Release 4.0.2: Optional, recommended for signers

[Brice Dobry]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Hello,

Stacks core developers have released Stacks Core version 4.0.2, available here:

https://github.com/stacks-network/stacks-core/releases/tag/4.0.2

This release is optional but recommended for all Stacks node and signer operators.

This release is compatible with chainstate directories from 4.0.x.

## Docker images have been published to GitHub Container Registry:

### **stacks-core**
* Debian (glibc): https://github.com/stacks-network/stacks-core/pkgs/container/stacks-core/1121957647?tag=4.0.2
```sh
docker pull ghcr.io/stacks-network/stacks-core:4.0.2@sha256:c62770f5dee7a3fa69351b948adf845f0c5cbc1e93414f4264368977aa1aa8ad
```

* Alpine (musl): https://github.com/stacks-network/stacks-core/pkgs/container/stacks-core/1121956340?tag=4.0.2-alpine
```sh
docker pull ghcr.io/stacks-network/stacks-core:4.0.2-alpine@sha256:74d62c261684eee37e9710e75a5f064d6bc931cf1208d95cc4bacf70c3d6150b
```

### **stacks-signer**
* Debian (glibc): https://github.com/stacks-network/stacks-signer/pkgs/container/stacks-signer/1121954314?tag=4.0.2
```sh
docker pull ghcr.io/stacks-network/stacks-signer:4.0.2@sha256:16fca040a7122ba3f30680fe92c17497ab88dc08a3d81f7e88c5bfc8df927c9f
```

* Alpine (musl): https://github.com/stacks-network/stacks-signer/pkgs/container/stacks-signer/1121953500?tag=4.0.2-alpine
```sh
docker pull ghcr.io/stacks-network/stacks-signer:4.0.2-alpine@sha256:1fb252e5947882a2e343fcc388e494676074c026fb276e3975ebcf2d0b69f672
```

This release includes the following changes:

## Stacks Node

https://github.com/stacks-network/stacks-core/blob/4.0.2/CHANGELOG.md

### ⚠️ Breaking Changes

* Miner configurations must now set `burnchain.wallet_name` to an existing wallet (ASCII letters, digits and `. _ - /`), regardless of the Bitcoin Core version; this also fixes compatibility with Bitcoin Core >= 31, which removed unnamed wallets.
* Loading is session-only: set `wallet=<name>` in `bitcoin.conf` to reload it after a bitcoind restart. After `migratewallet`, point `wallet_name` at the wallet holding the miner's addresses.

### Added

* Added an `[[events_observer]]` config option `disable_contract_interface` (default `false`). When set to `true` for an observer, the `contract_interface` (ABI) field of every transaction in `new_block` and `new_microblocks` event payloads sent to that observer is emitted as `null`, omitting the generated contract interface from that observer's event stream. This does not affect consensus, block validation, other observers, or any other event field.
* Added public constructors to run Clarity block processing (`ClarityBlockConnection` / `ClarityTx`) and genesis boot (`instantiate_boot_code`) against an arbitrary `WritableMarfStore`, so alternative storage backends can drive the consensus transaction engine without forking chainstate code ([#7428](https://github.com/stacks-network/stacks-core/pull/7428)).
* Refactored and expanded the defense-in-depth memory allocation limiter during non-consensus-critical transaction processing. Also, the  `/v2/contracts/call-read` and `/v3/contracts/fast-call-read` RPC endpoints no longer return the incorrect 408 status code when a contract call exceeds the limits, but a 400.

### Changed

* Added opt-in Clarity VM hook support for structured call tracing.
* Shrunk `size_of::<Value>()` from 128 to 64 bytes by boxing `CallableData::trait_identifier`, halving the memory of every `Vec<Value>`, clone, and stack copy in the Clarity VM and deserializer.
* Reduced Clarity `Value` deserialization cost: ~57% lower peak memory for untyped reads of large lists and 15-55% less CPU across deserialization paths.
* Improve test harnesses for vm tests (`costs.rs`, `analysis_costs.rs`, `large_contract.rs`, `transactions.rs`)
* Improve the `POST /v2/stackerdb/<address>/<contract>/chunks` handler to report each chunk-replacement failure with a precise error code adding dedicated `ChunkTooBig` and `TooManySlotWrites` codes instead of collapsing them into `DataAlreadyExists`.
* Improve miner stackerdb error handling taking into consideration the new error codes.
* In the reference `signer-manager.clar` contract, `claim-staker-rewards` now returns `{ earned, withdrawal-request }` instead of a bare `uint`; where `withdrawal-request` is `(some uint)` with the withdrawal request ID when the payout was routed to an L1 sBTC withdrawal and `none` for an sBTC payout.
* Cache prepared statements on hot SQLite read paths (Clarity side-store reads, MARF block-id/hash lookups, and the generic `query_*` helpers) instead of re-parsing the SQL on every call, and raise the per-connection statement-cache capacity so the cache is not LRU-thrashed
* `stacks-inspect validate-block` now opens the chainstate and sortition databases once per run instead of once per block, and caches the Nakamoto reward set per reward cycle

### Fixed

* Ensure sorting p2p neighbors by uptime behaves predictably in the face of system clock adjustments.
* Swap the order of the analysis checks so that the type checker runs before the read-only checker. The latter makes some assumptions about the type soundness, so it's more appropriate that the former runs first. This change can be consensus-breaking (albeit only in rare edge cases), so it's gated to start in Epoch 4.1.
* Fix the stringification of block proposal rejections based on a mismatch of the consensus hash between the proposal and the miner's tenure. The error message had the expected and actual values in the wrong order.
* Fix `MARF::squash_to_path` dropping the squash annotation on inline child pointers when the source MARF is itself a squashed (PCS) MARF.
* From Epoch 4.1, `from-consensus-buff?` rejects typed tuples whose declared fields are duplicated or missing.

### Removed

* Removed unused MARF trie-node caching functionality (default=noop)

## Stacks Signer

https://github.com/stacks-network/stacks-core/blob/4.0.2/stacks-signer/CHANGELOG.md

### ⚠️ Breaking Changes

* The signer now refuses to start if its configuration file contains unrecognized fields, instead of silently ignoring them. This catches misspelled option names that previously would have slipped by without warning.

### Fixed

* Accept a replacement tenure-start block when the previous proposal in the tenure was only pre-committed (never signed), instead of rejecting it with `DuplicateBlockFound`. This prevents a stall that occasionally shows up on mainnet.
* Refuse to sign a block at the pre-commit threshold if a different block at the same or higher height in the tenure has been signed or accepted within `tenure_last_block_proposal_timeout`. After that timeout, the signer consults the node and only signs the replacement if the canonical tip of the tenure is still below the proposed height (e.g. because the conflicting blocks were orphaned by a Bitcoin reorg).

********************************************************************************

Stacks Core:

Git commit hash: 1b57c3fb6709ab927f9179ab6814f874c84f5303

SHA512SUMS:
809a34c51c1b19eec073af6635ff91ce04cae104f3e1323009682ea0cc5a8233df8fec9d05fb01a66f63a27be67690367b58bc687ccef37666929f571def411d  linux-glibc-arm64.zip
21c54c5ec7743cf0f062e1631ec82a32e446d035cb5a735f0e75d4d817a374768cf105935651515cab13fd95f7addaa313b272220ee2de5c89fe8a85519e9f55  linux-glibc-x64.zip
3606267c0db4d67c0573fd01ae3257e247fc600acd18efc9bdb43ec275dc4bdfe42560f3547ca89c79da2430148a86d8c53363c2798818d9c00e398492235dbb  linux-musl-arm64.zip
90745782b282cff8ff967201b6d991c3200bfa617d796072e42d5436908d9b371dadd6eca6cf3ae8baf42478147949cbad3a4a1dbdfd2e7b145dd5e4c9544d31  linux-musl-x64.zip
4acf01d24c0b1c774b2c057b9a9fba1f6be30c41e80d156a02c937a81d6ef1252c7b9a370c31df39616faa274b78b0cda52b29f84a1020b78428bc2defad7b93  macos-arm64.zip
8629d3b48a06de47f5d6fc7fdb35892f11a66cbcd40dbc0128ff2faa863742ca6185dc30e1e79b6df97d8026db3f1de3c04d87795b733ca96273c9dbda65e8e5  windows-x64.zip

********************************************************************************

Best,

Brice Dobry
Staff Engineer, Stacks Labs

-----BEGIN PGP SIGNATURE-----

iQFlBAEBCABPFiEEVTrGj54NWyQJkqD84zO/PN0rBYYFAmp7j/wbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzFRxicmljZUBzdGFja3NsYWJzLmNvbQAKCRDjM788
3SsFhlMgB/9xAc3LJEJzp8ZYaqr/Lmr8Ama0CtGARiCcoe0WvoK4zRn8I0z/bWiG
hSrmZpbNZGw7bfsBI/uiy0WF+TTMhwvdulAakpBHaYE2CduzPc5FbLsxMWBi+ScV
BpqkNXppui+5Pp/IzJKl39kDvIUj2a+iXyU2a4lF3fCF1MpE11njR+ez716AflMb
CHuGmZp8E9fZh/CeKNfhxJ4f2WF20OTSkGyBvyafKqTxThnQ+HxQNKobJxU+dPRO
DF1HmjzTjk8J4Zym457zTwYLtgw59JpM1nGWN+2OmJ3mlx54lUTxp34+EMS3uBdA
116ta5ycRKUo17l/bjZUIbqXnoKFgwyR
=+Ele
-----END PGP SIGNATURE-----