v2.3.5

PPLNS: inactive miners age out of the window

• The window trims when it exceeds window_factor × network_difficulty. This pool sits at roughly 0.15 % of that threshold, so the trim never fired, the window grew without bound, and a miner who stopped mining kept its weight for good. Buckets older than abandoned_balance_days are now dropped as well; the bucket index is scored by the share's own accept time, written once when a bucket opens.
• An existing window is converted at the first boot: every bucket is stamped at that instant and nothing is evicted retroactively.
• The dust sweep pairs an abandoned credit against any open debit, not only against an abandoned one. The counterparty is by construction someone who was mining when the credit was withheld, so requiring silence from both sides meant the sweep never closed a single pair. A cancelled row now stays at zero instead of being deleted, because the same row carries the address's lifetime on-chain payout.

Worker sessions: the front decides who is connected

• A miner that paused with its socket open — standby overnight, a slow rig — lost its client:live:* key after five minutes, was retired by the dead-session sweep as dead and hard-deleted two hours later while still connected. It vanished from /api/client/:address and its hashrate from the total until it reconnected. Measured on prod before the fix: 46 of 635 connected devices had no visible row (an upper bound).
• The front now publishes which device holds each session (session:live:<front>) next to the device counts it already published. The sweep treats a held session as alive and falls back to the key verdict only where no front publishes sessions. A dead peer still leaves within about 140 s through the TCP keepalive the front sets on every miner socket.
• The revive lookback grows from 15 minutes to the row's two-hour retention.

Upgrade notes

• abandoned_balance_days now bounds the payout window as well as the ledger: a miner silent that long stops earning a share of the next block. Check the value before deploying; the example config describes both effects.
• Exactly abandoned_balance_days after the first boot on this release, every pre-existing bucket becomes eligible at once and the window drops to the work done since that boot, drained at 64 buckets per share append.
• Roll out payout before core. Until core runs this release no front publishes sessions and the sweep behaves as before. The core swap reconnects every miner, which also recreates the rows of sessions retired earlier.
• No migration, no config key added or removed.