Bitcoin Core

ipc # build: Fix fuzz target CMakeLists.txt for external libmultiprocess

**What failed:** Build error: 'mp/proxy-io.h' file not found when
building the ipc fuzz target.

**Root cause:** Upstream commit 037ad770714 (fuzz: add IPC round-trip
target) added target_link_libraries(fuzz bitcoin_ipc_fuzz multiprocess)
using the bare 'multiprocess' target, which only exists in subtree
builds. With WITH_EXTERNAL_LIBMULTIPROCESS=ON, no 'multiprocess' cmake
target is defined, so the INTERFACE_INCLUDE_DIRECTORIES from the
installed libmultiprocess headers were never propagated to the fuzz
target, causing the missing-header error.

**Fix:** Changed to 'Libmultiprocess::multiprocess', which is the
canonical namespaced target available in both subtree and external builds.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

depends: capnp 1.5.0

bench: replace CreateMockableWalletDatabase with MakeInMemoryWalletDatabase

Benchmarks don't need mock-specific behaviour (overridden Filename(),
Format(), or the exposed batch-level WriteKey()). Replace
CreateMockableWalletDatabase() with MakeInMemoryWalletDatabase() across
6 call sites in src/bench/ (5 files), using the same in-memory SQLite
path that production code uses.

wallet_migration.cpp is excluded: it calls GetOrCreateLegacyDataSPKM()
which asserts Format() == "sqlite-mock", a signal used to allow legacy
SPKM setup in test/bench contexts. MockableSQLiteDatabase is still
correct there.

For coin_selection.cpp, which had no other dependencies on
wallet/test/util.h, also switch the include to <wallet/sqlite.h>.

Follow-up suggested in #35655.

net_processing: Replace CompareInvMempoolOrder

Remove CompareInvMempoolOrder, replacing it with the new
ExtractBestByMiningScoreWithTopology. The trickle send code is reworked
accordingly.

txmempool: Drop CompareMiningScoreWithTopology

Now unused; replaced by ExtractBestByMiningScoreWithTopology.

util/tokenbucket.h: Provide a generic TokenBucket class

This is a simple token bucket parameterized on clock type, used in the
following commit.

net_processing: Provide a 30bpm heartbeat log while inv backlog is in use

init: add -txsendrate configuration parameter

Adds a debug-only configuration option to set the target
transaction/second rate for relay to inbound connections. This is mostly
intended to be set to artificially low values to aid in testing behaviour
when a backlog occurs, but is also available in case the default 14tx/s
target is somehow too low in practice.

rpc: report -txsendrate and bucket info via getnetworkinfo

Add `tx_send_rate` and `inv_buckets` fields to getnetworkinfo. The
`inv_buckets` field has separate `inbound` and `outbound` entries,
reporting backlog count, count tokens, and size tokens. Useful for
monitoring relay behavior.

tests: basic functional test for tx rate limiting

doc: Add release note for -txsendrate etc

net_processing: Drop unnecessary txid arg from InitiateTxBroadcastToAll

net_processing: add a global delay queue for sending txs

Without the per-peer rate limiting, nodes can act as an amplifier for
transaction spam -- receiving many transactions from one node, but
relaying each of them to over 100 other nodes. Limit the impact of this
by providing a global rate limit.

This is implemented using dual token buckets, one that consumes a
token for every transaction, and one that consumes a token for every
serialized byte. This rate limits both per-tx resource usage (eg INV
messages) and overall relay bandwidth.

Main bucket parameters:
* Count: 14tx/s rate, 420tx (30s) capacity
* Size: 12MB/600s rate (4-6 blocks per target block interval), 50MB capacity

The size bucket is expected to be large enough to almost never have an
impact in normal usage, even during transaction storms, and is primarily
intended to mitigate attack-like scenarios.

Outbound connections get a separate pair of buckets, with rates boosted
by a 2.5x multiplier.

This avoids the excessive memory and CPU usage due to the 100x multiplier
from the queues being per-peer.

Note that this also reduces the size of INV messages we send for general
tx relay back to a more reasonable level of under 600 txs in 99.999%
of cases.

txmempool: Add ExtractBestByMiningScoreWithTopology

Add a method for (partially) sorting a batch of transactions (specified as
a std::vector of wtxids) per mempool order, designed for transaction relay.

net_processing: Remove per-peer rate-limiting

Per-peer rate limiting introduces storage and compute costs proportional
to the number of peers. This has caused severe bugs in the past, and
continues to be a risk in the event of periods of extremely high rates
of transaction submission. Avoid these problems by always completely
emptying the m_tx_inventory_to_send queue when processing it.

Note that this increases the potential size of INV messages we send
for normal tx relay from ~1000 (limited by INVENTORY_BROADCAST_MAX)
to potentially 50000 (limited by MAX_INV_SZ).

net_processing: bump last_inv_sequence for bip35 messages explicitly

This avoids relying on the bump that occurs through the normal INV
process, which is confusing.

test: Remove `mock_process.cpp`

The previous binary used a number of `Boost.Test` features:
- `boost::unit_test::disable`
- `BOOST_FAIL`
- `boost::exit_test_failure`

This patch duplicates the previous mock process behavior with no boost features.

With the patch we can:
- simplify the test config
- remove a linted boost include
- remove a file that was not actually a test

test: cover unused mempool space in coins cache

Co-authored-by: l0rinc <pap.lorinc@gmail.com>

test: cover disconnect on private broadcast peer with relay=false

addrman: remove unreachable tried-collision branch

`ResolveCollisions_()` had a fallback for the case where a pending tried
collision no longer collided because the destination tried slot became
empty.

Under current addrman invariants this cannot happen: once an entry is
added to `m_tried_collisions`, the corresponding tried slot remains
occupied until the collision is resolved. The only other valid outcomes
are that the pending new entry disappears or becomes invalid, both of
which are already handled.

Remove the dead branch and replace the implicit assumption with
assertions in `ResolveCollisions_()` and `SelectTriedCollision_()`.

doc: archive release notes for v29.4

wallet: Introduce WalletError with machine-readable error code

Introduce WalletError as a generic wallet-layer error type that can carry a machine-readable WalletErrorCode and a translated user-facing message.

The WalletErrorCode::GenericError code is intended for failures that callers should only display to the user. More specific codes should only be added when callers can handle the condition differently.

doc: Update enum class constant naming style guide

Remove myself as security contact

node: smooth oversized `-dbcache` warnings

The oversized `-dbcache` warning currently switches from a fixed `450 MiB` threshold below `2 GiB` of RAM to `75%` of total RAM at `2 GiB`.
This creates a cliff where a small increase in RAM can raise the warning threshold to about `1536 MiB`.

Apply the `75%` factor only to RAM above a `2 GiB` reserve while keeping `DEFAULT_DB_CACHE` as the minimum threshold.
This removes the cliff: the threshold stays at the default until the percentage term exceeds it, then grows by `0.75 MiB` per additional MiB of RAM.

This also aligns better with the recently merged parallel input prevout fetcher which performs better with slightly lower dbcache memory.

Co-authored-by: Bortlesboat <Bortlesboat@users.noreply.github.com>