Release 4.0.1

This release contains bugfixes and improvements to the stacks-node and stacks-signer binaries, ensuring more consistent block production.

This release includes the activation logic for the Epoch 4.0 hard-fork, which will activate on mainnet at Bitcoin block 960230 (approximately July 30 2026, AM UTC). It is compatible with prior chainstates, but after the hard-fork activation height, nodes running 4.0.1 and 3.4.x will diverge. Node operators must upgrade before the activation height.

This release includes the following changes:
https://github.com/stacks-network/stacks-core/blob/4.0.1/CHANGELOG.md

Added

• Clarity 6: Add variadic concat built-in
• Adds two new Clarity 6 native functions: verify-merkle-proof, which checks a Bitcoin-style merkle inclusion proof against a known root using double-SHA-256, and get-bitcoin-tx-output?, which parses a serialized Bitcoin transaction (with or without SegWit witness data) and returns the output at a given index along with the canonical, witness-stripped txid in internal byte order
• Adds the ability to pause claiming of rewards in pox-5. This is an irreversable action, which can only be taken by the "pause admin", which is set initially at 4.0 activation.
• Added ed25519-verify to clarity6
• Adds a new epoch, epoch 4.0, which deploys pox-5, and a new Clarity version, Clarity 6, along with related boilerplate code.
• Complete L1 bitcoin staking integration tests, including both normal exit after the timelock expires, and early exit.
• pox-5: support seamless rollovers between bond and STX-only staking positions. A staker may now register-for-bond for the bond that starts immediately after their current bond ends or at the same cycle at which their STX-only staking unlocks. They can also stake STX-only while their existing bond/stake is ending. In these cases, the STX lock is carried forward (amount may go up or down) with no release. sBTC for the bond is also rolled forward via net transfer (or refunded on bond → stake). These rollovers are restricted to the bond L1 unlock window (last half cycle).
• Added print events for all interesting actions on the pox-5 contract and also improved the return values for some.
• The /v2/pox RPC response now includes pox_5_sbtc_contract and pox_5_sbtc_registry_contract, the sBTC token and registry contract identifiers that this node's PoX-5 references. On mainnet these are the canonical sBTC contracts; on non-mainnet they reflect the node's configuration.
• Add support to the pox-locking library for PoX-5.
• Added a private function, transfer-from-reserve to pox-5 to allow a consensus transfer of sBTC from the reserve.
• Added per-block problematic_txs markers to the Nakamoto block header (Epoch 4.0+), letting miners flag transactions to skip during replay. The field is gated on a new header version, so pre-4.0 block serialization and hashes are unchanged, and the header version is now validated against the block's epoch. Until the policies are set, signers will reject any transactions in this list.
• Added secp256k1-decompress? to clarity6
• Added transaction-level Staking and Pox post-conditions, and matching in-contract with-staking / with-pox allowances. Staking constrains how much STX a principal may stake (lock for PoX) during a transaction. Pox gates the state-altering PoX-5 operations that act on a principal's existing position: unstake, unstake-sbtc, update-bond-registration, and announce-l1-early-exit, and is presence-based (block / allow / require). Both are only valid in Stacks epoch 4.0 and later, and in Deny/Originator post-condition mode an uncovered stake or PoX action fails the transaction. In Clarity 6 the with-stacking allowance was renamed to with-staking (the old with-stacking spelling remains valid in Clarity 4 and 5).
• Updated the print event inside register-for-bond to include the transaction info for L1 lockups.

Changed

• Added .cost-voting disablement gate beginning from epoch 4.0
• Updated coinbase intervals for Epoch 4.0
• Recalibrated all Clarity 6 (Epoch 4.0) runtime cost functions in costs_5.rs using Callgrind instruction-count measurements from clarity-cost-bench. Arithmetic, tuple, sequence, hash, crypto, and store operations now have bench-derived linear formulas instead of forwarding to the Clarity 4 values, with a calibration baseline of 1 cost unit = 80,000 CPU instructions (a clean round value chosen to place the base overhead of any Clarity call at ≈38 units).
• Doubled the Clarity read budget (read_length and read_count) for Stacks Epoch 4.0 blocks, via a new BLOCK_LIMIT_MAINNET_40 cost limit. All other block limit dimensions (write and runtime) remain unchanged from Epoch 2.1 onward.
• Add additional Clarity value sanitization pass to function invocations in Epoch 4.0
• Contract analysis now charges the runtime cost of AnalysisUseTraitEntry when a trait is resolved from the contract under analysis. This closes a metering asymmetry between the two lookup paths and applies starting with Epoch 4.0.
• Allow pox-5 L1 BTC lockups to use timelock unlock heights greater than or equal to the bond's minimum L1 unlock height.
• Restructure the pox-5 L1 BTC lockup witness script: the early-exit branch now requires revealing the 32-byte sha256(to-consensus-buff? staker) preimage alongside the early-unlock signature.
• Updated the stacks-signer generate-staking-signature command to generate PoX-5 signer grant signatures.
• Reduced the per-cycle readCount cost of pox-5 stake (and the other staking entry points that fold over lock cycles) by de-duplicating redundant map reads in settle-rewards and skipping settle-staker-rewards when the staker holds no shares in that cycle. A max-length (96-cycle) stake now costs ~2,336 readCount instead of ~3,104 (~15.6% vs ~20.7% of the tenure-block budget), raising worst-case throughput from ~4 to ~6 such transactions per block.
• pox-5: announce-l1-early-exit is now callable by the staker themselves, not the bond's early-unlock admin. The early-unlock-admin field is removed from protocol-bonds and from the setup-bond parameter list, since no on-chain code path consumes it anymore. Re-announcing for the same bond returns the new ERR_L1_EARLY_EXIT_ALREADY_ANNOUNCED. The new read-only has-announced-l1-early-exit exposes per-staker announcement state for off-chain consumers and gates the re-entry assert on-chain.
• Reject unstake-sbtc and announce-l1-early-exit calls during a prepare phase.
• The node and stacks-signer now share a single version (stacks_node_version in versions.toml) and ship in one combined GitHub release: one set of binary archives (containing both binaries) plus the stacks-core and stacks-signer docker images, all tagged with the same version. The separate stacks_signer_version, the signer-x.x.x release tags, and the independent release/signer-x.x.x release path have been removed.
• Use new variadic concat in the pox-5 contract.

Fixed

• Updates to pox-5 to prevent a scenario where a bond participant could switch signers, but that switch would cause the new signer to immediately start getting rewards, even though their signing power isn't updated yet.
• Fixed an issue related to signer managers not being able to withdrawal their accumulated fees.
• Consensus now rejects blocks that contain transactions with non-normalized "high S" secp256k1 signatures. This is a requirement of SIP 005, but was never correctly implemented. This change applies starting with Epoch 4.0.
• Prevent counting duplicate lockups in pox-5 register-for-bond.
• In signer-manager.clar, the function check-pox-addr wasn't used. Now, it is used to check when a staker has passed a pox-addr as part of their calldata.
• Fixed an issue related to how current and future cycle rewards state is managed after unstaking.
• Fixed an error where there could be an arithmetic underflow if a staker claimed rewards before the signer claimed their own first. Instead, we now explicitly return an error.
• Remove the faulty reward-cycle-to-unlock-height from pox-5.
• Return rejected sBTC withdrawal amounts to stakers and let admins sweep orphaned fee-refund dust in the pox-5 reference signer-manager. The admin sweep now subtracts outstanding withdrawal liability so it can never sweep funds owed to stakers, and accepted withdrawals are retired via the permissionless settle-accepted-withdrawal to release their liability.
• Handle reward cycle with no STX-only stakers (all excess rewards go to the reserve).
• In Epoch 4.0 (PoX-5), the Clarity asset map now sums concurrent stacking entries for the same principal within a transaction (both within a frame and when merging frames) instead of rejecting the block. The pre-Epoch-4.0 soft-fork behavior (rejecting PoX assetmap overwrites) is unchanged.
• Fixed PoX-5 L1 lockup CLTV height serialization so large unlock heights cannot truncate to lower Bitcoin script numbers.
• Re-check the signer key grant at every pox-5 new-stake entry point (register-for-bond, update-bond-registration, stake, stake-update), so revoking a grant with revoke-signer-grant now disables an already-registered signer manager from accepting any new stake. Previously revocation only blocked future register-signer calls, leaving a deprecated or buggy manager free to keep accumulating delegated STX and re-enter the signer set; its existing obligations still settle and wind down as the backing bonds/stakes expire.
• Fixed PoX-5 L1 lockup script construction to reject Bitcoin CHECKLOCKTIMEVERIFY values that would be interpreted as Unix timestamps instead of block heights.
• Allow only the signer to call grant-signer-key. Without this check someone could grief the signer, by watching for their call to register-self in the mempool, grabbing the signer-key, and then frontrunning...

Release signer-3.4.0.0.4.0

This release contains bugfixes and improvements to the stacks-node and stacks-signer binaries, ensuring more consistent block production.
This release is compatible with chainstate directories from 3.4.x.x.x.

The version of stacks-node compatible with this release is 3.4.0.0.4, available here: https://github.com/stacks-network/stacks-core/releases/tag/3.4.0.0.4.

This release is recommended for all Stacks node operators.

This release includes the following changes:
https://github.com/stacks-network/stacks-core/blob/signer-3.4.0.0.4.0/stacks-signer/CHANGELOG.md

Fixed

• Signers now reject blocks that contain transactions with non-normalized "high S" secp256k1 signatures.

Docker images have been published to GitHub Container Registry:

stacks-signer

• Debian (glibc): https://github.com/stacks-network/stacks-signer/pkgs/container/stacks-signer/1005425720?tag=3.4.0.0.4.0

docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.4.0@sha256:a743a6bd04147dbb3d21ccdd6ffd12fe92ef872025fde190b033c773ee25a036

• Alpine (musl): https://github.com/stacks-network/stacks-signer/pkgs/container/stacks-signer/1005425623?tag=3.4.0.0.4.0-alpine

docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.4.0-alpine@sha256:4496906fe6a63fa01874a6ad5074cba60490b48e345f61acaeb0f805e9031141

Release 3.4.0.0.3

This release contains bugfixes and improvements to the stacks-node and stacks-signer binaries, ensuring more consistent block production.
This release is compatible with chainstate directories from 3.4.x.x.x.

The version of stacks-signer compatible with this release is 3.4.0.0.3.0, available at: https://github.com/stacks-network/stacks-core/releases/tag/signer-3.4.0.0.3.0.

This release is recommended for all Stacks node operators.

This release includes the following changes:
https://github.com/stacks-network/stacks-core/blob/3.4.0.0.3/CHANGELOG.md

Added

• Allow non-blocking event dispatching. This is off by default, but can be enabled in the node configuration.
• Introduced caching for contracts loaded/parsed within the context of a single Clarity transaction, reducing resource usage for many calls to the same contract.
• Add defensive memory allocation checks for miners and signers. This adds two new config options: max_assembly_mem_bytes and block_proposal_max_tx_mem_bytes
• Bump MARF index DB schema to v3: add squash metadata tables (marf_squash_info, marf_squashed_blocks) and the storage foundation for the MARF squashing pipeline.
• Add support for u64 children pointer offsets in the MARF trie, using a mixed u32/u64 encoding with a 0x20 bit flag for backward compatibility

Changed

• Exposed MockSignature::signature field and MockProposal::signer_signature_hash() method as pub in libsigner::v0::messages, enabling external consumers (observer/indexer tooling) to recover signer pubkeys from mock signer messages without maintaining a local copy of these types.

Fixed

• Fixed potential overflow in signer threshold arithmetic by widening intermediate computations to u64 (#7189)
• Mark a transaction as problematic when it hits the execution time limit.
• Fixed the miner reporting of the reason it stopped mining to prometheus metrics.

Docker images have been published to GitHub Container Registry:

stacks-core

• Debian (glibc): https://github.com/stacks-network/stacks-core/pkgs/container/stacks-core/885354798?tag=3.4.0.0.3

docker pull ghcr.io/stacks-network/stacks-core:3.4.0.0.3@sha256:4e4e861c0c47d33e7deae4793f446977004ec226108b9c4dbda949c789f491f3

• Alpine (musl): https://github.com/stacks-network/stacks-core/pkgs/container/stacks-core/885354135?tag=3.4.0.0.3-alpine

docker pull ghcr.io/stacks-network/stacks-core:3.4.0.0.3-alpine@sha256:da2ca02e0376d804a4f1ddeaf9ba7fafdd3166e7317a8583e4f4078b15dfe9a7

stacks-signer

• Debian (glibc): https://github.com/stacks-network/stacks-signer/pkgs/container/stacks-signer/885352180?tag=3.4.0.0.3.0

docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.3.0@sha256:483055ccc4555935e945d50a89242310832f8c4d977a05452b33b0921a914c3f

• Alpine (musl): https://github.com/stacks-network/stacks-signer/pkgs/container/stacks-signer/885352452?tag=3.4.0.0.3.0-alpine

docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.3.0-alpine@sha256:9d21f1d1c568e252685e7a29f5d47a6613ea54c810cf161cafb15d262b48a0ed

Release signer-3.4.0.0.3.0

This release contains bugfixes and improvements to the stacks-node and stacks-signer binaries, ensuring more consistent block production.
This release is compatible with chainstate directories from 3.4.x.x.x.

The version of stacks-node compatible with this release is 3.4.0.0.3, available here: https://github.com/stacks-network/stacks-core/releases/tag/3.4.0.0.3.

This release is recommended for all Stacks node operators.

This release includes the following changes:
https://github.com/stacks-network/stacks-core/blob/signer-3.4.0.0.3.0/stacks-signer/CHANGELOG.md

Added

• Added the block_proposal_max_tx_execution_time_secs connection option (defaulting to 30 seconds), which caps the time a single transaction is allowed to run during block proposal validation. A transaction that exceeds this per-transaction cap on its own is reported as a ProblematicTransaction. If the overall block proposal validation budget (block_proposal_validation_timeout_secs) is exhausted before a transaction is processed, the block is rejected with InvalidBlock and no specific transaction is flagged, so a transaction is no longer marked problematic just because earlier transactions consumed the validation budget.

Docker images have been published to GitHub Container Registry:

stacks-signer

• Debian (glibc): https://github.com/stacks-network/stacks-signer/pkgs/container/stacks-signer/885352180?tag=3.4.0.0.3.0

docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.3.0@sha256:483055ccc4555935e945d50a89242310832f8c4d977a05452b33b0921a914c3f

• Alpine (musl): https://github.com/stacks-network/stacks-signer/pkgs/container/stacks-signer/885352452?tag=3.4.0.0.3.0-alpine

docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.3.0-alpine@sha256:9d21f1d1c568e252685e7a29f5d47a6613ea54c810cf161cafb15d262b48a0ed

Release 3.4.0.0.2

This release contains bugfixes and improvements to the stacks-node and stacks-signer binaries, ensuring more consistent block production.
This release is compatible with chainstate directories from 3.4.x.x.x.

The version of stacks-signer compatible with this release is 3.4.0.0.2.0, available at: https://github.com/stacks-network/stacks-core/releases/tag/signer-3.4.0.0.2.0.

This release includes the following changes:
https://github.com/stacks-network/stacks-core/blob/3.4.0.0.2/CHANGELOG.md

Added

• Miners now track failed_txid from signer block rejections. When a blocking minority (>30%) of signers report the same transaction as failed, the miner excludes it from the next block proposal. A new ProblematicTransaction validation reject code distinguishes genuinely broken transactions (permanently blacklisted from the mempool) from context-dependent failures like deadline exceeded (excluded until a successful block only).
• Added some diagnostics data to a miner's block proposal StackerDB message. This data contains nothing confidential, only some information about the miner's view of the world. This may help with investigating issues where a miner keeps submitting blocks that are then rejected by signers.
• Added error!-level logging with UNREACHABLE_ERROR_TRIGGERED marker and stacks_unreachable_errors_total Prometheus counter when unreachable errors are hit during transaction processing (#7046)
• Add a helper script for creating changelog fragments.
• Add tests for handling of bad block commits (vtxindex=0, wrong parent).

Changed

• Optimized SequenceData::retain_values built-in from O(n²) to O(n)
• Renamed SequenceData::retain_values to SequenceData::try_retain and changed it to take self by value instead of &mut self
• Breaking: Removed duplicate value field from NFT and SmartContract observer event payloads. Use raw_value (hex-encoded Clarity value) instead.
• Breaking: Removed result field from block replay/simulate transaction responses. Use result_hex (hex-encoded Clarity value) instead.
• BlockResponseData version bumped from 4 to 5 to include the new failed_txid field. Older signers that don't send this field are handled gracefully via backwards-compatible deserialization.
• Remove unused version_string function (for building binary version) from clarity and clarity-types crates.
• Improved performance for fold, map, and filter Clarity functions
• Refactor to avoid the risk of panics when creating ClarityNames and similar
• Updated deprecated usage of slog macros and GenericArray
• Updates the PoX constants used in various test scenarios to ensure there are 3 blocks in the prepare phase, which is required for Nakamoto.
• Moved codec types and traits into a new stacks-codec crate, extracted from stacks-common

Fixed

• Fix to clear ongoing block commits when a send_transaction call fails (#6976)
• Fixed clarity-cli to print errors to stderr and exit gracefully instead of panicking with a backtrace on invalid inputs.
• Fixed flakiness in Bitcoin integration tests due to shutdown timing.
• Fixed flakiness in fuzzed_median_fee_rate_estimation_test tests.
• Fixed flaky miner_stackerdb_version_rollover and multiple_miners_mock_sign_epoch_25 integration tests by increasing polling frequency and extending the timeout in wait_for_registered and wait_for_registered_both_reward_cycles, and aligning boot_to_epoch_25_reward_cycle with boot_to_epoch_3 (extended timeout plus mine-another-block recovery when the reward set isn't yet available)
• Fixed flakiness in signer_waits_for_validation_before_signing by waiting for state machine updates to prevent the signer from rejecting immediately.
• Fixed logical operator in tenure-start block validation to correctly reject blocks where either the coinbase or tenure-change transaction is in the wrong position, not only when both are wrong

Docker images have been published to GitHub Container Registry:

• stacks-core: https://github.com/stacks-network/stacks-core/pkgs/container/stacks-core

  docker pull ghcr.io/stacks-network/stacks-core:3.4.0.0.2

• stacks-signer: https://github.com/stacks-network/stacks-core/pkgs/container/stacks-signer

  docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.2.0

This release is recommended for all Stacks node operators.

Release signer-3.4.0.0.2.0

This release contains bugfixes and improvements to the stacks-node and stacks-signer binaries, ensuring more consistent block production.
This release is compatible with chainstate directories from 3.4.x.x.x.

The version of stacks-node compatible with this release is 3.4.0.0.2, available here: https://github.com/stacks-network/stacks-core/releases/tag/3.4.0.0.2.

This release includes the following changes:
https://github.com/stacks-network/stacks-core/blob/signer-3.4.0.0.2.0/stacks-signer/CHANGELOG.md

Added

• Signers now include a failed_txid field in block rejection messages, reporting which transaction caused block validation to fail. This allows miners to skip problematic transactions in subsequent proposals rather than repeatedly proposing blocks that will be rejected.

Fixed

• Fix duplicated binary name when running stacks-signer --version cli command
• Fixed an issue in the signer where it would return early if it detected a message from an unrecognized signer.
• Fixed flakiness in check_capitulate_miner_view test.
• When checking tenure change blocks, ensure there are no locally accepted blocks in the tenure, not just globally accepted blocks.

Docker images have been published to GitHub Container Registry:

• stacks-core: https://github.com/stacks-network/stacks-core/pkgs/container/stacks-core

  docker pull ghcr.io/stacks-network/stacks-core:3.4.0.0.2

• stacks-signer: https://github.com/stacks-network/stacks-core/pkgs/container/stacks-signer

  docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.2.0

This release is recommended for all Stacks node operators.

Release 3.4.0.0.1

Stacks core developers have released Stacks Core version 3.4.0.0.1.

This release contains bugfixes and improvements to the stacks-node and stacks-signer binaries, ensuring more consistent block production.
This release is compatible with chainstate directories from 3.x.x.x.x.

The version of stacks-signer compatible with this release is 3.4.0.0.1.0, available at: https://github.com/stacks-network/stacks-core/releases/tag/signer-3.4.0.0.1.0.

This release includes the following changes:

• Improve block production.
• Fix the 3.4 activation height in sample testnet configs (sample configs were incorrect in the 3.4.0.0.0 release).

Docker images have been published to GitHub Container Registry:

• stacks-core: https://github.com/stacks-network/stacks-core/pkgs/container/stacks-core

  docker pull ghcr.io/stacks-network/stacks-core:3.4.0.0.1

• stacks-signer: https://github.com/stacks-network/stacks-core/pkgs/container/stacks-signer

  docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.1.0

This release is recommended for all Stacks node operators.

Release signer-3.4.0.0.1.0

This release contains bugfixes and improvements to the stacks-node and stacks-signer binaries, ensuring more consistent block production.
This release is compatible with chainstate directories from 3.x.x.x.x.

The version of Stacks Core compatible with this release is 3.4.0.0.1.0, available here: https://github.com/stacks-network/stacks-core/releases/tag/3.4.0.0.1.

This release includes the following changes:

• Improve block production.
• Fix the 3.4 activation height in sample testnet configs (sample configs were incorrect in the 3.4.0.0.0 release).

Docker images have been published to GitHub Container Registry:

• stacks-core: https://github.com/stacks-network/stacks-core/pkgs/container/stacks-core

  docker pull ghcr.io/stacks-network/stacks-core:3.4.0.0.1

• stacks-signer: https://github.com/stacks-network/stacks-core/pkgs/container/stacks-signer

  docker pull ghcr.io/stacks-network/stacks-signer:3.4.0.0.1.0

This release is recommended for all Stacks node operators.

Release 3.4.0.0.0

This release implements the 3.4 Stacks consensus rules which activates at Bitcoin block 943,333.
For more details see the following SIPS:
SIP-039: Clarity 5 and Epoch 3.4
SIP-040: SIP for improved post-conditions
SIP-042: Removal of at-block

This is a required upgrade

• Activation is estimated for April 2, 2026 around 2000 UTC, or Bitcoin block 943,333.
• Upgrading after Bitcoin block 943,333 will require a genesis sync.

This release is compatible with chainstate directories from 3.3.x.x.x.

The version of stacks-signer compatible with this release is 3.4.0.0.0.0, available at: https://github.com/stacks-network/stacks-core/releases/tag/signer-3.4.0.0.0.0.

Testnet Config update

In the stacks-node config, ensure this section is added to the bottom of the config file (immediately after the [[burnchain.epochs]] 3.3 section):

[[burnchain.epochs]]
epoch_name = "3.4"
start_height = 159350

Added

• Set the epoch 3.4 activation height to 943,333 per SIP-039 and finalize all settings for epoch 3.4 and Clarity version 5.
• Added post-condition enhancements for epoch 3.4 (SIP-040): Originator post-condition mode (0x03) and NFT MAY SEND condition code (0x12), including serialization support and epoch-gated validation/enforcement.
• Disabled at-block starting from Epoch 3.4 (see SIP-042). New contracts referencing at-block are rejected during static analysis. Existing contracts that invoke it will fail at runtime with an AtBlockUnavailable error.

Changed

• /v3/blocks/simulate/{block_id} and /v3/block/replay no longer emit transaction events for post condition aborted transactions.
• EventDispatcher no longer emits transaction events for post condition aborted transactions.

Fixed

• Fixed signer database migration 19 that could leave the database in corrupted, unrecoverable state.

Release signer-3.4.0.0.0.0

This release implements the 3.4 Stacks consensus rules which activates at Bitcoin block 943,333.
For more details see the following SIPS:
SIP-039: Clarity 5 and Epoch 3.4
SIP-040: SIP for improved post-conditions
SIP-042: Removal of at-block

This is a required upgrade

• Activation is estimated for April 2, 2026 around 2000 UTC, or Bitcoin block 943,333.
• Upgrading after Bitcoin block 943,333 will require a genesis sync.

This release is compatible with chainstate directories from 3.3.x.x.x.

The version of stacks-node compatible with this release is 3.4.0.0.0, available at: https://github.com/stacks-network/stacks-core/releases/tag/3.4.0.0.0.

Fixed

• Fixed signer database migration 19 that could leave the database in corrupted, unrecoverable state.