reardencode · Oct 4, 2026 · Oct 2, 2026
diff --git a/changelog.d/livera-review.md b/changelog.d/livera-review.md
@@ -0,0 +1,5 @@
+Security
+
+- Thanks to Stephan Livera for the 2026-10-02 review of P2P resource
+  accounting, inbound eviction, REST, and silent-payment logging.
+  Status board: docs/external_findings/052-livera-review-index.md.
diff --git a/docs/external_findings/052-livera-review-index.md b/docs/external_findings/052-livera-review-index.md
@@ -0,0 +1,49 @@
+# 052 — Livera review index
+
+Review by Stephan Livera, 2026-10-02, commit `058adb8d`. This index is
+the status board. Each fixed row names the regression. No reproduction
+steps.
+
+| Id | Severity | Topic | Status | Regression |
+|----|----------|--------|--------|------------|
+| C1 | critical | Unbounded parent-request tracker | open | — |
+| N2 | low | Wtxid follow-up requested as a txid | open | — |
+| H1 | high | Decoy and invalid-type packets skip the rate window | open | — |
+| H2 | high | Inbound eviction drops the longest-connected peer | open | — |
+| H2-ban | high | Misbehavior disconnect is not remembered | open | — |
+| H3 | high | REST always on and shares the RPC work queue | open | — |
+| H4 | medium | Silent-payment unsubscribe logs the scan secret | open | — |
+| H5 | high | IBD reader credits unsolicited data as progress | open | — |
+| N1 | medium | Inv getdata does not charge the send budget | open | — |
+| M1 | medium | Block getdata can queue past the send budget | open | — |
+| M2 | medium | Silent-payment scan span is unbounded when start is set | open | — |
+| M3 | medium | RPC listener has no accept timeout; long-poll holds a permit | open | — |
+| M4 | medium | fuse8 segment length need not be a power of two | open | — |
+| M5 | medium | Class A bulk read ignores the published end | open | — |
+| M6 | medium | Testnet milestone is height-only | open | — |
+| M7 | medium | Mempool inv is one message per transaction | open | — |
+| M8 | medium | Pending blocks and orphans are count-capped only | open | — |
+| M9 | high | io_uring drop can free a buffer the kernel still owns | open | — |
+| M10 | low | Secret types derive Debug; create-then-chmod | open | — |
+| L1 | low | Height-0 BIP68 time lock uses median time 0 | open | — |
+| L4 | low | Empty median time panics | open | — |
+| L5 | low | Version nonce is not a CSPRNG | open | — |
+| L6 | low | Recent-reject set clears at the cap | open | — |
+| L8 | low | Manifest and txstat lengths allocate before a size check | open | — |
+| L9 | low | Tor control password on argv | open | — |
+| L10 | low | Datadir lock follows a symlink | open | — |
+| L11 | low | Conf parse errors echo the raw line | open | — |
+| L12 | low | Invalid-hash set grows without a cap | open | — |
+| L13 | low | Rate window grants two budgets at the boundary | open | — |
+| L14 | low | Mempool expiry runs only on admission | open | — |
+| L15 | low | Write jobs form a mutable slice over a shared buffer | open | — |
+| L2 | — | P2PKH fast path skips FindAndDelete | rejected | The fast path is the 25-byte template. A DER signature does not fit in that scriptCode, so FindAndDelete cannot change it. |
+| L3 | — | Witness-v0 strict DER independent of BIP66 | rejected | BIP141 witness verification is strict DER. Mainnet, testnet, signet, and regtest are unaffected. |
+| L7 | low | Rewind deeper than 1024 is refused | won't-fix | `REWIND_MAX_DEPTH` is a deliberate denial-of-service cap. Removing it needs an operator decision. No new knob. |
+| L16 | — | Warnet image is pinned by tag | won't-fix | `scripts/core-functional/warnet/Dockerfile` is a lab image, not a Release. |
+| eclipse | — | Inverted eviction eclipses the node | rejected | Outbound peers are not eviction candidates. The defect is inbound-slot monopoly, tracked as H2. |
+| M2-sh | — | Silent-payment subscribe must require `--sh-index` | rejected | The scan uses the tweak index, not the scripthash index (finding 036). |
+| M8-fee | — | Fee and sigop checks at orphan park | rejected | The parent outputs are not available yet. Shape checks already run before park. |
+| M6-flag | — | Height-only `--milestone` needs a new flag | rejected | Explicit `--milestone HEIGHT` is already that switch (finding 042). |
+
+Owner: [`quality.md`](../quality.md) **Q-72**.
diff --git a/docs/external_findings/README.md b/docs/external_findings/README.md
@@ -56,6 +56,7 @@ rbitcoin reference, or redteam static analysis). Numbered reports live beside th
 | [044](./044-local-auth.md) | low | Tor SAFECOOKIE, datadir `0700`, socket mode, overlay permissions | fixed | `tor_control_onion_lifecycle` |
 | [043](./043-peer-send-buffer.md) | high | Unbounded per-peer outbound queue | fixed | `hostile_peer_session` |
 | [040](./040-corrupt-bounds.md) | medium | Corrupt uleb128, seqsigwit lengths, and BDZ modulus | fixed | `read_packed_zero_modulus_or_vertices_is_corrupt` |
+| [052](./052-livera-review-index.md) | — | Livera review index | index | Q-72 |
 
 **012–021:** fuzzamoto differential report (`rbitcoin-report.tar.gz`, baseline
 `8f3990f`). Report-local 001–010 are **renumbered** here. Identity/BIP30

diff --git a/docs/quality.md b/docs/quality.md
@@ -37,9 +37,10 @@ Counts and procedures stay in the owner doc. A row is the rank and the outcome.
 | 7 | **Q-70** | Batch lookup-path hit counters if a profile names them | `head_resolve_stats::add_hit_rank` does two relaxed `fetch_add`s per resolved txid (`head_resolve_denserels`, `tx_table`). SH extract collect flushes output and hit counts once per fk batch, not per output. Still once per event: `accepted_wb` (`SeqCst`, per confirmed block), `serve_perf::note_serve` (per historical getdata), `page_ios` (per SH page read). Done: a profile shows `add_hit_rank` on confirm lookup and those counters flush per batch, or the profile shows the line is noise and this row moves to Won't-fix. `add_hit_ages` is already a batched flush; `add_hit_age` remains the one-bucket path. |
 | 8 | **Q-71** | Talip review remediations | Every row in [`external_findings/024-talip-review-index.md`](./external_findings/024-talip-review-index.md) is fixed, rejected, or won't-fix, and each fixed row names a regression. |
 | 9 | **Q-64** | SV2 template provider (TDP server) | Node serves Noise-encrypted Template Distribution Protocol in-process: `CoinbaseOutputConstraints` → pushed `NewTemplate` / `SetNewPrevHash` on tip change and fee delta, `RequestTransactionData`, `SubmitSolution` → `accept_block`. Roadmap (plans A → B → C, one PR each): [`sv2-template-provider.md`](./sv2-template-provider.md). |
+| 10 | **Q-72** | Livera review remediations | Every row in [`external_findings/052-livera-review-index.md`](./external_findings/052-livera-review-index.md) is fixed, rejected, or won't-fix, and each fixed row names a regression. |
 
 R-ids were the 2026-08-12 slice. Canonical id is **bold**. Do not start
-**R-11+**. Next unused Q-id is **Q-72**.
+**R-11+**. Next unused Q-id is **Q-73**.
 
 Close work by **writing the Open row into `changelog.d/`** in the same edit as
 the landing change (do not grow a Completed museum here). New item: insert