zaino: re-vendor to upstream 0.10.0 (chain-store refactor)

.claude/skills/update-subtree/SKILL.md

@@ -12,11 +12,10 @@ Never run on `main`; never auto-merge a dirty result.
 
 | Component | Prefix    | Remote      | Branch   | Test command |
 |-----------|-----------|-------------|----------|--------------|
-| zcashd    | `zcashd/` | `up-zcashd` | `master` | `cd zcashd && ./zcutil/build.sh -j$(nproc)` (build-only smoke) |
 | zebra     | `zebra/`  | `up-zebra`  | `main`   | `cd zebra && cargo test --workspace` |
-| zaino     | `zaino/`  | `up-zaino`  | `dev`    | `cd zaino && cargo test --workspace` |
+| zaino     | `zaino/`  | `up-zaino`  | `dev`    | `cd zaino && cargo nextest run --workspace --no-default-features` |
 | zallet    | `zallet/` | `up-zallet` | `main`   | `cd zallet && cargo test --workspace` |
-| orchard   | `orchard/`| `up-orchard`| `feat/ironwood` | `cd orchard && cargo test` |
+| orchard   | `orchard/`| `up-orchard`| `main`   | `cd orchard && cargo test` |
 | librustzcash | `librustzcash/` | `up-librustzcash` | `main` | `cd librustzcash && cargo test --workspace` |
 | lightwalletd | `lightwalletd/` | `up-lightwalletd` | `master` | `cd lightwalletd && go test ./...` |
 
@@ -74,6 +73,15 @@ MAINTENANCE.md tag-pinning policy).
 
 ## Notes
 
+- **zaino must be tested with `cargo nextest`, not `cargo test`.** Its
+  `chain_index` tests call a `try_init().unwrap()` tracing helper, which
+  succeeds only for the first test in a process. Upstream CI uses nextest
+  (process per test) and never sees this; `cargo test --workspace` fails ~49
+  tests on the shared global dispatcher, which is a harness artifact and not a
+  regression. Do not "fix" it in vendored code.
+- **zcashd is retired from this skill** (2026-09-08): upstream `zcash/zcash` is
+  archived, there is no `up-zcashd` remote, and `zcashd/` is a Zero-only fork
+  with nothing left to pull.
 - One component per run. To update several, run repeatedly.
 - If the pull is clean and tests pass, still stop for human review before merge.
 - A carry marked `[upstream-pending #N]` whose PR has merged upstream should be

CHANGELOG.md

@@ -22,6 +22,20 @@ date) before dispatching the release.
 - lightwalletd: `google.golang.org/grpc` 1.82.1 to 1.83.1 (`1cb42c5166`), and
   the image now builds in a stage and ships on `debian:13-slim`
   (`0e398d79cf`).
+- zaino: re-vendored to upstream `0.10.0` (265 commits, `07695fac5e..f1d2befe62`).
+  Upstream split the finalised state into backend crates
+  (`zaino-chain-store`, `zaino-chain-store-zainodb`, `zaino-encoding`,
+  `zaino-primitives`, `zaino-chain-head-service`) and removed zcashd support
+  entirely. Our sync-patience patch (`41d4342ded`) survives in
+  `chain_index.rs` and is still required: upstream's loop still escalates to
+  `CriticalError` after `max_consecutive_failures` with no startup exemption.
+
+### Removed
+
+- zaino: the two `[zero]` patches on `chain_index/non_finalised_state.rs`
+  (`fae256572a`, `1c1c3029ea`), obsolete because upstream deleted the module.
+  `UpdateError::DatabaseHole` and its "could not determine best chain" message,
+  which `fae256572a` existed to un-mask, no longer appear anywhere upstream.
 
 ## v29 - 2026-09-07
 

SUBTREES.md

@@ -17,7 +17,14 @@ still pull upstream updates or split changes back out when useful.
 | `lightwalletd/` | https://github.com/zcash/lightwalletd.git | `master` | `up-lightwalletd` |
 
 Notes:
-- **zaino** tracks `dev` (its active default), not `stable`.
+- **zaino** tracks `dev` (its active default), not `stable`, but is pinned to a
+  release tag: currently **`0.10.0`** (2026-09-11). `dev` is an ancestor of each
+  tag rather than ahead of it, so the tag is strictly the better pin. As of the
+  0.10.0 re-vendor the finalised state lives in its own backend crates
+  (`zaino-chain-store`, `zaino-chain-store-zainodb`, `zaino-encoding`,
+  `zaino-primitives`, `zaino-chain-head-service`), zcashd support is gone, and
+  `chain_index/non_finalised_state.rs` no longer exists. Test with
+  `cargo nextest run`, not `cargo test`; see the `update-subtree` skill.
 - **zallet** is the `zallet` crate, which lives in the `zcash/wallet` repo.
 - **orchard** tracks `main` and is pinned to a release tag. The `feat/ironwood`
   branch it used to track was merged into `main` and shipped as the 0.15.x line,

zaino/.dockerignore

@@ -3,6 +3,15 @@ target/
 **/target/
 **/*.rs.bk
 
+# Nix build outputs (dangling store symlinks; must never enter the context)
+result
+result-*
+
+# direnv cache: filenames embed a per-eval env hash, so leaving this in the
+# context rotates the content-addressed image tag on every `direnv reload`.
+.direnv/
+.envrc
+
 # VCS / CI
 .git/
 .gitignore

zaino/.dupes-ignore.toml

@@ -0,0 +1,21 @@
+# Duplicate groups the check-code-duplication lint has been told to allow.
+#
+# An entry here is a claim that a group is irreducible, not that it is
+# unimportant. Each one names why sharing the code would make things worse, so
+# a later reader can re-litigate it rather than inherit it.
+
+[[ignore]]
+fingerprint = "a56301cbdb5a82de"
+members = [
+    "<StoreCapability as fmt::Display>::fmt",
+    "<ChainTipStatus as core::fmt::Display>::fmt",
+]
+reason = """
+Two unrelated enums whose Display impls are each a match over their own \
+variants mapping to their own strings. The shape is shared; nothing else is. \
+Factoring it would mean a generic variant-to-string helper that both enums \
+route through, which adds indirection to two eight-line functions and couples \
+a chain-store capability to an RPC chain-tip status for no reason beyond their \
+both being enums. They also live in crates that do not and should not depend \
+on each other.
+"""

zaino/.github/CODEOWNERS

@@ -0,0 +1,22 @@
+# CODEOWNERS — drives automatic review requests on pull requests.
+#
+# Listing an owner for a path makes GitHub REQUEST that owner's review when a PR
+# touches it. That is all this file does. It does NOT by itself require approval:
+# the approval COUNTS are branch-protection rules, configured separately per the
+# release ADR —
+#   * 1 CODEOWNER approval to merge into `dev`
+#   * 2 CODEOWNER approvals to merge into `stable`
+# (see docs/release/pipeline.md § "Branching and approvals").
+#
+# The team handles below are PLACEHOLDERS. Replace every `@zingolabs/PLACEHOLDER-*`
+# with a real GitHub team (or user) slug before this file is relied upon; an
+# unresolvable owner silently requests no one.
+
+# Default owner for everything in the repo.
+* @zingolabs/PLACEHOLDER-maintainers
+
+# Example per-path ownership. Uncomment and point at real teams as the review
+# structure firms up — more specific paths win over the default above.
+# /tools/relman/                    @zingolabs/PLACEHOLDER-release-tooling
+# /.github/workflows/               @zingolabs/PLACEHOLDER-ci
+# /docs/release/   @zingolabs/PLACEHOLDER-maintainers

zaino/.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -70,7 +70,7 @@ body:
       description: |
         Please include:
         - Zaino version or commit hash
-        - Backend version (zebra/zcashd)
+        - Backend version (zebra)
         - OS and platform
       placeholder: |
         Zaino: v0.x.x or commit abc123

zaino/.github/actions/cycle-ids/action.yml

@@ -0,0 +1,63 @@
+name: Cycle ids
+description: >-
+  Derive the release-cycle identity from the existing git tags: the open
+  cycle N (the one a new rc or a blessing belongs to) and the next prerelease
+  number M within it. The checkout must have fetched all tags (fetch-depth: 0).
+  Two tag shapes carry the numbers: `cycle-<N>` (final, blessed) and
+  `cycle-<N>-rc.<M>` (deployment prerelease). Date-style ids such as
+  `cycle-2026-08-15` never match and are ignored.
+
+outputs:
+  open:
+    description: "The open cycle N: 1 with no cycle tags, hi+1 when `cycle-<hi>` is final, else hi."
+    value: ${{ steps.ids.outputs.open }}
+  next_rc:
+    description: "The next prerelease number M within the open cycle (max existing + 1, or 1)."
+    value: ${{ steps.ids.outputs.next_rc }}
+  last_rc_tag:
+    description: "The highest existing `cycle-<N>-rc.<M>` tag of the open cycle, or empty."
+    value: ${{ steps.ids.outputs.last_rc_tag }}
+
+runs:
+  using: composite
+  steps:
+    - name: Derive cycle ids from tags
+      id: ids
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        # highest_cycle(): the max integer N seen across BOTH tag shapes, or
+        # empty when no cycle tags exist.
+        highest_cycle() {
+          git tag --list 'cycle-*' \
+            | sed -n 's/^cycle-\([0-9][0-9]*\)\(-rc\.[0-9][0-9]*\)\{0,1\}$/\1/p' \
+            | sort -n | tail -1
+        }
+        # open_cycle(): the cycle a NEW rc (or a blessing) belongs to.
+        open_cycle() {
+          hi="$(highest_cycle)"
+          if [ -z "$hi" ]; then
+            echo 1
+          elif git rev-parse -q --verify "refs/tags/cycle-${hi}" >/dev/null; then
+            echo $((hi + 1))
+          else
+            echo "$hi"
+          fi
+        }
+        # last_rc(N): the highest existing M of `cycle-<N>-rc.<M>`, or empty.
+        last_rc() {
+          git tag --list "cycle-${1}-rc.*" \
+            | sed -n "s/^cycle-${1}-rc\.\([0-9][0-9]*\)$/\1/p" \
+            | sort -n | tail -1
+        }
+
+        N="$(open_cycle)"
+        last="$(last_rc "$N")"
+        if [ -z "$last" ]; then M=1; last_tag=""; else M=$((last + 1)); last_tag="cycle-${N}-rc.${last}"; fi
+        echo "open cycle N=$N, next rc M=$M, last rc tag=${last_tag:-none}"
+        {
+          echo "open=$N"
+          echo "next_rc=$M"
+          echo "last_rc_tag=$last_tag"
+        } >> "$GITHUB_OUTPUT"

zaino/.github/actions/setup-relman/action.yml

@@ -0,0 +1,52 @@
+name: Set up relman
+description: >-
+  Put the `relman` release-manager CLI on PATH without assuming cargo is
+  available. Prefers an already-installed binary, then a prebuilt one under
+  tools/relman/target, and only falls back to building with cargo. This lets
+  changeset-only checks (which need no cargo) run in a minimal container while
+  real CI (which has cargo) still builds from source.
+
+runs:
+  using: composite
+  steps:
+    - name: Probe for cargo
+      id: probe
+      shell: bash
+      run: |
+        if command -v cargo >/dev/null 2>&1; then echo "has_cargo=true"; else echo "has_cargo=false"; fi >> "${GITHUB_OUTPUT}"
+
+    # Only the cargo fallback below benefits; a runner without cargo (the
+    # minimal changeset-check container) skips the cache entirely.
+    - name: Cache the relman build
+      if: steps.probe.outputs.has_cargo == 'true'
+      uses: Swatinem/rust-cache@v2
+      with:
+        workspaces: tools/relman
+
+    - name: Resolve relman onto PATH
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        # Candidate prebuilt binaries, in preference order. A static musl build
+        # is what the local integration harness stages; the plain release path
+        # is what a prior `cargo build` in this job would have produced.
+        musl="tools/relman/target/x86_64-unknown-linux-musl/release/relman"
+        release="tools/relman/target/release/relman"
+
+        if command -v relman >/dev/null 2>&1; then
+          echo "setup-relman: using relman already on PATH ($(command -v relman))"
+        elif [ -x "${musl}" ]; then
+          echo "setup-relman: using prebuilt musl binary ${musl}"
+          echo "${GITHUB_WORKSPACE}/$(dirname "${musl}")" >> "${GITHUB_PATH}"
+        elif [ -x "${release}" ]; then
+          echo "setup-relman: using prebuilt binary ${release}"
+          echo "${GITHUB_WORKSPACE}/$(dirname "${release}")" >> "${GITHUB_PATH}"
+        elif command -v cargo >/dev/null 2>&1; then
+          echo "setup-relman: no prebuilt binary; building with cargo"
+          cargo build --release --manifest-path tools/relman/Cargo.toml
+          echo "${GITHUB_WORKSPACE}/tools/relman/target/release" >> "${GITHUB_PATH}"
+        else
+          echo "::error::setup-relman: relman is not on PATH, no prebuilt binary was found at ${musl} or ${release}, and cargo is unavailable to build it." >&2
+          exit 1
+        fi

zaino/.github/workflows/auto-tag-rc.yml

@@ -1,3 +1,7 @@
+# LEGACY tag producer for the pre-cutover release protocol (rc/<version>
+# branches). It stays live until the repo variable RELMAN_PIPELINE_ACTIVE is
+# set to true, at which point the release pipeline (rc-gate / blessing) owns
+# every tag and this workflow goes dormant. Delete it after the cutover.
 name: Auto RC Tag
 
 on:
@@ -8,7 +12,7 @@ on:
 
 jobs:
   auto-tag-rc:
-    if: github.event.pull_request.merged == true
+    if: github.event.pull_request.merged == true && vars.RELMAN_PIPELINE_ACTIVE != 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write