v0.40.0

⚠️ Upgrade notes

• All validators must upgrade together. MAX_WASM_POINTS_PER_TRANSACTION (100M → 250M) and
  max_block_validation_execution_points (7.1e9 → 7.25e9) are consensus rules — mixed versions
  disagree on block validity.
• Transaction receipts change. An input with no live version now rejects with
  "Substate {id} is not found or DOWN". The receipt is hashed into the state tree, so mixed
  versions diverge.
• Nodes refuse to start if the binary introduces a substate schema activation at an epoch the
  node has already run past. Override with --allow-past-protocol-activation only when discarding
  state. No existing network is affected — every schedule is still [(Epoch(0), V0)].
• Indexer config: latest_substate_cache_ttl is replaced by substate_cache_max_serve_lag
  (300s) and substate_cache_max_entries (100k). max_serve_lag must exceed a full sync round,
  not just state_scanning_interval. A SQLite migration runs on first start; the old cacache
  directory can be deleted.
• tari_indexer_client: GetIndexerInfoResponse.latest_substate_cache_ttl_secs →
  substate_cache_max_serve_lag_secs.

Fixes

• State sync no longer corrupts the state tree. The stream reopened at the shard's
  already-persisted version; the rewrite marked live JMT nodes stale and the GC deleted them an hour
  later, wedging the node permanently (A node v6384:f9 expected to exist … was not found).
  Unrecoverable without a database wipe. (#2495)
• A validator whose pool was cleared can vote again. After a state sync the next epoch re-proposed
  a cleared transaction; the node no-voted every block for ~65 minutes. The pool record is now
  re-derived from the transaction we already hold. (#2496)
• Destroyed and never-existed substates report identically. The distinction reflects retained
  history, not the ledger, but reached the receipt — nodes with different epoch_history_length
  committed different receipts. (#2490)
• UP_ONLY decides liveness by destruction, not value presence. Substates destroyed within the
  GC window were streamed as live and never corrected, so an indexer reported spent UTXOs as unspent
  for its whole life. (#2491)
• Indexer WASM module cache resolves against the configured data dir. (#2486)

Changes

• WASM metering ceiling 100M → 250M points (~12ms → ~30ms CPU). At the old ceiling a Groth16/BN254
  verify fitted only with one public input, at 96% of budget; at 250M a 16-input statement fits at
  70%, and two verifies fit in one transaction. The proposal budget is unchanged. (#2482)
• Substate schema activations are per network, and the two copies of the schedule are consolidated
  into one. (#2487)
• Indexer substate cache is invalidated by the transition stream, so unversioned reads are servable
  indefinitely rather than for 2s — removing a committee round trip per vault and per resource on a
  wallet account refresh. (#2498)

Crate versions

[workspace.package].version → 0.40.0 (whole tier-3 cohort). Independently versioned:
tari_ootle_wallet_crypto, tari_ootle_wallet_sdk, tari_ootle_wallet_storage_sqlite,
tari_ootle_walletd_client 0.41.0 → 0.42.0; tari_indexer_client 0.40.0 → 0.41.0; ootle-rs
0.21.0 → 0.22.0.

What's Changed

• docs: add changelog entries for 0.39.1, 0.39.2 and 0.39.3 by @sdbondi in #2485
• fix(indexer): resolve wasm cache dir against the configured data dir by @sdbondi in #2486
• feat(engine)!: raise the per-transaction WASM metering budget to 250M points by @sdbondi in #2482
• feat(consensus): make the substate schema activation schedule per network by @sdbondi in #2487
• chore(deps): bump taiki-e/install-action from 2.86.5 to 2.87.0 by @dependabot[bot] in #2489
• fix(storage): decide UP_ONLY liveness by destruction, not value presence by @sdbondi in #2491
• test(walletd): build balance-change fixtures in one transaction by @sdbondi in #2494
• fix(consensus)!: report a destroyed substate as not found by @sdbondi in #2490
• fix(swarmd): clean up log output by @sdbondi in #2497
• fix(state-sync): start the state stream at the first unpersisted version by @sdbondi in #2495
• fix(consensus): re-sequence a proposal's transaction when its pool record is gone by @sdbondi in #2496
• ci: give consensus tests room past the 240s kill by @sdbondi in #2501
• feat(indexer): invalidate the substate cache from the transition stream by @sdbondi in #2498
• chore(deps): bump browserslist from 4.28.6 to 4.28.8 in /applications/tari_swarm_daemon/webui by @dependabot[bot] in #2504
• docs: add changelog entries for 0.40.0 by @sdbondi in #2507

Full Changelog: v0.39.3...v0.40.0