shell-chain v0.27.4

Breaking Changes

• Bind the sender-bound transaction identity rules into the genesis header.
  Existing databases use the legacy identity rules and cannot be resumed by
  this release.

Migration Guide

• Alpha testnet operators must stop the node, back up any required state, run
  shell-node --datadir <path> removedb --force, and initialize the chain from
  the coordinated genesis configuration before restarting. The upgraded node
  rejects legacy databases with a clear migration error.

Changed

• Revalidate canonical main and the exact annotated tag source after release
  confirmation, rejecting a push when either changed during the prompt.
• Make sparse parallel-execution wave planning linear in the current wave size
  by checking conflict-set disjointness against indexed wave membership.
• Make weighted proposer selection linear in the validator count and allocation-free.
• Account for the outer envelope and session-verification intrinsic gas in AA
  receipts and fee settlement, without treating the unused outer destination
  as a contract-creation request.
• Start STARK proof generation only after node readiness, and bound both the
  proof handoff queue and the number of amendments awaiting canonical
  settlement.
• Expose pending STARK settlements and rate-limited amendments as Prometheus
  metrics for prover admission monitoring.
• Require a production binary build before creating a release tag.
• Avoid allocating account-trie keys on world-state cache misses and writes.
• Run advanced CodeQL analysis for fork-based pull requests so every proposed
  head receives the required GitHub Actions, Python, and Rust security checks.
• Index pending sender and paymaster balance reservations so transaction
  admission no longer scans the full mempool.
• Commit replayed state, receipts, canonical indexes, and the replacement head
  in one atomic storage transition during branch adoption.
• Deterministically replay and atomically adopt quorum-preferred forks while
  keeping candidate execution isolated until every commitment is verified.
• Back off repeated preferred-fork adoption attempts up to 30 seconds, while
  retrying immediately when fork choice selects a different head.
• Reconcile the mempool after fork adoption by removing newly canonical
  transactions and reinserting valid reverted transactions in nonce order.
• Remove terminally invalid preferred-fork subtrees from fork choice so
  production can resume, while retaining backoff for transient failures.
• Reconstruct signature-algorithm policy from the common ancestor state before
  validating a preferred branch, with rollback when adoption fails.
• Journal canonical public-key and guardian-recovery metadata changes so fork
  replay restores the common-ancestor view before validating either branch.

Fixed

• Evaluate custom-account, paymaster, and session authorization against the
  exact candidate block header during block production and import.
• Clear block-sync request state when sending the next peer-targeted batch
  fails, instead of waiting for a response to a request that was never sent.
• Upgrade lru to 0.18.2 to resolve RUSTSEC-2026-0253.
• Bind canonical signed-transaction identifiers to the authenticated sender so
  distinct accounts with identical transaction payloads cannot collide in the
  mempool, receipt, or transaction indexes while authentication witnesses
  remain excluded from the identifier.
• Revalidate imported transactions against prior in-block state changes so key
  rotations and account or paymaster policy updates take effect immediately.
• Propagate authority-registry and equivocation lookup storage failures during
  block import instead of misclassifying them as unknown proposers or missing
  equivocation evidence.
• Prevent custom-validator V2 policy reverts from retrying through the reduced
  legacy V1 authorization interface.
• Bind snapshot checksums to framed key and value records and require the
  checksum in snapshot format version 2.
• Keep historical STARK frontier tasks ordered ahead of live tip tasks and
  retain sparse frontier ranges instead of skipping them into proofs that
  canonical settlement must reject.
• Reserve STARK source ranges while proofs are in flight so periodic frontier
  seeding cannot generate duplicate amendments during proof handoff.
• Revalidate persisted STARK amendments before startup recovery, discard
  malformed or unauthenticated artifacts, and regenerate their proof tasks
  instead of repeatedly blocking the settlement window.
• Accept a rotated wPoA proposer during historical block sync only with a
  verified commit certificate and after the deterministic view-change timeout,
  so restarted validators can synchronize safely after a valid view change.
• Apply backpressure to STARK proof generation and authenticated amendment
  gossip so an unsettled historical frontier cannot starve block propagation.
• Bind block-sync responses to the requested starting height before importing
  any peer-supplied blocks.
• Prune address-metadata undo journals once their blocks are finalized, while
  retaining every journal that a valid reorganization can still require.
• Reject side-fork blocks with malformed or invalid STARK aggregate proofs
  before persisting them or registering them with fork choice.
• Keep idle syncing subscriptions active until the client unsubscribes or
  disconnects instead of expiring healthy WebSocket sessions.
• Require owners to cancel an active guardian recovery before replacing its
  guardian configuration, preventing votes under the old configuration from
  remaining executable.
• Preserve AA inner-call balance effects during sponsored-gas settlement so
  self-transfers and value received by paymasters are not discarded.
• Keep an mDNS peer explicit in GossipSub until all of its discovered addresses
  have expired.
• Reject checkpoint snapshots with a missing or mismatched canonical head body
  before importing any snapshot records.
• Start finality-bounded log filters at their resolved upper bound so blocks
  already above that bound are delivered when finality later advances.
• Let higher-priority transactions evict enough lower-priority nonce chains to
  satisfy the aggregate mempool byte limit as well as the transaction-count
  limit.
• Reject release cuts when the exact tag already exists on the canonical remote,
  before creating a conflicting local tag.
• Stop retaining expired mDNS discoveries as dialable peer addresses.
• Reject headless genesis snapshots before they can replace stored chain data
  or clear the published chain head.
• Reject commit certificates for missing, height-mismatched, or noncanonical
  blocks before advancing finality.
• Resolve log-filter fromBlock tags when the filter is created so later polls
  cannot skip matching blocks.
• Reject sender-paid transactions whose maximum gas cost plus transferred value
  exceeds the U256 balance range.
• Reject algorithm-activation proposals when the canonical head cannot be read,
  instead of validating their timelock against a fallback genesis height.
• Require successful exact-commit CodeQL analyses for GitHub Actions, Python,
  and Rust before creating a release tag.
• Reject aggregate pending balance reservations that exceed the U256 balance
  range.
• Reject blob transactions whose versioned hashes do not use the EIP-4844 KZG
  version byte.
• Return an internal error from eth_getLogs when a matching canonical block
  has a non-zero log bloom but its receipts are unavailable.
• Recover the persisted finalized hash from canonical indexes after restart so
  body-pruned finalized blocks do not reset the in-memory checkpoint hash.
• Reject snapshot exports whose chain identity does not match the persisted
  chain configuration.
• Reject historical body responses that do not start at the requested block.
• Respect custom-validator and session-key signature policies during block
  import and side-fork validation.