knots-next-29: 29.4.3rc1 with k429 at its current head, k445, k444, k443, k459, k319, k422

[chrisguida]

Spec for 29.4.3rc1, following up #4.

• k429 (bitcoinknots/bitcoin#429): head moved from a049372c27f to 6d1b0706a83: Luke's round-2 review items, the spkm_migration fuzz use-after-free fix (the backport itself is k445), and jasonsopko's change limiting the one-year policy hold to coins covered by the rule.
• k445 (bitcoinknots/bitcoin#445): backport of fuzz: wallet: add target for MigrateToDescriptor bitcoin/bitcoin#32624 plus the one #32977 commit it needs; this is what turns k429's fuzz CI job green.
• k444 (bitcoinknots/bitcoin#444): assumeutxo snapshot at 976000, the first entry past the BLAKE2b fork, needed by the DATUM easy-install miners (approved by Luke and Kyle). The PR branch is rooted on the released 29.4.2 tip, which the assembler cannot merge, so the spec merges the copy chrisguida/assumeutxo-976000-29+knots (same commit on the k385 merge, as #425 is) and tracks the PR head.
• k443 (bitcoinknots/bitcoin#443): backport of Rollback for dumptxoutset without invalidating blocks bitcoin/bitcoin#33477 (dumptxoutset rollback on a copy of the UTXO set, used to produce k444). Same situation: the spec merges the copy chrisguida/dumptxoutset-rollback-copy-29+knots (the three commits on the compat_rpc_dumptxoutset_hr merge they depend on), listed right after that line, tracking the PR head.
• k459 (bitcoinknots/bitcoin#459): testnet4 RDTS expiry extended to 2027-04-01 00:00 UTC, retroactively (the deployment expired 2026-10-13 15:00 UTC; nodes re-check blocks from 152963 through a chainstate revalidation entry). Keeps k429 a softfork on 29.4.2 on testnet4. The PR is one commit on the k419 base; the spec merges the copy chrisguida/rdts-testnet4-extension-k429-29+knots, the same change rebased onto k429 and k425 (k425 edits the line directly above the testnet4 expiry, k429 rewrote the revalidation-deployment test), listed after k425 and tracking the PR head with last=.
• k319 (bitcoinknots/bitcoin#319) and k422 (bitcoinknots/bitcoin#422) (Kyle): count bare data envelopes, and pubkeys no signature can prove, as datacarrier bytes; #422 now also counts tapscript keys and contains #319's commits; its marker is the head with the CI fixes applied. Both rooted on datacarrier_opnet-29+knots, so they sit right after k292. jasonsopko approved both. Over the chain since the fork these two refuse about 84% of the spam weight that stock 29.4.2 relays, with one legitimate casualty in the whole corpus (a Liquid federation emergency spend); on a year of pre-fork history the cost is not measurable.
• Triage lines (not active): k389 and k400 (jasonsopko, output hashes/keys and dead branches; both rooted on the released tip and would need rebased copies), k457 (Kyle, TX_NOT_STANDARD for datacarrier rejections).
• k394 (bitcoinknots/bitcoin#394): marker moved to 8e50d772c1a: jasonsopko restored the testnet4 and cjdns fixed seeds in the PR itself, the same fix the privkeyio copy carries.
• Mirrored into -next and -next-28 like knots-next-29: 29.4.3rc1 with k429, k425, k398, k394, k437, k430 #4 (k443 only as a triage comment in -next-28, its rebase is 29.x-specific).

Assembled tree: chrisguida/bitcoin 29.4.3rc1-candidate-20261014b (a7d7d2e7c3f, tree e9eca3571345), produced with the reproduction scripts from #2 run in forward mode against this spec (branch tips pinned to their v29.4.2 release-time commits, the merge-script identity, TZ=UTC): 455 merges, no conflicts, no autoresolvers. Build, unit (771 cases) and the functional suite pass on it locally (294 passed, 65 skipped for BDB/USDT/ZMQ/previous-release variants, 0 failed).

CI: run 38609164952 is green on all 18 jobs for a tree that differs from this candidate only by one comment line in a test (it was the previous assembly plus the two one-line fixes that k422's head now carries; the first candidate run, 38509266693, had failed exactly those two points: an MSVC narrowing at script.cpp:389 and a UBSan integer finding in the new test helper). The run on this exact candidate, 38627051940, is green on all 18 jobs (the Win64 native job needed a re-run after feature_dbcrash.py timed out restarting a node on the first attempt; it passed in 44 minutes on the second).

Observed while assembling the spec at knots-spec tip:

• line 818 35197 lld_icf_safe-28 ... last=24ad7419dea fanquake/lld_icf_safe: fanquake force-pushed; the old commit is still fetchable by full SHA but the branch now points at ee9f7dbf5fe with a changed patch (-faddrsig -Wl,--icf=safe, the two try_append_linker_flag lines swapped). Left as is for Luke to review; a fresh checkout stops there.
• (cherrypick=488640fe20b) (doc/bips) exists only in Luke's repo; outside it the recorded result 37b6ff5929f is the byte-equivalent source. Left as is.

Not touched: k441, k431 (follow-up to k430; left out to keep the release small), k456 (fee floor for unproven multisig operands; overlaps k422).

[jasonsopko]

k400 (bitcoinknots/bitcoin#400, data in dead conditional branches) is ready for a line. The PR branch is now rooted on the k354 merge of 29.4.2 (aff00ffdcd3) with the k422 head (eea24673b4d) merged in, since both change DatacarrierBytes and k422 is not in a 29.4.2 merge yet. The PR head is the branch to merge: every user/branch the spec merges resolves at github.com/user/bitcoin, and jasonsopko/bitcoin does not exist. If a linear copy on the candidate's own k422 merge is preferred instead, say so; privkeyio hosted that kind of copy for k394. So it goes right after the k354 line at the end of the POLICY section, not where the triage comment sits under k422; that comment goes away:

	k400  -												last=847d6a232f9
		# count data in a conditional branch that constants make unreachable as datacarrier bytes, behind -rejectdeadbranches (default on, reset by -corepolicy); rooted on the k354 merge aff00ffdcd3 with the k422 head eea24673b4d merged in (it changes the function k422 changes), so it must follow both

Checked here: the branch merges into 29.4.3rc1-candidate-20261014b (a7d7d2e7c3f) with no conflict, and the result differs from the candidate by exactly the PR's diff (10 files, +627/-9). On that merged tree, without wallet: -Werror build, ctest 131 of 131, functional suite 218 passed, 141 skipped, 0 failed. On the branch alone (ctest 128 of 128, functional 202 passed, 138 skipped) the one failure is tool_cli_completion.py, which fails on anything rooted before the release regenerated the completions. The old head failed the previous-releases CI job on gcc 11 (may be used uninitialized, four number locals); the new head starts those locals at zero, and the fork CI run on it is https://github.com/jasonsopko/bitcoinknots/actions/runs/38674849436. If k422's head moves, say so and I will re-root.

[jasonsopko]

k389 (bitcoinknots/bitcoin#389, data in output hashes and keys) has the same base fix as k400 now: the PR branch sits on the k400 head 847d6a232f, since both change DatacarrierBytes in policy.cpp, so it goes right after the k400 line, and the Needs review: k389 comment under k422 goes away:

	k389  -												last=40e0e6f2679
		# count outputs whose hash or key is data as datacarrier bytes, behind -rejectfakeoutputs (default on, reset by -corepolicy); rooted on the k400 head (it changes the function k400 changes), so it must follow it

Checked here: the branch merges into 29.4.3rc1-candidate-20261014b (a7d7d2e7c3f) after k400 with no conflict, and the result differs from that tree by exactly the PR's diff (11 files, +537/-9). On the merged tree, without wallet: -Werror build, ctest 131 of 131, functional suite 219 passed, 141 skipped, 0 failed. On the branch alone: ctest 128 of 128 and its own functional tests pass; tool_cli_completion.py fails there as on k400 (the root predates the regenerated completions) and passes on the merged tree, so expect the fork CI on it (https://github.com/jasonsopko/bitcoinknots/actions/runs/38720016274) red on that one test in every job that runs the functional suite, as k400's run is. Review state is as it was: kwsantiago's four threads of 2026-09-02 are answered, no re-review since.

[jasonsopko]

k400 head moved to df767118a9: one commit on top of 847d6a232f9 adding the fuzz target Chris asked for on the PR (src/test/fuzz/datacarrier_dead_branch.cpp; FindDeadParts and DeadParts into script.h, no code change). Only the last= changes:

	k400  -												last=df767118a99

k389 (last=40e0e6f2679) stays rooted on 847d6a232f9 and merges clean after the new k400 head.