ReserveGrid OS v1.0.2

ReserveGrid OS v1.0.2 — Stress

Resilience release following a deep stress-test audit and systemic frontend bug fix. 12 findings resolved across timing accuracy, error recovery, configuration correctness, and dashboard reliability. Website i18n coverage expanded from partial to complete across English, Spanish, and Mandarin.

Stress-test audit scope

Four parallel scans (2026-04-07) stress-tested the production pipeline for timing races, error recovery under outage, resource exhaustion, and config edge cases. 8 actionable findings fixed, 2 triaged as false positives. All fixes use safe Rust only (no unsafe blocks).

Template age clock fix

build_template_propose() previously stamped created_at_unix_ms with SystemTime::now() at the moment the gateway received the template from bitcoind. If the RPC call hangs for 15 seconds, the template appears fresh when it is actually stale, bypassing age enforcement entirely. Fixed: the timestamp now uses bitcoind's curtime field (the block creation time embedded in the template itself), converted to milliseconds. Template age enforcement is accurate regardless of RPC latency.

Gateway mode environment variable override

The docker-compose documentation has always shown VELDRA_GATEWAY_MODE=observe as the way to select gateway mode. The gateway only read mode from TOML, silently ignoring the env var. Operators following the docs ran in the wrong mode with no error. Fixed: VELDRA_GATEWAY_MODE now overlays the TOML value when set. Accepts inline, observe, or shadow. Invalid values fail startup with an explicit error.

Fee tier ordering validation

An operator could configure min_avg_fee_lo > min_avg_fee_mid > min_avg_fee_hi (inverted fee tiers) with no startup error. The verifier would run with contradictory thresholds, producing confusing accept/reject patterns. Fixed: PolicyConfig::validate() now enforces lo <= mid <= hi ordering and fails startup with a clear error message identifying which values are inverted.

Feed adapter backoff reduction

MAX_BACKOFF_SECS was 30, creating 40 to 50 second template gaps during sustained feed outages. Reduced to 10 seconds. Worst case gap between reconnection attempts is now approximately 15 seconds.

Verifier reconnect jitter

All gateways used a fixed-delay reconnect to the verifier. After a verifier restart, every gateway reconnected at the same instant (thundering herd). Fixed: hash-based jitter adds 0 to 50 percent of the base delay, spreading reconnection attempts across the window. The jitter seed is derived from the current instant, so each gateway instance picks a different offset.

Degraded policy mode logging

When policy.toml fails to parse, the verifier falls back to a built-in default policy that accepts all templates without fee enforcement. This critical operational state was logged at WARN. Upgraded to ERROR with an explicit impact description so operators and log alerting systems cannot miss it.

File descriptor limit check

sv2-gateway now reads /proc/self/limits at startup on Linux and warns when the soft FD limit is too low for the configured max_connections. At 10,000 miners the gateway needs 20,000+ file descriptors, but the default limit is 1024. The check uses safe filesystem reads only (no libc dependency, no unsafe blocks).

Dashboard poll interval sync

Policy state polled every 30 seconds while verdicts polled every 5 seconds. After a policy change, operators saw new rejections for up to 25 seconds before the policy display caught up. Policy poll interval reduced to 5 seconds to match verdict polling.

Stale-diff bug in dashboard save handlers

All four dashboard save/apply handlers (policy, verifier settings, gateway settings, template settings) shared a bug: they diffed local UI state against the most recently polled prop. If the user toggled a setting, saved, then toggled again before the prop refreshed, the diff compared against stale data and produced an empty or incorrect patch. The toggle appeared stuck. Fixed all four with a baselineRef pattern that tracks the last known server state independently of prop polling and advances after each successful save.

Website i18n completion

Added data-i18n attributes to 30+ previously untranslated elements across 14 site pages, including the Problem section (6 feature cards), SVG architecture diagram labels, Sign In buttons, Copy buttons, and the Architecture footer link. Added 32 new translation keys to es.json and zh.json. Renamed "Two paths to enforcement" to "Progressive deployment" across all three locales. Cache buster version bumped to v=6.

Unsafe code lint compliance

Workspace-level unsafe_code = "deny" blocked a libc::getrlimit call added for the FD limit check. Replaced with safe /proc/self/limits file read and removed the libc dependency entirely. This is the same class of error as the env::set_var incident in v1.0.2 config.rs (both resolved by finding safe alternatives to unsafe libc calls).

Documentation updates

README overhauled from the localhost-era format to reflect the shipping product: native desktop app as primary install path, rg-desktop in the architecture diagram, dual quickstart (desktop app vs Docker-only), signed updater and per-IP limit security notes. Deployment runbook, pitch prep, LinkedIn playbook, and three-mode architecture doc updated to v1.0.2.

False positives triaged

Two stress-test findings were triaged as already handled and required no changes:

• Pending templates HashMap unbounded: already bounded to 2 entries by FIFO eviction before each insert.
• Prometheus metric cardinality on reason_code: labels come from a bounded canonical enum (approximately 40 series maximum), not unbounded user input.

Known limitations

Unchanged from v1.0.1:

• Extended channels and vardiff remain deferred to v1.1 (PB-6)
• Rate limiter state is in-process only (shared state deferred to v1.1)
• Sustained load testing (hours) and two-host network latency benchmarks have not been performed
• Legacy DB-only key validation fallback in rg-auth will be removed in v1.1
• Automatic inline-to-observe degradation on verifier outage scoped for v1.1

Upgrade from v1.0.1

1. No new environment variables required
2. VELDRA_GATEWAY_MODE env var now works as documented (verify your docker-compose values match intended mode)
3. Review policy.toml fee tier ordering: startup will now reject lo > mid or mid > hi configurations that were previously silently accepted
4. Desktop users: auto-update delivers v1.0.2 automatically if running v1.0.1+

See CHANGELOG.md for the complete list of changes.