Dinero v8.0.13

Dinero v8.0.13

The AssumeUTXO release — a stateless (mobile/CSN) node can now bootstrap from a UTXO snapshot, backfill and validate the full history, cross both mainnet consensus forks, and hold the live tip in byte-for-byte consensus with full nodes. Proven end-to-end on mainnet, including the first stateless crossing of the shielded epoch reset.

Also carries the operational hardening from the July 4 EU1 incident.

Chain context: activations at 60000 (leaf-format Utreexo maturity) and 61000 (shielded epoch reset + cv-binding) are already live on mainnet as of v8.0.12 — v8.0.13 changes no consensus rules and no activation heights. It is a non-consensus release: safe to upgrade at any time, no flag-day.

AssumeUTXO / stateless (CSN) sync — now end-to-end

• #363/#365/#366 — fix the fresh-snapshot bootstrap data race (g_block_index locking), the chainwork log guard, and separate the tip vs. backfill NOTFOUND skip-sets so a snapshot peer can't wedge catch-up.
• #367/#368 — forward-connect mobile profile (usable at the live tip while background validation runs) + a reserved download-window share for backfill so tip traffic can't starve it.
• #370 — evict zombie relay virtual peers on repeated send failure (the NAT'd-node backfill wedge).
• #376 — stop the CSN stale-guard from silently discarding 100% of backfill bodies.
• #377 — move ordered proof validation off the P2P dispatch thread (backfill ingest ~6/min → ~600/min; Recv-Q no longer grows unbounded).
• #379 — a forward frontier failure no longer halts the independent backfill queue.
• #381 + #382 — keep the CSN forest and its stump coherent as blocks connect, so the first block containing a real spend validates against the correct root (previously every forward run died at the first spend block).
• #384 — reconcile the forward-validate cursor to the active tip so a node that restarts mid-backfill recovers instead of deadlocking ("too far ahead of cursor 1"). Empirically proven via a live A/B (same datadir, binary-only change).

Operational hardening (EU1 incident, July 4)

• #372 — recover from, or fail loudly on, a latched RocksDB background error. A single transient IO failure used to silently freeze the node's tip indefinitely; it now attempts in-process recovery and, failing that, exits non-zero so the service manager restarts it (a restart is a clean recovery for this class).
• #374 — close-and-invalidate peer socket fds to stop a stale-fd double-close that could destroy an unrelated file descriptor (on EU1 it killed RocksDB's sst fd mid-flush — the trigger for the above).

Build

• #362/#364 — Windows/MSVC build guard for unistd.h; remove dead block_index_persistence.

Verification

• Every fix shipped with a failing-first regression test (unit and, where the wiring mattered, integration/A/B).
• Full campaign proven on a public mainnet node: fresh snapshot → backfill 52287/52287 → promotion → forward-connect crossing both forks → live-tip consensus with the fleet.
• Fleet held full block + shielded consensus through both fork activations.

Upgrade

Non-consensus; upgrade any time. Stateless/mobile nodes gain the full AssumeUTXO path; full nodes gain the storage/fd hardening. A stateless node that was on an older core and forked off at 60000/61000 will resync cleanly on this build.