zaino: re-vendor to upstream 0.10.0 (chain-store refactor)

[aphelionz]

Re-vendors zaino/ from 07695fac5e (2026-08-19) to upstream 0.10.0 (f1d2befe62, tagged 2026-09-11), 265 commits.

Motivated by the 2026-09-15 upstream watch. This component had been held since 08-19 because there was no pinnable target; 0.10.0 is one.

Why the tag, not dev

dev is an ancestor of 0.10.0, three commits behind it, so the tag is strictly the better pin per MAINTENANCE.md rather than a compromise. Worth correcting the record: the 09-07 watch reported that 0.9.0 was not an ancestor of dev. That is no longer true, and 0.10.0 supersedes the question.

What upstream did

• Split the finalised state out of zaino-state into backend crates: zaino-chain-store, zaino-chain-store-zainodb, zaino-encoding, zaino-primitives, zaino-chain-head-service.
• feat!: remove zcashd support entirely (8c823f6108).
• Deleted chain_index/non_finalised_state.rs; its writer task moved to zaino-chain-head-service.

Conflicts, and how they resolved

Three, far fewer than the file-name intersection predicted. chain_index.rs auto-merged, and our sync-patience patch survived intact.

File	Resolution
chain_index/non_finalised_state.rs	Accepted upstream's deletion (modify/delete)
Dockerfile	Ours
README.md	Ours

The deleted module retires two [zero] patches, by deletion rather than by judgement. fae256572a existed to un-mask UpdateError::DatabaseHole so the reorg-walk error reached the operator; that variant and its "could not determine best chain" message no longer appear anywhere upstream. 1c1c3029ea's edits there were rustfmt fallout, and its behavioural half in chain_index.rs was already superseded by 41d4342ded. Nothing in the merged tree references the module.

Dockerfile is ours because upstream reinstated DL3008-style exact apt pins on the builder stage. 62c6efac5d unpinned them deliberately: Debian point releases delete superseded versions from the bookworm suite, so the pins rot and break fresh builds while layer caching hides the rot until the worst moment.

README.md is ours to keep the Shielded Labs Signal disclosure group (05aa97cc87, b2b8ca74be) over upstream's Matrix and zingodisclosure@proton.me contacts.

Our sync-patience patch is still required

41d4342ded (the synced_once startup grace over the 10-failure budget) auto-merged and is still load-bearing: upstream's loop at 0.10.0 still escalates to CriticalError after max_consecutive_failures with no startup exemption. The chain-store refactor's typed FeatureUnavailable does not cover this case. Both sync-loop budget tests pass.

Two side changes that need a look

**[zero] chore(zaino): treat zaino's own crates as first-party in the vet store.** The store was initialized with cargo vet init's defaults, marking every workspace crate audit-as-crates-io = true. That is wrong for a fork, and it failed the gate here on five first-party crates whose only change was a version number. Set false, matching the zebra policy MAINTENANCE.md already documents. Also drops policy entries for zaino-testutilsandzingo_test_vectors(removed from the graph) and exemptsserde_arrays0.2.0 atsafe-to-run, a dev-only dependency of zaino-chain-store-zainodb`. This is a trust decision, hence its own commit.

**skill(update-subtree): test zaino with nextest.** The skill ran cargo test --workspace, which fails ~49 chain_indextests on"a global default trace dispatcher has already been set". Their helper does try_init().unwrap(), which can only succeed once per process; upstream CI uses cargo nextest(process per test) and never sees it. The same tree is 758/758 green under nextest. This is a harness artifact, not a regression, and the note in the skill says so, so a future run does not patch vendored code to "fix" it. Two stale rows corrected in the same commit: orchard trackedfeat/ironwood(merged intomain`, shipped as 0.15.x) and zcashd is retired from the watch.

Testing

• cargo nextest run --workspace --no-default-features: 758 passed, 0 failed, 3 skipped.
• cargo vet --locked: green (134 fully audited, 4 partially audited, 478 exempted).
• cargo check --workspace --all-targets: clean.

Note

This branch and #78 both add an ## Unreleased CHANGELOG section, so whichever merges second will conflict there trivially.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings affect synchronization, concurrency, migration safety, release tooling, and generated changesets.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Re-vendors Zaino to upstream 0.10.0, adopting the chain-store refactor and removing legacy zcashd support.

Changes:

• Adds chain-store and chain-head architecture while preserving Zero-specific synchronization behavior.
• Updates release, sandbox, CI, vet-policy, Docker, and documentation tooling.
• Validation reports 758 passing nextest tests, clean cargo vet, and successful workspace checks.

Final findings remain unresolved:

• [critical, 1 vote] Chain-head advancement can publish an incomplete snapshot when an intermediate block is missing.
• [critical, 1 vote] Concurrent build_to calls can bypass the single-flight check.
• [critical, 1 vote] Routed writes can overlap full-mode migration after acquiring a backend.
• [critical, 1 vote] Same-epoch mempool thaw can omit Added events.
• [moderate, 1 vote] Relman bump and changelog paths are not resolved from the repository root.
• [moderate, 1 vote] Changeset discovery ignores the restored consumed ledger.
• [moderate, 1 vote] Sandbox ruleset updates do not send the complete ruleset representation.
• [moderate, 1 vote] Both sandbox-cycle changeset-generation paths accept unescaped TOML descriptions.
• [nit, 3 votes] Validator-height documentation contains a malformed link.

File summaries

File	Review
zaino/zainod-heights-from-validator-spec.md	Reviewed — nit noted
zaino/tools/workbench/src/bin/get-zebra-git-ref.rs	Reviewed
zaino/tools/workbench/src/bin/check-published-versions.rs	Reviewed
zaino/tools/workbench/src/bin/check-code-duplication.rs	Reviewed
zaino/tools/test-runner/Cargo.toml	Reviewed
zaino/tools/test-runner/Cargo.lock	Reviewed
zaino/tools/scripts/sandbox-common.sh	Reviewed — moderate finding
zaino/tools/scripts/init-podman-volumes.sh	Reviewed
zaino/tools/scripts/helpers.sh	Reviewed
zaino/tools/scripts/get-ci-image-tag.sh	Reviewed
zaino/tools/scripts/functions.sh	Reviewed
zaino/tools/scripts/container-test-save-failures.sh	Reviewed
zaino/tools/scripts/container-test-retry-failures.sh	Reviewed
zaino/tools/scripts/container-nextest-workspace.sh	Reviewed
zaino/tools/scripts/check-matching-zebras.sh	Reviewed
zaino/tools/relman/README.md	Reviewed
zaino/tools/relman/crates/domain/src/services/about.rs	Reviewed
zaino/tools/relman/crates/domain/src/services.rs	Reviewed
zaino/tools/relman/crates/domain/src/lib.rs	Reviewed
zaino/tools/relman/crates/domain/Cargo.toml	Reviewed
zaino/tools/relman/crates/core/src/types/target.rs	Reviewed
zaino/tools/relman/crates/core/src/types/tag_plan.rs	Reviewed
zaino/tools/relman/crates/core/src/types/release_options.rs	Reviewed
zaino/tools/relman/crates/core/src/types/about.rs	Reviewed
zaino/tools/relman/crates/core/src/types.rs	Reviewed
zaino/tools/relman/crates/core/src/ports.rs	Reviewed
zaino/tools/relman/crates/core/src/mocks/workspace.rs	Reviewed
zaino/tools/relman/crates/core/src/mocks/vcs.rs	Reviewed
zaino/tools/relman/crates/core/src/mocks/uid_source.rs	Reviewed
zaino/tools/relman/crates/core/src/mocks/slug_source.rs	Reviewed
zaino/tools/relman/crates/core/src/mocks/fixtures.rs	Reviewed
zaino/tools/relman/crates/core/src/mocks/consumed_ledger_store.rs	Reviewed
zaino/tools/relman/crates/core/src/mocks/clock.rs	Reviewed
zaino/tools/relman/crates/core/src/mocks.rs	Reviewed
zaino/tools/relman/crates/core/src/lib.rs	Reviewed
zaino/tools/relman/crates/core/Cargo.toml	Reviewed
zaino/tools/relman/crates/config/src/lib.rs	Reviewed
zaino/tools/relman/crates/config/src/error.rs	Reviewed
zaino/tools/relman/crates/config/Cargo.toml	Reviewed
zaino/tools/relman/crates/cli/src/warn.rs	Reviewed
zaino/tools/relman/crates/cli/src/lib.rs	Reviewed
zaino/tools/relman/crates/cli/src/context.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands/versions.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands/tags.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands/publish_plan.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands/changeset/rename.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands/changeset/new.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands/changeset/clear.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands/changeset/check.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands/about.rs	Reviewed
zaino/tools/relman/crates/cli/src/commands.rs	Reviewed
zaino/tools/relman/crates/cli/src/app.rs	Reviewed
zaino/tools/relman/crates/cli/Cargo.toml	Reviewed
zaino/tools/relman/crates/app/Cargo.toml	Reviewed
zaino/tools/relman/crates/adapters/src/random_uid_source.rs	Reviewed
zaino/tools/relman/crates/adapters/src/lib.rs	Reviewed
zaino/tools/relman/crates/adapters/Cargo.toml	Reviewed
zaino/supply-chain/config.toml	Reviewed
zaino/packages/zainod/src/indexer.rs	Reviewed
zaino/packages/zainod/src/config.rs	Reviewed
zaino/packages/zainod/README.md	Reviewed
zaino/packages/zainod/CHANGELOG.md	Reviewed
zaino/packages/zainod/Cargo.toml	Reviewed
zaino/packages/zaino-status/usage.md	Reviewed
zaino/packages/zaino-status/CHANGELOG.md	Reviewed
zaino/packages/zaino-status/Cargo.toml	Reviewed
zaino/packages/zaino-state/src/stream.rs	Reviewed
zaino/packages/zaino-state/src/chain_index/chain_store/driving.rs	Reviewed
zaino/packages/zaino-source/src/send_raw_transaction.rs	Reviewed
zaino/packages/zaino-source/src/get_tx_out.rs	Reviewed
zaino/packages/zaino-source/src/get_treestate.rs	Reviewed
zaino/packages/zaino-source/src/get_treestate_by_hash.rs	Reviewed
zaino/packages/zaino-source/src/get_transaction.rs	Reviewed
zaino/packages/zaino-source/src/get_subtree_roots.rs	Reviewed
zaino/packages/zaino-source/src/get_raw_mempool_transaction.rs	Reviewed
zaino/packages/zaino-source/src/get_raw_block.rs	Reviewed
zaino/packages/zaino-source/src/get_raw_block_header.rs	Reviewed
zaino/packages/zaino-source/src/get_peer_info.rs	Reviewed
zaino/packages/zaino-source/src/get_node_info.rs	Reviewed
zaino/packages/zaino-source/src/get_network_sol_ps.rs	Reviewed
zaino/packages/zaino-source/src/get_mining_info.rs	Reviewed
zaino/packages/zaino-source/src/get_mempool_txids.rs	Reviewed
zaino/packages/zaino-source/src/get_mempool_source_tip.rs	Reviewed
zaino/packages/zaino-source/src/get_mempool_metadata.rs	Reviewed
zaino/packages/zaino-source/src/get_difficulty.rs	Reviewed
zaino/packages/zaino-source/src/get_compact_block.rs	Reviewed
zaino/packages/zaino-source/src/get_commitment_tree_roots.rs	Reviewed
zaino/packages/zaino-source/src/get_chain_tips.rs	Reviewed
zaino/packages/zaino-source/src/get_chain_tip.rs	Reviewed
zaino/packages/zaino-source/src/get_blockchain_info.rs	Reviewed
zaino/packages/zaino-source/src/get_block.rs	Reviewed
zaino/packages/zaino-source/src/get_block_verbose.rs	Reviewed
zaino/packages/zaino-source/src/get_block_subsidy.rs	Reviewed
zaino/packages/zaino-source/src/get_block_header.rs	Reviewed
zaino/packages/zaino-source/src/get_block_deltas.rs	Reviewed
zaino/packages/zaino-source/src/get_block_by_hash.rs	Reviewed
zaino/packages/zaino-source/src/get_best_block_height.rs	Reviewed
zaino/packages/zaino-source/src/get_address_utxos.rs	Reviewed
zaino/packages/zaino-source/src/get_address_txids.rs	Reviewed
zaino/packages/zaino-source/src/get_address_deltas.rs	Reviewed
zaino/packages/zaino-source/src/get_address_balance.rs	Reviewed
zaino/packages/zaino-source/Cargo.toml	Reviewed
zaino/packages/zaino-source-zebra/usage.md	Reviewed
zaino/packages/zaino-source-zebra/CHANGELOG.md	Reviewed
zaino/packages/zaino-source-zebra/Cargo.toml	Reviewed
zaino/packages/zaino-source-zebra-rpc/usage.md	Reviewed
zaino/packages/zaino-source-zebra-rpc/tests/block_parity.rs	Reviewed
zaino/packages/zaino-source-zebra-rpc/src/parse.rs	Reviewed
zaino/packages/zaino-source-zebra-rpc/examples/smoke.rs	Reviewed
zaino/packages/zaino-source-zebra-rpc/examples/fetch_fixtures.rs	Reviewed
zaino/packages/zaino-source-zebra-rpc/CHANGELOG.md	Reviewed
zaino/packages/zaino-source-zebra-rpc/Cargo.toml	Reviewed
zaino/packages/zaino-source-zebra-readstate/CHANGELOG.md	Reviewed
zaino/packages/zaino-source-zebra-readstate/Cargo.toml	Reviewed
zaino/packages/zaino-source-macros/CHANGELOG.md	Reviewed
zaino/packages/zaino-source-macros/Cargo.toml	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/subtrees.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/hashes.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/chain_tips.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/blockchain_info.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/block_subsidy.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/block_header.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/block_deltas.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/address_queries.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire/address_deltas.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/jsonrpc/wire.rs	Reviewed
zaino/packages/zaino-serve/src/rpc/grpc/service.rs	Reviewed
zaino/packages/zaino-serve/CHANGELOG.md	Reviewed
zaino/packages/zaino-serve/Cargo.toml	Reviewed
zaino/packages/zaino-rpc/usage.md	Reviewed
zaino/packages/zaino-rpc/src/retry.rs	Reviewed
zaino/packages/zaino-rpc/src/error.rs	Reviewed
zaino/packages/zaino-rpc/CHANGELOG.md	Reviewed
zaino/packages/zaino-rpc/Cargo.toml	Reviewed
zaino/packages/zaino-proto/README.md	Reviewed
zaino/packages/zaino-proto/CHANGELOG.md	Reviewed
zaino/packages/zaino-proto/Cargo.toml	Reviewed
zaino/packages/zaino-primitives/src/types/shielded_pool.rs	Reviewed
zaino/packages/zaino-primitives/src/types/rpc/peer_info.rs	Reviewed
zaino/packages/zaino-primitives/src/types/rpc/mining_info.rs	Reviewed
zaino/packages/zaino-primitives/src/types/rpc/address_deltas.rs	Reviewed
zaino/packages/zaino-primitives/src/types/rpc.rs	Reviewed
zaino/packages/zaino-primitives/src/types/outpoint.rs	Reviewed
zaino/packages/zaino-primitives/src/types/mempool_info.rs	Reviewed
zaino/packages/zaino-primitives/src/types/equihash_solution.rs	Reviewed
zaino/packages/zaino-primitives/src/types/chain_state_epoch.rs	Reviewed
zaino/packages/zaino-primitives/src/types/block.rs	Reviewed
zaino/packages/zaino-primitives/src/types/address_delta.rs	Reviewed
zaino/packages/zaino-primitives/src/types.rs	Reviewed
zaino/packages/zaino-primitives/CHANGELOG.md	Reviewed
zaino/packages/zaino-primitives/Cargo.toml	Reviewed
zaino/packages/zaino-mempool/usage.md	Reviewed
zaino/packages/zaino-mempool/src/lib.rs	Reviewed
zaino/packages/zaino-mempool/src/event.rs	Reviewed
zaino/packages/zaino-mempool/src/entry.rs	Reviewed
zaino/packages/zaino-mempool/docs/mempool_lifecycle.md	Reviewed
zaino/packages/zaino-mempool/CHANGELOG.md	Reviewed
zaino/packages/zaino-mempool/Cargo.toml	Reviewed
zaino/packages/zaino-mempool-service/src/coherence/reconcile.rs	Reviewed
zaino/packages/zaino-mempool-service/src/coherence/publish.rs	Reviewed — critical finding
zaino/packages/zaino-mempool-service/src/coherence.rs	Reviewed
zaino/packages/zaino-mempool-service/CHANGELOG.md	Reviewed
zaino/packages/zaino-mempool-service/Cargo.toml	Reviewed
zaino/packages/zaino-encoding/CHANGELOG.md	Reviewed
zaino/packages/zaino-encoding/Cargo.toml	Reviewed
zaino/packages/zaino-convert-zebra/CHANGELOG.md	Reviewed
zaino/packages/zaino-convert-zebra/Cargo.toml	Reviewed
zaino/packages/zaino-consensus/src/lib.rs	Reviewed
zaino/packages/zaino-consensus/CHANGELOG.md	Reviewed
zaino/packages/zaino-consensus/Cargo.toml	Reviewed
zaino/packages/zaino-common/src/config/validator.rs	Reviewed
zaino/packages/zaino-common/src/config/storage.rs	Reviewed
zaino/packages/zaino-common/CHANGELOG.md	Reviewed
zaino/packages/zaino-common/Cargo.toml	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/primitives/block_index.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/primitives.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/helpers.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/db/transaction.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/db/shielded.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/db/primitives.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/db/commitment.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/db/address.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/db.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/types/block_context.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/tests/finalised_state/migrations.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/tests/finalised_state.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/tests.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/support.rs	Reviewed
zaino/packages/zaino-chain-store-zainodb/src/stream.rs	Reviewed
zaino/packages/zaino-chain-head/src/error.rs	Reviewed
zaino/packages/zaino-chain-head/Cargo.toml	Reviewed
zaino/packages/zaino-chain-head-service/src/metric_names.rs	Reviewed
zaino/packages/zaino-chain-head-service/src/lib.rs	Reviewed
zaino/packages/zaino-chain-head-service/Cargo.toml	Reviewed
zaino/packages/zaino-bench/Cargo.toml	Reviewed
zaino/packages/zaino-address/usage.md	Reviewed
zaino/packages/zaino-address/src/validated.rs	Reviewed
zaino/packages/zaino-address/src/lib.rs	Reviewed
zaino/packages/zaino-address/src/classify.rs	Reviewed
zaino/packages/zaino-address/CHANGELOG.md	Reviewed
zaino/packages/zaino-address/Cargo.toml	Reviewed
zaino/nix/package.nix	Reviewed
zaino/live-tests/zaino-testutils/src/validator_oracle.rs	Reviewed
zaino/live-tests/zaino-testutils/src/rpc.rs	Reviewed
zaino/live-tests/zaino-testutils/src/legacy_parser/block.rs	Reviewed
zaino/live-tests/zaino-testutils/src/legacy_parser.rs	Reviewed
zaino/live-tests/test_binaries/bins/.gitinclude	Reviewed
zaino/live-tests/clientless/tests/test_vectors.rs	Reviewed
zaino/live-tests/Cargo.toml	Reviewed
zaino/flake.nix	Reviewed
zaino/docs/use_cases.md	Reviewed
zaino/docs/updating_zebra_crates.md	Reviewed
zaino/docs/rpc_api.md	Reviewed
zaino/docs/logging.md	Reviewed
zaino/docs/internal_spec.md	Reviewed
zaino/docs/example_configs/zebrad_config_3.1.0.toml	Reviewed
zaino/docs/example_configs/zainod.toml	Reviewed
zaino/docs/example_configs/zainod-bench-mainnet-ephemeral.toml	Reviewed
zaino/docs/docker.md	Reviewed
zaino/docs/adr/README.md	Reviewed
zaino/docs/adr/0015-periodic-release-flow.md	Reviewed
zaino/docs/adr/0010-mempool-subsystem-separation.md	Reviewed
zaino/docs/adr/0008-source-ports-and-domain-primitives.md	Reviewed
zaino/docs/adr/0003-live-test-taxonomy-and-two-crate-split.md	Reviewed
zaino/CONTRIBUTING.md	Reviewed
zaino/CONTEXT.md	Reviewed
zaino/.gitignore	Reviewed
zaino/.github/workflows/publish-dry-run.yml	Reviewed
zaino/.github/workflows/final-tag-on-stable.yml	Reviewed
zaino/.github/workflows/compute-tag.yml	Reviewed
zaino/.github/workflows/auto-tag-rc.yml	Reviewed
zaino/.github/ISSUE_TEMPLATE/bug_report.yaml	Reviewed
zaino/.github/CODEOWNERS	Reviewed
zaino/.env.testing-artifacts	Reviewed
zaino/.dupes-ignore.toml	Reviewed
zaino/.dockerignore	Reviewed
SUBTREES.md	Reviewed
CHANGELOG.md	Reviewed

Review details

• Files reviewed: 87/533 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate issues remain in release automation, chain-head/store behavior, CI tooling, and documentation.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

zaino/.github/workflows/rc-gate.yml:225

• If the deployment POST fails after the RC tag was pushed, this warning lets the workflow finish without dispatching the soak. A rerun sees that tag at the same RC_SHA, sets cut=false, and skips this dispatch step, so the RC can remain permanently untested. Retry or independently reconcile the deployment for an existing RC tag instead of gating dispatch only on a newly cut tag.

• Files reviewed: 87/536 changed files
• Comments generated: 4
• Review effort level: Lite

[aphelionz]

On the Copilot review

All eight findings are in vendored upstream code, not in this PR's authored change. Checked rather than asserted: every flagged file returns zero results for git log --grep='^\[zero\]' -- <file>.

Flagged file	[zero] commits
zaino-chain-head-service/src/service.rs	0
zaino-chain-store-zainodb/src/store.rs	0
zaino-mempool-service/src/coherence/publish.rs	0
zainod-heights-from-validator-spec.md	0
.github/workflows/blessing.yml	0
tools/scripts/get-ci-image-tag.sh	0

Our actual delta in this subtree is six files: Dockerfile, .dockerignore, README.md, zaino-proto/build.rs, chain_index.rs, and the supply-chain/ store. The review read 265 commits of upstream history as authored change, which is the expected failure mode for a subtree re-vendor and not a criticism of the findings themselves.

Two of them are real, and I verified both rather than dismissing them on scope:

• u8 recursion counter (service.rs:488). Confirmed by resolving the constants: default max_retained_depth is 1011, so the guard cannot trip before the counter overflows at 255. Needs a >255-block reorg, so near-unreachable on mainnet. Detail.
• Partial advance published as success (service.rs:409). A None from block_at_height breaks the loop and returns Ok. This one sits on a path we have already been bitten by: a syncing validator advertising a tip it cannot serve is exactly what 41d4342ded exists to survive. Detail.

Both are being filed at zingolabs/zaino and will flow back on the next subtree pull. Neither is patched here: per MAINTENANCE.md a general bugfix is upstream-bound, and carrying one would add permanent divergence to a refactor we have just taken, which is the cost this whole re-vendor was meant to avoid.

The remaining six (single-flight race, watermark provenance, mempool same-epoch thaw, relman paths, sandbox ruleset, CI image tag) are also upstream and unreviewed by me in depth. The doc-link nit is in a vendored .md and is upstream's to fix.

Nothing here is a regression against our previous zaino 0.8.0 import in code we own. Validation on this branch is unchanged: 758/758 nextest, cargo vet --locked green, and the zeronym hub and shim build and pass their suites plus the real-mixnet smoke against the new zaino-proto.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in release workflows, changeset handling, runtime ordering, and sandbox cleanup.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (4)

Previously missed (1) — in code that hasn't changed since the last review.

zaino/.github/CODEOWNERS:16

• This default owner is an unresolved placeholder, so GitHub cannot request a reviewer for any path covered by *; CODEOWNER-based approval requirements can therefore never be satisfied as documented. Replace it with a real team or user before relying on this file for the release branch rules.

zaino/.github/workflows/release-pr-body.yml:32

• The manual workflow_dispatch path checks out the dispatch ref, which defaults to the repository's default branch rather than release-ready. It then derives the release body from that branch's manifests and changesets while only refreshing the ledger from stable, so a maintainer dispatching this workflow without explicitly selecting release-ready can overwrite the standing PR with a body for the wrong tree. Check out release-ready explicitly for both push and manual runs.
  zaino/docs/release/pipeline.md:231
• The release-gate documentation still claims that zcashd_support, clientless::json_server, and e2e::devtool_zcashd exist, but the re-vendored live-test workspace has no such feature or binaries. This makes the documented suite membership impossible to reproduce; remove this feature-axis paragraph and the corresponding table rows.
  zaino/docs/updating_zebra_crates.md:40
• The changed guidance says the root Zebra pin reaches every workspace member, but live-tests/ is a separate workspace with its own manifests and lockfile. Following this section can update only the production workspace and leave the live-test validator dependency on a different version; describe the two pin sets separately.

• Files reviewed: 87/536 changed files
• Comments generated: 6
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved review findings remain in release automation, relman tooling, sandbox scripts, and documentation.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

zaino/.github/workflows/blessing.yml:245

• Pushing the release commit before the tag, GitHub Release, and crate-publish steps makes any later failure unrecoverable: stable now contains consumed changesets and bumped versions, so a rerun computes the next cycle and exits at the empty publish plan, while a partial upload cannot resume from plan.txt because it was only in RUNNER_TEMP. A transient tag/release/crates.io failure therefore strands the release; publish the plan before this push, or persist and explicitly resume the in-flight cycle from the release commit/tag.
  zaino/.github/workflows/rc-gate.yml:226
• A deployment-creation failure is swallowed after the RC tag has already been pushed. Because the next run sees that tag at the same rc SHA, need.cut becomes false and this deployment is never retried, leaving the release permanently stuck without a soak. Make deployment dispatch retryable for an existing tag (and fail the job on an unhandled API error), or create the deployment before making the tag the idempotency marker.
  zaino/.github/workflows/release-pr-body.yml:110
• Every RC is written as deployment = "pending", and neither deployment-advance.yml nor this workflow reads the GitHub Deployment status afterward. Consequently the release PR continues to report pending even after a successful or failed deployment, so its deployment dashboard is permanently stale. Populate this field from the Deployment status for each RC (or update the status snapshot when deployment_status arrives).

• Files reviewed: 87/536 changed files
• Comments generated: 4
• Review effort level: Lite

[aphelionz]

Second and third Copilot batches: same scope point, plus these are inert here

Ten further findings since the summary above, bringing the total to eighteen. Same check as before, same result: zero [zero] commits on every flagged file.

Flagged file	[zero] commits
.github/workflows/release.yaml	0
.github/workflows/blessing.yml	0
tools/relman/crates/core/src/types/slug.rs	0
tools/relman/crates/cli/src/commands/changeset.rs	0
tools/relman/crates/domain/src/services/release_artifacts.rs	0
tools/scripts/sandbox-common.sh	0
tools/scripts/sandbox-cycle.sh	0
tools/scripts/sandbox-bless-ledger-check.sh	0
tools/scripts/sandbox-sentinel-check.sh	0
.release/gate-suites.toml	0

This batch is narrower than the first, though. All ten are zaino's own release-engineering machinery: relman, the sandbox blessing cycle, their tag/publish workflows and gate manifest. That matches what the 0.10.0 window actually contained, which the upstream watch digested as release engineering almost entirely.

None of it executes in this repository, and that is checkable rather than assumed:

• GitHub Actions only reads workflows from the repository root .github/workflows/. Vendored zaino/.github/workflows/* is inert. Confirmed against the run history: the only workflows that have ever run here are our own ten (cargo-vet, images, release, z3-regtest, z3-smoke, zebra-bench, zeronym-guards, the two reproduce jobs, and Copilot Review). No blessing, no zaino release, no changeset-check.
• grep -rn 'relman\|sandbox-cycle\|sandbox-common\|blessing' .github/ deploy/ docker/ qa/ returns nothing. We do not invoke any of it.

So the failure modes described (a sandbox left with branch protection disabled, a changeset check evaded by a nested path, publish = false ignored in a publish plan, glob-versus-regex tag filters skipping a release) are real concerns for zingolabs' release process, and cannot fire in Zero's.

Not filing these upstream either, deliberately. The two I did file, zingolabs/zaino#1551 and zingolabs/zaino#1552, are in the node's service code: they can affect a running node, they are on a path we have been bitten by, and I verified both against the source. This batch is in-flight tooling its owners are actively iterating on right now; ten drive-by issues on someone's release pipeline is noise, not contribution. If any of it later starts gating something we depend on, it changes category and we revisit.

No code change here. Validation unchanged: 758/758 nextest, cargo vet --locked green, reproduce jobs green after the re-baseline, CHANGELOG conflict with #78 resolved keeping both sides.