files, 3 commits (+) #35003 furszy validation: improve block data I/O error handling in P2P paths P2 · bug fix Waiting on author 1 (+4) -1 Blocked 15 + 533 tests Prevent nodes from hanging or crashing when block storage encounters filesystem errors Ensure fatal storage failures trigger a clean shutdown rather than silently stalling block relay P2 because it stops block I/O errors from bypassing fatal error handling during chain activation Prevents nodes from becoming silently stuck when the block storage directory is inaccessible Provides durable crash safety and reliability improvements for chainstate storage invariants Ranking pass: Moved up: silently stuck node on block-storage I/O errors is a reliability bug, ranked with the other storage-error fixes Reviewing now is worthwhile as there are no pending changes invalidating review Unaddressed objection: getrawtransaction under txindex masks storage errors as missing txs (w0xlt) Unaddressed objection: introduces index regressions and leaves error handling inconsistent (maflcko) Contested objection: returning nullptr for low-level file errors loses failure context (josibake) Support for improved test coverage and preventing silent hangs during I/O failures (frankomosh, l0rinc) 15 lines added or modified outside tests 533 lines added or modified in tests 7 lines removed in total 10 files, 5 commits (+) #34132 l0rinc coins, dbwrapper: remove error catcher, make point-read failures fatal P2 · bug fix Ready 0 (+2) Blocked 139 + 153 tests Prevent nodes from continuing to run with damaged state when database reads encounter corruption Stop treating corrupted records as merely missing keys during coin and index lookups P2 because deserialization failures in the UTXO database were treated as missing keys rather than errors Ensuring corrupt coin reads fail safely protects chainstate integrity across validation lookups Unaddressed objection: aborting in DB reads breaks startup recovery and kills kernel hosts (furszy) Unaddressed objection: aborting on optional index corruption halts nodes for non-critical errors (ajtowns) Unaddressed objection: thread safety of the GUI message box callback before abort is unclear (ajtowns) Support for removing indirection in the coin view stack (andrewtoth) Verified with code review and local unit tests (optout21) 139 lines added or modified outside tests 153 lines added or modified in tests 381 lines removed in total 33 files, 9 commits (+) #36280 furszy validation: throw when a compressed script can't be decompressed P2 · bug fix Waiting on author 1 Mild 7 + 89 tests Prevent corrupted compressed scripts from silently becoming spendable empty scripts Ensure decompression failures raise an explicit error rather than silently returning a blank script P2 because corrupted UTXO records can silently turn unspendable outputs into anyone-can-spend scripts Prevents invalid or corrupted data from causing unintended spending behavior during validation Ranking pass: Moved up: corrupted compressed script silently becoming anyone-can-spend is a fund-safety-adjacent correctness hazard Broad support for fixing silent decompression failures, but an objection remains unaddressed Unaddressed objection: rollback snapshots skip unreadable coins and can succeed with missing coins (l0rinc) Support because error handling aligns with existing decoding exceptions (purpleKarrot) Verified by testing against thousands of test vectors and corrupted snapshots on regtest (fametrano) 7 lines added or modified outside tests 89 lines added or modified in tests 9 lines removed in total 3 files, 2 commits (+) #36621 mutatrum node: batch block file pruning in a single pass over block index P2 · speedup Ready 0 Crickets 29 + 86 tests Prevent node freezes when switching an existing node with full history to pruned mode Greatly reduce the time required to prune many block files at once P2 because it eliminates long startup hangs holding the main lock when switching a node to pruned mode Reduces pruning time from up to 10 minutes down to milliseconds on low-power hardware like a Raspberry Pi No review verdicts recorded No reviews or comments yet Awaiting initial feedback 29 lines added or modified outside tests 86 lines added or modified in tests 13 lines removed in total 4 files, 1 commits (+) #36000 l0rinc validation: prefetch blocks while connecting P2 · speedup Waiting on author 0 (+2) Strong 176 + 93 tests Read upcoming blocks asynchronously from disk ahead of time during block connection Avoids validation thread stalls from disk I/O, speeding up initial block download and reindexing P2 because prefetching blocks avoids validation thread stalls during disk reads Speeds up initial block download by 1.15x and reindexing by up to 1.53x across SSD and HDD Ranking pass: Moved up: measured 1.15x IBD / 1.53x reindex gain is the largest well-benchmarked validation speedup in this band Ready to review, with nothing known that would invalidate a review now Strong support with substantive performance verification and no blocking objections Verified speedups in initial block download and reindex benchmarks (andrewtoth) Verified lack of race conditions with block writes, pruning, and indexes (arejula27) Minor open suggestions on doc comments and an early return (andrewtoth, arejula27) 176 lines added or modified outside tests 93 lines added or modified in tests 14 lines removed in total 19 files, 8 commits (+) #36244 w0xlt validation, net: Process blocks asynchronously and reduce cs_main contention P2 · speedup Needs rebase 0 Crickets 895 + 2,265 tests Keep peer message processing responsive during block validation and chain activation Prevent peer stalls, ping latency spikes, and slow block serving during heavy block processing P2 because it decouples chain activation and block persistence from message handling Reduces lock contention and trims initial block download time by roughly 5% Ranking pass: Moved up: user-visible responsiveness fix plus ~5% IBD, broader effect than the other speedups below it No review verdicts recorded No substantive review comments either way yet Asked whether steady-state responsiveness is the primary motivation, author confirmed (andrewtoth) 895 lines added or modified outside tests 2,265 lines added or modified in tests 294 lines removed in total 42 files, 20 commits (+) #36603 ajtowns Improve loadtxoutset performance P2 · speedup Ready 0 Mild 1,110 + 213 tests Speed up assumeutxo snapshot loading during node startup Reduce memory overhead and redundant disk flushes when importing UTXO snapshots P2 because it addresses a major performance bottleneck in node bootstrap Parallelizes snapshot import and avoids redundant cache staging and disk flushes No review verdicts recorded Unaddressed objection: adds assumeutxo complexity to consensus paths (l0rinc) Questioned whether speeding up snapshot loading justifies code complexity (l0rinc) Author defended the approach for fast node startup with no further reply yet (l0rinc) 1,110 lines added or modified outside tests 213 lines added or modified in tests 472 lines removed in total 27 files, 12 commits (+) #35793 darosior Implement BIP 54 (Consensus Cleanup) without mainnet activation P2 · DoS protection Needs rebase 2 Mild 151 + 6,433 tests Implement BIP 54 consensus cleanup rules on regtest without activating them on mainnet Allow developers to test mitigations for timewarp attacks, Merkle collisions, and sigops CPU exhaustion P2 because it mitigates timewarp attacks, Merkle collisions, and legacy sigops CPU exhaustion Enables testing and evaluation of the consensus cleanup soft fork in Bitcoin Core before public rollout Ranking pass: Moved down slightly: regtest-only soft-fork implementation ranks below concrete bug/perf fixes, but first among the soft-fork group since it mitigates real attack classes ACK: instagibbs , fametrano Concept ACK: dergoegge , fanquake , polespinasa , theStack , hsjoberg , fjahr , stickies-v , nervana21 , 0xB10C , ViniciusCestarii Broad concept approval across maintainers and contributors Verified with mutation testing against Inquisition (instagibbs) and btclib vectors (fametrano) Unaddressed objection: breaks getblocktemplate on regtest without consensuscleanup parameter (optout21) Open questions on cache edge cases and requests for pre-activation test coverage (ariard, ViniciusCestarii) 151 lines added or modified outside tests 6,433 lines added or modified in tests 123 lines removed in total 39 files, 22 commits (+) #32427 sedited kernel: Replace leveldb-based BlockTreeDB with WAL and .dat file based store P2 · new feature Waiting on author 0 (+6) Blocked 988 + 769 tests Allow external applications using libbitcoinkernel to inspect block and header data concurrently Remove the exclusive database lock that forces users to shut down Bitcoin Core to run indexers P2 because it replaces the block index storage engine, affecting node crash safety and startup migration Directly impacts validation persistence, file locking, and data integrity under power loss Needs rebase Author silent 84 days and reworking parallel reader access after converting to draft Stale ACK: willcl-ark , w0xlt , josibake , janb84 , alexanderwiederin , yuvicc Approach ACK: edilmedeiros Concept ACK: theuni , ismaelsadeeq , marcofleon , l0rinc , stickies-v , HowHsu , craigraw Broad interest in removing the LevelDB dependency and enabling parallel indexing (josibake, theuni) Verified by differential fuzzing for 5000 CPU hours without issues (marcofleon) Unaddressed objection: LockDirectory succeeds without locking on re-lock and drops the lock (pzafonte) Unaddressed objection: directory committing is a no-op on Windows risking corruption (stickies-v) 988 lines added or modified outside tests 769 lines added or modified in tests 201 lines removed in total 31 files, 10 commits (+) #35646 yuvicc RFC: Separate out runtime errors from BlockValidationState using `util::Expected` P2 · unblocks #35570 Waiting on author 0 -1 Blocked 342 + 233 tests Separate system runtime errors like disk or memory failures from consensus block validity Prevent operational failures from being mistaken for invalid blocks across node routines P2 because it eliminates an architectural hazard across block connection and storage Unblocks returning clean validation state directly from validation methods in #35570 Reviewing logic now is worthwhile even though the branch has merge conflicts The rebase is mechanical and does not disrupt the ongoing design discussion General support for separating fatal runtime errors from block validation (optout21, hodlinator, l0rinc) Unaddressed objections on fallthrough bugs and changed notification behavior (optout21) Concept objection against expected returns over exceptions citing chain split risks (purpleKarrot) Concern that flattening results into booleans leaves safety to reviewer checks (alexanderwiederin) 342 lines added or modified outside tests 233 lines added or modified in tests 369 lines removed in total 40 files, 16 commits (+) #31989 jamesob BIP-119 (OP_CHECKTEMPLATEVERIFY) (regtest only) P2 · new feature Waiting on author 0 (+1) -2 Blocked 244 + 3,439 tests Allow covenant protocol developers to test BIP-119 transaction templates against Bitcoin Core in-tree Enable testing interactions between OP_CHECKTEMPLATEVERIFY and other proposed soft-fork opcodes P2 after comparing with the other PRs here (assessed alone as P1): Lowered to P2 to match the other regtest-only proposed-opcode implementations (#32247 #29247 #36122 P1 because it introduces consensus rules for a major proposed soft fork It unblocks ecosystem evaluation of covenant designs without requiring custom out-of-tree builds Thorough consensus review is critical to verify validation logic and caching correctness Needs rebase and author response to long-standing objections before further review is worthwhile Object to adding consensus rules without emergent community consensus (darosior, BitcoinErrorLog) Warn of contentious chain split risks without clear community consensus (melvincarvalho, michaelfolkson) Support for enabling covenant protocols and testing on non-production networks (jaybny, prasincs, ariard) Code approval for implementation correctness and test coverage (rot13maxi, JeremyRubin) 244 lines added or modified outside tests 3,439 lines added or modified in tests 23 lines removed in total 33 files, 9 commits (+) #32247 jamesob BIP-348 (OP_CHECKSIGFROMSTACK) (regtest only) P2 · new feature Waiting on author 0 (+1) Mild 135 + 161 tests Allow smart contract developers to test covenants, oracles, and delegated signatures against node consensus Enable verifying signatures over arbitrary stack data in Tapscript on regtest P2 because proposed consensus opcodes require thorough interpreter review even when limited to regtest Unblocks experimentation with covenant designs and oracle protocols against node consensus logic Ranking pass: Grouped with the other regtest-only opcode proposals Waiting on author response to an open objection Needs rebase Support for matching BIP-348 semantics with a sound implementation (JeremyRubin) Verified with comprehensive tests for edge cases and the sigops budget (instagibbs) Concept approval without stated reasons (jonatack, shahsb, yuvicc, delta1) Nonblocking objection: restricting opcode to Tapscript limits use cases, no reply (1440000bytes) 135 lines added or modified outside tests 161 lines added or modified in tests 12 lines removed in total 20 files, 3 commits (+) #29247 arminsabouri CAT in Tapscript (BIP-347) P2 · new feature Author silent 169d 0 Blocked 46 + 742 tests Enable byte and string concatenation in Tapscript under the standard 520-byte stack element limit Provide interpreter logic and test harness support for BIP-347 evaluation without bundling activation P2 because it implements a major consensus opcode proposal in the Tapscript interpreter Validates execution correctness and 520-byte stack bounds for prospective script capabilities Ranking pass: Grouped with the other proposed-opcode implementations rather than ahead of concrete fixes Review is likely to wait on the author, who has been inactive on the PR for over four months No review verdicts recorded Blocking objection: cannot merge a consensus opcode without project or community consensus (achow101) Nonblocking objection: standard limit enables unintended introspection like SIGHASH assembly (moonsettler) Support for merging the opcode implementation into the interpreter (EthanHeilman) 46 lines added or modified outside tests 742 lines added or modified in tests 7 lines removed in total 9 files, 3 commits (+) #29491 fjahr [EXPERIMENTAL] Schnorr batch verification for blocks P2 · speedup CI failing 0 Strong 2,452 + 276 tests Speed up block validation and initial sync by batch verifying Taproot Schnorr signatures Reduce CPU overhead during block connection by verifying signature cache misses simultaneously P2 because batching cache misses significantly cuts CPU overhead during IBD and block connection Provides the largest validation speedups on blocks with heavy Taproot usage Ranking pass: Moved down: benefit is real but gated on unmerged upstream secp256k1 work and explicitly experimental CI is failing, so verify whether the failure is related to this PR before doing a deep review No review verdicts recorded Substantive support after earlier performance and lock contention issues were resolved (Sjors, Eunovo) Support highlighted speedups on Taproot blocks and batch tweak verification readiness (Sjors, Eunovo) Open request to document how batch verification and signature collection works (Sjors) 2,452 lines added or modified outside tests 276 lines added or modified in tests 172 lines removed in total 56 files, 11 commits (+) #36122 fjahr BIP460: CISA for Taproot key path spends P2 · new feature Waiting on author 0 Strong 7,680 + 3,565 tests Allow cross-input signature aggregation for Taproot key path spends to reduce transaction size and fees Lower fee overhead for multi-party collaborative transactions like CoinJoin and Payjoin P2 because it supplies the consensus reference implementation for BIP460 soft-fork validation Evaluating consensus rules and validation safety is critical for the long-term consensus roadmap Worth reviewing now, but check if CI failures are caused by this PR before a deep review No review verdicts recorded Substantive support after testing consensus logic against BIP460 vectors and edge cases (fametrano) Objections regarding wallet signing and PSBT input grouping were addressed in code (BarneyChambers) Open suggestion to update vendored consensus test vectors to match the latest BIP copy (fametrano) 7,680 lines added or modified outside tests 3,565 lines added or modified in tests 219 lines removed in total 111 files, 22 commits (+) #35861 fjahr Testnet 5 (BIP95) P2 · new feature Waiting on author 0 Blocked 317 + 6,426 tests Introduce Testnet 5 to provide a public test network enforcing BIP 54 cleanup rules from genesis Prevent testnet difficulty manipulation by eliminating the 20-minute minimum-difficulty rule P2 because it protects testnet users from difficulty manipulation attacks experienced on prior networks Unblocks ecosystem testing of proposed BIP 54 consensus cleanup rules on a live network Ranking pass: Moved down: value is contingent on BIP 54 (#35793 Review #35793 Conflicts with master, but review the logic now because the rebase is mechanical No review verdicts recorded Blocked by an unaddressed objection regarding network port configuration Unaddressed objection: Tor port clashes with testnet3, no author reply (darosior) 317 lines added or modified outside tests 6,426 lines added or modified in tests 129 lines removed in total 59 files, 25 commits (+) #36543 l0rinc validation: check the most recent AssumeUTXO commitment during IBD P2 · new feature Waiting on author 0 Blocked 110 + 106 tests Audit hardcoded AssumeUTXO snapshot commitments during standard IBD Crowdsource verification of baked-in snapshot hashes against chain history P2 because it crowdsources verification of hardcoded AssumeUTXO snapshot commitments Closes a trust gap by having every full node validate baked-in hashes against history during IBD Ranking pass: Moved up: closes a real trust gap in hardcoded snapshot commitments, comparable to other assumeutxo correctness work Concept approval for crowdsourced verification during IBD (optout21, Sjors) Concept approval without stated reasons (fametrano) Unaddressed objection: shutdown on mismatch acts as an unsafe checkpoint (Sjors) Unaddressed objection: assertion crash leaves state inconsistent and restart bypasses check (fametrano) Unaddressed objection: crashing IBD penalizes verified nodes without protecting snapshot users (ajtowns) 110 lines added or modified outside tests 106 lines added or modified in tests 220 lines removed in total 17 files, 7 commits (+) #35751 andrewtoth validation: use parallel input prevout fetching in TestBlockValidity P2 · speedup Ready 0 (+1) Blocked 14 + 25 tests Speed up block template validation for miners and Stratum v2 services using parallel input prefetching Prevent block template validation lookups from polluting the main coins cache P2 because parallel input prefetching can save up to a full second during block checking Significantly lowers validation latency for mining template checks and Stratum v2 workflows Protects the main coins cache against pollution and cache stuffing from untrusted miner templates Ranking pass: Moved down: ~10% gain confined to mining template validation, narrower than the other P2 performance work Reviewable now; nothing known that would invalidate a review Unaddressed objection: proposed assert will not prevent reentrancy aborts while fetching (Yudis-bit) Contested safety objection: invalid block templates can retain up to 250 MiB of coins without PoW (l0rinc) Agreed fix for reentrancy safety concerns has not yet been pushed (l0rinc) Support for speeding up Stratum v2 block checks and preventing cache stuffing (Sjors, optout21) Measured disk prefetching saving up to a full second during block validation (Sjors) 14 lines added or modified outside tests 25 lines added or modified in tests 7 lines removed in total 3 files, 2 commits (+) #35054 fjahr p2p: UTXO set sharing P2 · new feature Waiting on author 0 -5 Blocked 943 + 771 tests Distribute AssumeUTXO snapshots directly over the P2P network instead of requiring out-of-band downloads. Reduces onboarding friction and avoids centralized distribution points for users wanting fast initial sync. P2 because it triggers in-process snapshot activation and coordinates with background chainstate validation. Increases maintenance complexity across block reorgs, wallet rescanning, and block pruning. Needs rebase and CI is failing. Author has been silent for 146 days. Blocked by unaddressed objections while author has been silent (andrewtoth, narula, josibake, nkaretnikov) Unaddressed objection: peer can cause immediate out-of-memory crash via data length field (andrewtoth) Unaddressed objection: activation failure leaves download manager permanently stuck (andrewtoth) Objections to dual chainstate complexity and unvalidated snapshots in P2P (l0rinc, stickies-v, evoskuil) Tested snapshot download, activation, and background validation on mainnet demo node (svanstaa) 943 lines added or modified outside tests 771 lines added or modified in tests 1 lines removed in total 27 files, 13 commits (+) #36555 ja7ad rpc: return error when invalidateblock fails P3 · bug fix Ready 0 Strong 19 + 14 tests Stops invalidateblock from reporting success when block disconnection fails and leaves a partial rollback Explicitly rejects attempts to invalidate the genesis block with an invalid parameter error P3 because it improves error accounting during rollbacks without altering consensus rules Surfaces disconnection failures in BlockValidationState instead of silently ignoring them Ranking pass: Moved up: fixes a reported bug (#36546 ) where invalidateblock reports success after a partial rollback, more concrete than the rest of P3 No review verdicts recorded Supports routing disconnection failures through state rather than reporting success (yusufyildiz34) Suggests documenting partial rollback as a known limitation instead of adding regression code (l0rinc) Requested simplifying tests and expanding the pull request description (l0rinc, pinheadmz) 19 lines added or modified outside tests 14 lines added or modified in tests 4 lines removed in total 6 files, 3 commits (+) #36542 l0rinc AssumeUTXO: allow retrying loadtxoutset after an interrupted load P3 · bug fix Ready 1 Strong 3 + 4 tests Allow node operators to retry loading UTXO snapshots after an interrupted load Avoids requiring manual deletion of incomplete snapshot database directories from disk P3 because it fixes an edge case requiring manual operator intervention during snapshot loads Only benefits operators recovering from an interrupted snapshot load Ranking pass: Moved up: removes a manual-intervention recovery step after interrupted snapshot loads, grouped with the other assumeutxo robustness fixes Verified by testing restart and retry scenarios on Linux aarch64 (cyb3ralbert) Asks whether regression tests should cover databases locked by another process (cyb3ralbert) 3 lines added or modified outside tests 4 lines added or modified in tests 3 lines removed in total 3 files, 2 commits (+) #36500 l0rinc AssumeUTXO: reject duplicate coins and empty snapshot groups P3 · bug fix Waiting on author 1 Strong 11 + 25 tests Reject malformed AssumeUTXO snapshots with duplicate coin records or empty groups Prevent inflated coin counts in loadtxoutset and delays during node shutdown P3 because it adds sanity checks to AssumeUTXO snapshot loading rather than fixing consensus flaws Snapshot content hashes are already verified before this change Prevents misleading coin counts and node shutdown delays caused by malformed snapshots Ranking pass: Moved up: grouped with the other assumeutxo input-validation fixes it overlaps with Substantive support with no open objections Verified rejection of duplicate records and empty groups without fuzz crashes (cyb3ralbert) Verified duplicate records are rejected by coin count on head versus base (fametrano) Nonblocking suggestion to reuse an existing test node remains open (cyb3ralbert) 11 lines added or modified outside tests 25 lines added or modified in tests 10 lines removed in total 3 files, 4 commits (+) #36318 optout21 validation: Ensure Invalid ValidationState has result P3 · bug fix Ready 0 Crickets 18 + 9 tests Ensure invalid validation states always carry a concrete failure result and non-empty reason Prevent ambiguous validation outcomes in downstream callers like P2P logic and the kernel C API P3 because invalid validation states can no longer be left unset or missing a reason Prevents ambiguous failure results across consensus callers and peer punishment logic Ready for review Nothing known that would invalidate a review now No review verdicts recorded No substantive reviews or objections yet Neutral context provided noting where the defaulted result originated (hodlinator) 18 lines added or modified outside tests 9 lines added or modified in tests 11 lines removed in total 10 files, 4 commits (+) #35195 l0rinc coins: cache UTXO outpoint hash codes P3 · speedup Author silent 183d 0 Strong 4 + 17 tests Speed up initial sync and AssumeUTXO loading by avoiding redundant hash calculations on UTXO lookups Trades a small memory increase per cached entry for faster table operations P3 because IBD and reindex speedups are modest at 2% to 3%, though AssumeUTXO loading gains reach 11% The speedup trades off increased cache memory usage and relies on compiler-specific standard library traits Ranking pass: Moved up: measured IBD and assumeutxo-loading gains make it the most tangible P3 item after the bug fixes Needs rebase Author silent for 138 days Concept support because benchmarks justify the memory trade-off for faster execution (optout21) 4 lines added or modified outside tests 17 lines added or modified in tests 7 lines removed in total 2 files, 2 commits (+) #33637 l0rinc validation: reduce block index comparison overhead P3 · speedup Ready 0 (+2) Strong 26 + 244 tests Speed up block index work comparisons during chainstate evaluation and best-chain candidate selection Reduce branch overhead by allowing compilers to inline chainwork comparison logic P3 because it speeds up a hot path in block index sorting and chainstate evaluation Comparator throughput increases 6.5x to 6.8x and block index validation rate improves 1.4x to 1.6x Strong support with no open objections across four reviewers Support for a worthwhile hot-path micro-optimization using modern comparison operators (laanwj, optout21) Tested the optimized comparator directly (Raimo33) Readability concerns and testing gaps were resolved with reordered commits and fuzz tests (mzumsande, sipa) 26 lines added or modified outside tests 244 lines added or modified in tests 43 lines removed in total 12 files, 7 commits (+) #35071 pinheadmz Reindex: save progress to continue after interruption P3 · new feature Author silent 177d 0 Mild 69 + 59 tests Resume an interrupted node reindex from the last completed block file Avoids restarting from the very first block file and losing hours or days of indexing work P3 because resuming an interrupted reindex avoids repeating work across processed block files The benefit is marginal because restarting without reindex already avoids reprocessing blocks on disk Author has been silent for 139 days, so reviews may wait a long time for a response No review verdicts recorded Adds database complexity without evidence of meaningful overhead or restart improvement (maflcko) May be unnecessary because restarting without reindex already skips re-indexing on master (mzumsande) Concerns about slowing the happy path were addressed by saving only on interrupt (maflcko, mzumsande) 69 lines added or modified outside tests 59 lines added or modified in tests 6 lines removed in total 3 files, 2 commits (+) #33324 l0rinc blocks: add resumable reobfuscation for existing block files P3 · new feature Waiting on author 1 Strong 299 + 173 tests Allow node operators to obfuscate or rotate XOR keys on existing block files without resyncing Provide a crash-safe, resumable migration for datadirs originally synced prior to v28 P3 because it solves a migration issue for pre-v28 nodes without requiring a full resync The use case is niche and steadily declines in relevance as older datadirs are replaced Ready to review, with no open blockers or pending rebases Support for adding resumable block file reobfuscation to the node (stickies-v, sedited) Questions whether an external tool is sufficient given declining relevance over time (sedited) Resolved objections on file chunking, pruned nodes, and progress display (ajtowns) 299 lines added or modified outside tests 173 lines added or modified in tests 39 lines removed in total 16 files, 12 commits (+) #35906 purpleKarrot First steps towards a stateless, side-effect free validation library P3 · test coverage Ready 1 (+1) Strong 46 + 809 tests Allow consensus block and header validation checks to run and be tested in isolation Remove the requirement for chainstate setup and system clock reads during validity tests P3 because it makes consensus checking safer to test in isolation and unblocks validation modularization It adds extensive unit test coverage for isolated validity checks without urgent operational need Ranking pass: Moved down: first step of a modularization project with no user-visible effect yet; ranks below measured fixes and speedups Strong support for enabling direct unit tests and passing validation parameters explicitly Tested ACK noting it makes testing validation routines practical (janb84) Approves reducing complexity and making error cases simpler to test (optout21, josibake) Clarification requested on a suggestion to compress tests into a declarative style (sedited) 46 lines added or modified outside tests 809 lines added or modified in tests 37 lines removed in total 6 files, 7 commits (+) #35570 optout21 refactor: Change some validation.cpp methods to return BlockValidationState P3 · cleanup Ready 0 (+1) Disputed 238 + 36 tests Stop block and header validation checks from returning conflicting status flags and error states Prevent chained validation steps from inheriting or overwriting unrelated failure reasons P3 because it eliminates an interface hazard where validation results and error states can disagree It improves long-term validation safety but fixes no active bug and carries no direct user impact Ranking pass: Moved up: placed directly after its enabling work so the #35646 #35570 Broad concept support for removing mutable validation out-parameters Contested objection that relying on asserts over compile-time types risks runtime aborts (hodlinator) Verified that updates change signatures without altering behavior (arejula27) Support because returning values directly instead of using out-parameters is cleaner (purpleKarrot) 238 lines added or modified outside tests 36 lines added or modified in tests 234 lines removed in total 16 files, 12 commits (+) #35662 l0rinc script: prevent partial reinitialization of sighash data P3 · cleanup Needs rebase 1 Strong 35 + 55 tests Prevent transactions from accidentally reusing cached signature verification data across transactions Eliminate unnecessary copying in kernel verification and skip unused block verification memory P3 because it removes an error-prone pattern that could corrupt signature hashes if caches were reused It also avoids allocating unused verification data during assumevalid block connection Ranking pass: Moved down: hardening of an error-prone pattern, no active bug, sits with the other defensive validation refactors Ready for review with no known blockers or invalidating changes Strong support with all reviewer concerns addressed Verified by differential testing across thousands of sighash key paths and kernel benchmarks (fametrano) Approval after objection to enforce initialization at construction was resolved (sedited) 35 lines added or modified outside tests 55 lines added or modified in tests 88 lines removed in total 17 files, 5 commits (+) #36395 l0rinc script: clarify implicit signature-cache input requirements P3 · cleanup Waiting on author 0 Mild 35 + 117 tests Enforce strict input preconditions for signature-cache hashing to avoid ambiguous cache commitments Catch signature-cache validation bugs earlier with expanded test coverage P3 because it hardens internal hashing against potential misuse without fixing an active consensus bug Reduces future maintenance hazards in consensus validation code by asserting implicit input assumptions Concept support after mutation testing showed the new tests catch bugs missed on master (fametrano) Objection that signature-cache refactoring carries excessive blast radius in critical code (instagibbs) Author answered the objection by defending the cleanup, awaiting further reviewer response (instagibbs) Suggestion to add a test verifying domain separation between ECDSA and Schnorr salts (fametrano) 35 lines added or modified outside tests 117 lines added or modified in tests 39 lines removed in total 7 files, 9 commits (+) #34864 l0rinc coins: tighten cache entry state invariants P3 · cleanup Ready 0 (+1) Strong 97 + 60 tests Prevent coins cache entries from representing invalid dirty or fresh states in memory and tests Stop repeat coin spends from mutating caller output buffers P3 because it tightens internal UTXO cache state hygiene so invalid states cannot be represented Reduces flag complexity and avoids convention breaks, but does not fix an active bug or crash Ranking pass: Moved down: UTXO cache state hygiene with no active bug, grouped with the other invariant-tightening refactors Ready to review Nothing known that would invalidate a review now Substantive support with all initial concerns addressed Support citing reduced complexity and unrepresentable invalid states (optout21) Verified by running coins fuzz targets without crashes or invariant errors (ptrinh) Concept approval for picking up the refactor (andrewtoth) Early objections on comments, logging, and freshness clearing were resolved (andrewtoth) 97 lines added or modified outside tests 60 lines added or modified in tests 186 lines removed in total 9 files, 8 commits (+) #32575 fjahr consensus: Remove special treatment for single threaded script checking P3 · cleanup Ready 0 (+1) -1 Disputed 96 + 17 tests Unify single-threaded and multithreaded block script checking paths Fix missing script execution cache population during block validity tests Make consensus validation code clearer and less error-prone to audit P3 because it simplifies critical validation paths and fixes an edge-case cache omission It remains an internal refactoring without blocking other work Contested objection: mixing behavior changes with refactoring risks subtle consensus bugs (l0rinc) Strong support for simplifying script verification flow (Eunovo, sedited, theuni) Minor request to document script cache miss trade-off remains open (Eunovo) 96 lines added or modified outside tests 17 lines added or modified in tests 83 lines removed in total 5 files, 6 commits (+) #35731 arejula27 Indexes: Harden the flush-error notification invariant P3 · cleanup Author silent 109d 0 Crickets 18 + 103 tests Ensure failed disk flushes reliably trigger node shutdown to protect chainstate integrity Prevent future file flush error paths from returning failure without aborting the node P3 because it is a defensive refactoring that hardens error handling rather than fixing an active bug Ensures all failed block or undo disk flushes reliably trigger node shutdown Protects maintainers from future flush code paths failing silently without aborting Review #35714 first CI is failing and author has been silent for over two months No review verdicts recorded No substantive review comments or feedback yet No participants have weighed in on the proposed refactoring 18 lines added or modified outside tests 103 lines added or modified in tests 10 lines removed in total 5 files, 4 commits (+) #34254 mzumsande validation: Prevent duplicate logging and looping in invalid block handling P3 · cleanup Author silent 74d 2 (+1) Strong 35 + 29 tests Prevent duplicate tree traversals and repeated log messages when a node encounters an invalid block Avoid running redundant block failure and header recalculation passes in immediate succession P3 because it eliminates redundant work in a rare error path during chain activation Performance and log noise improvements are modest and only triggered when encountering invalid blocks Ranking pass: Moved down: redundant work only in a rare invalid-block path, least consequential of the refactor group Substantive support for improving chain activation error handling (Crypt-iQ) Objection regarding missing failure flags on out-of-chain blocks was resolved and verified (Crypt-iQ) Concept approval for the refactoring approach and cleanup (frankomosh, stratospher) Approvals without detailed comments (bensig, sedited) 35 lines added or modified outside tests 29 lines added or modified in tests 30 lines removed in total 6 files, 3 commits (+) #35187 sedited kernel: Block validation without a complete UTXO set P3 · new feature Ready 0 (+1) Disputed 242 + 119 tests Validate blocks in libbitcoinkernel without requiring a local on-disk chainstate database Allow lightweight verifiers and external UTXO databases to validate block transactions directly P3 after comparing with the other PRs here (assessed alone as P2): Lowered to P3: primarily a libbitcoinkernel API addition for external callers; node-side validation behavior is unchanged, so it ranks below in-node validation work P2 because it adds a new validation entry point that checks blocks against caller-supplied coins P2 because it alters how block validation interacts with script caching and validity invariants Broad concept support, but contested objections remain after a rebase (ajtowns, w0xlt) Contested objection: caller callback enables non-deterministic lookups and drops UTXO changes (ajtowns) Contested objection: script cache poisoning could let caller-supplied coins validate invalid blocks (w0xlt) Contested objection: impossible coin confirmation heights can cause assertion crashes in release builds (w0xlt) Unaddressed objection: assumevalid causes ancestor blocks to skip script checks (nervana21) 242 lines added or modified outside tests 119 lines added or modified in tests 0 lines removed in total 6 files, 5 commits (+) #35557 ryanofsky kernel, validation: Add btck_chainstate_manager_set_clock_time P3 · cleanup Ready 0 Mild 171 + 86 tests Allow kernel library callers and tests to set clock time per instance rather than through global state Eliminate intermittent test flakes caused by race conditions across second boundaries P3 because scoped time checks prevent second-boundary race conditions in isolated validation tests The impact is limited to testing safety rather than fixing production consensus issues No review verdicts recorded Unaddressed objection: PR may be obsolete after #35496 and conflicts with approach in #35906 Prefers setter on chainstate over options, but questions whether it is worth the effort (sedited) Ergonomics concern about managing clocks per object was answered with an alternative prototype (stickies-v) 171 lines added or modified outside tests 86 lines added or modified in tests 99 lines removed in total 31 files, 6 commits (+) #36598 l0rinc [Demo] validation: remove AssumeUTXO P3 · cleanup Waiting on author 0 -1 Blocked 445 + 227 tests Remove AssumeUTXO snapshot loading and background historical validation Eliminate the architectural complexity and maintenance burden of supporting concurrent chainstates P3 after comparing with the other PRs here (assessed alone as P2): Lowered to P3: explicitly a demo not intended for merge; its value is as a reference for smaller extractions, not as reviewable validation change P2 because it eliminates the substantial architectural burden of supporting concurrent chainstates Simplifies core validation by removing dual chainstate roles, candidate sets, and complex lifetime locks Unaddressed objection: removes major bootstrapping speedup and encourages non-Core clients (Sjors) Suggests dropping background validation first rather than removing AssumeUTXO entirely (Sjors) Concept approval because multiple chainstates add high maintenance and trust ambiguity (ismaelsadeeq) Suggests retaining the feature as an optional IPC companion process to limit kernel impact (ariard) 445 lines added or modified outside tests 227 lines added or modified in tests 5,795 lines removed in total 82 files, 35 commits (+) #35511 hodlinator RFC: consensus: Make `CAmount` a class P3 · cleanup Ready 0 Mild 589 + 927 tests Prevent silent bugs from accidental conversions, uninitialized amounts, and invalid monetary math Catch invalid operations and mismatched comparisons on monetary values at compile time P3 because strong monetary typing prevents hazards like uninitialized amounts and invalid arithmetic It catches historical bugs like boolean assignments and mismatched comparisons at compile time It lays groundwork for enforcing valid monetary bounds across consensus code Concept approval because the design is clean and improves safety (ryanofsky) Concept approval without stated reasons (sedited) Objection that converting the entire codebase at once is too risky to review (l0rinc) 589 lines added or modified outside tests 927 lines added or modified in tests 1,282 lines removed in total 194 files, 12 commits (+) #35569 purpleKarrot Encapsulation for CTransaction P4 · cleanup Needs rebase 0 (+2) -2 Disputed 392 + 209 tests Hide internal transaction data layout behind read accessors across the codebase Let future work change transaction memory layouts or share block data without breaking callers P4 because it is an architectural cleanup with no immediate consensus or validation benefit Potential future storage optimizations remain speculative and unproven Worth reviewing now as no changes or rebases are pending Opposed due to wide churn across consensus code without clear immediate benefit (ajtowns, l0rinc) Objected that renaming protocol fields like vin and vout causes confusion (mzumsande) Strong support for decoupling callers from internal transaction layout (josibake, willcl-ark) Verified that the automated refactor reproduces cleanly with passing tests (alexanderwiederin) 392 lines added or modified outside tests 209 lines added or modified in tests 506 lines removed in total 94 files, 7 commits (+) #36066 optout21 validation: Separate check-only version of ConnectBlock P4 · cleanup Ready 0 Strong 60 + 5 tests Clarify mutability guarantees in block validation when running in check-only mode Avoid requiring caller-side dummy objects in validation tests and fuzzing P4 because it is an internal structural refactor with no consensus, safety, or performance impact. Improves code clarity in test paths without affecting node runtime behavior. Concept support for clarifying index mutability and cleaning the public interface (l0rinc) Concern over check-only mode still mutating internal state answered as a compatible step (purpleKarrot) Objection to renaming fuzz target resolved by reverting the rename (marcofleon) Clarified that check flag was removed from public interface but kept internally (mzumsande) 60 lines added or modified outside tests 5 lines added or modified in tests 20 lines removed in total 4 files, 1 commits (+) #36501 bartoli refactor : Reorder CBlockIndex members to save 8 bytes P4 · speedup Ready 2 Strong 5 Reduce memory footprint for every block known to the node by eliminating struct alignment padding Saves roughly 8MB of resident RAM per one million blocks on 64-bit systems P4 because saving roughly 8MB of RAM across one million blocks is a marginal reduction on 64-bit nodes It provides a harmless memory optimization but does not address primary validation bottlenecks Ready to review: no known blockers or pending changes Strong substantive support with no open objections Verified the struct size reduction on 64-bit platforms and confirmed safety (l0rinc) Argued compiler checks and language rules prevent layout or initialization issues (maflcko) Asked for clear proof and verification methods rather than assuming no side effects (stickies-v) 5 lines added or modified outside tests 0 lines added or modified in tests 5 lines removed in total 1 files, 1 commits (+) #35229 optout21 refactor: Use CBlockIndex parameters as reference P4 · cleanup Ready 0 Strong 72 + 7 tests Enforce non-null input invariants at compile time across block index and chain handling Reduce risks of unexpected null dereferences and redundant defensive checks for maintainers P4 because it is an internal cleanup with no effect on consensus or chain validation correctness The maintainability and robustness improvements across the codebase are modest Strong support with all reviewer suggestions addressed Approved citing better clarity and stronger compile-time non-null guarantees (musaHaruna) Verified reference conversions, call sites, and ancestry assumptions (musaHaruna) Concept approval without stated reasons (stickies-v, w0xlt) 72 lines added or modified outside tests 7 lines added or modified in tests 68 lines removed in total 12 files, 7 commits (+) #35271 tomt1664 Update CoinsView::NeedsUpgrade to add additional checks P4 · bug fix Author silent 173d 0 Neutral 2 Prevent downstream forks or nonstandard chainstates from falsely requiring a legacy database upgrade P4 because standard Bitcoin Core databases do not encounter this false upgrade signal Only downstream projects and nonstandard chainstates receive any benefit Review may stall because the author has been silent for 135 days CI is failing No review verdicts recorded No reviewers have actively endorsed the pull request Initial objection on usefulness was withdrawn after author explained downstream need (sedited) Asked about Bitcoin Core applicability and suggested tests (l0rinc) Asked if the author is still actively working on the change (maflcko) 2 lines added or modified outside tests 0 lines added or modified in tests 1 lines removed in total 1 files, 1 commits (+) #36496 l0rinc coins: avoid redundant prevout preparation allocations P4 · speedup Waiting on author 0 (+1) Positive 32 Reduce heap allocations and unneeded worker tasks when prefetching transaction inputs for new blocks. P4 because it is an unmeasured micro-optimization in parallel prevout prefetching. No benchmarks or profiling data demonstrate a noticeable performance gain during block connection. Support without stated reasons (andrewtoth) Concept approval without stated reasons (hodlinator) Open suggestion to check input size to avoid an odd warning log on empty tasks (hodlinator) 32 lines added or modified outside tests 0 lines added or modified in tests 27 lines removed in total 3 files, 4 commits