JoinMarket-NG 0.35.0

Automatic histroy reconstruction on import, network fee estimation for neutrino, UTXO selector with all mixdepths, CLI alphabetic sorting of subcommands and options, security hardening, neutrino taker flow improvements, and bug fixes.

Added

• Reconstruct and persist on-chain wallet history after seed import (0fc884eb)
• Estimate neutrino fees over Tor with safe provider fallbacks (08b9dd07)
• Subcommands and options are now listed alphabetically in all CLI --help outputs (a13c8d33)
• The orderbook watcher CLI is now jm-orderbook-watcher; the old orderbook-watcher name still works but is deprecated (2905fd71)
• Add notifications.verify_tls option for self-signed/private-CA notification servers and log the underlying error when a notification fails (f1a82812)
• The interactive UTXO selector (--select-utxos) now shows the whole wallet grouped by mixdepth; the source mixdepth is derived from the selection unless pinned with --mixdepth (cc658466)
• jm-taker coinjoin --select-utxos shows the whole wallet and derives the source mixdepth (and INTERNAL destination) from the selected UTXOs unless --mixdepth is set (8ebdbe9e)
• The shell TUI send flow can open the full-wallet UTXO selector instead of asking for a mixdepth (03070865)

Fixed

• Fix a server error after deleting a tumbler plan via the API (96626c81)
• Stop log flooding and CPU spin when directory connections drop mid-round (32bc16d9)
• Failed CoinJoin rounds no longer leave UTXOs locked until the lock TTL expires (12e4e4c6)
• Tumbler plans now fully empty the wallet to the destinations instead of leaving part of the last mixdepth behind (5e634932)
• Tumbler phase retries no longer get blocked by input locks left over from a failed attempt (5d1c4a77)
• A crashed maker session phase no longer aborts the whole tumble (e93e1946)
• Fee settings saved in JAM (sat/vB rate, fee limits) are now applied to direct sends, coinjoins, and tumbles instead of being silently ignored, fixing coinjoins on the neutrino backend (44a7a076)
• Fee estimation now falls back to the next source when an onion fee endpoint is unreachable instead of failing the transaction (389ca312)
• Fix reconstructed history showing amount 0 for internal transfers and over-counting taker peers by one (c20488c7)
• Fix sweep CoinJoins occasionally aborting with a negative residual of 1 sat when multiple makers charge relative fees (fb7b0f11)
• Fix maker/taker/orderbook-watcher processes hanging after shutdown instead of exiting (bfd0ee46)
• Bound maker-controlled CoinJoin input counts to prevent mining-fee inflation and reject invalid maker input sets before they can abort a round (dd67f8ee)
• Prevent maker rounds from failing when input selection would leave sub-dust change (2a6d8d63)
• Fix makers on light-client backends (Neutrino) failing to create fidelity bond proofs with 'Bond missing pubkey' (bbd71bae)
• Make maker bond discovery robust when the bond address is missing from the wallet's address cache (101d96a3)
• Neutrino takers now replace makers that turn out not to support neutrino_compat instead of aborting the CoinJoin (e6d3cf01)
• Neutrino takers now prefer makers with confirmed neutrino_compat support during selection, falling back to unknown-status makers only when needed (3f0e6509)
• Neutrino takers now detect incompatible makers right after the fill phase and replace them before sending PoDLE revelations (ddbd42d8)
• The taker now retries with other makers when a replacement candidate does not respond, instead of failing the CoinJoin (bae5e265)

Configuration Changes

Existing config.toml files are not updated automatically. Review the bundled template changes below and apply the relevant options manually.

--- config.toml.template (0.34.2)
+++ config.toml.template (0.35.0)
@@ -128,6 +128,22 @@
 # effect against older neutrino-api builds without the tracker. Set to false
 # for chain-only behaviour.
 # neutrino_include_mempool = true
+
+# External HTTP fee estimate source, used when the backend cannot estimate
+# fees itself (neutrino; the descriptor_wallet backend always uses Bitcoin
+# Core's estimatesmartfee). Fetched over the Tor SOCKS proxy configured in
+# [tor]. Accepted response formats: mempool.space recommended fees
+# (/api/v1/fees/recommended), Esplora /fee-estimates, and LND fee.url JSON.
+# Unset (default): over Tor, try the mempool.space onion service first, then
+# Blockstream's Esplora onion, then both providers' clearnet endpoints through
+# Tor. Failed sources are deprioritized for 10 minutes before being retried.
+# This is disabled on regtest or when no Tor proxy is available. Set to "off"
+# to disable external estimation (a manual fee rate
+# is then required with neutrino). A comma-separated list supplies a custom
+# fallback order. Self-hosting a mempool/Esplora instance is the most private
+# option. Every resolved estimate is still subject to the hard
+# wallet.max_fee_rate_sat_vb safety cap above (default 1000 sat/vB).
+# fee_estimate_url = "http://your-esplora.onion/api/fee-estimates,https://backup.example/fee-estimates"

 # ============================================================================
 # Network Settings
@@ -181,6 +197,14 @@
 #    0  disable auto-freezing
 # Release a frozen UTXO with `jm-wallet unfreeze`.
 # max_sats_freeze_reuse = -1
+
+# Automatically reconstruct CoinJoin/send/deposit history from on-chain data
+# for wallets imported from seed (wallets with no recorded history). Uses the
+# same equal-output CoinJoin heuristic as the legacy client to guess each
+# transaction's role (maker/taker/send/deposit) and fees. Reconstructed rows
+# are tagged as on-chain guesses and never override protocol-recorded history.
+# Manual control: `jm-wallet reconstruct-history`.
+# reconstruct_history = true

 # Smart wallet scanning optimizations
 # When importing an existing wallet, initial sync scans recent blocks for fast startup.
@@ -261,6 +285,13 @@
 # mempool_url = ""
 # include_nick = true
 # use_tor = true
+
+# Verify TLS certificates of notification servers. Set to false when your
+# notification server (e.g. Gotify) uses a self-signed certificate or a
+# private CA that Python's bundled certifi store does not trust. To keep
+# verification enabled instead, point the REQUESTS_CA_BUNDLE environment
+# variable at your CA bundle (e.g. /etc/ssl/certs/ca-certificates.crt).
+# verify_tls = true

 # Event notifications
 # notify_fill = true
@@ -437,6 +468,15 @@
 # max_cj_fee_abs = 500        # Absolute fee in satoshis per maker
 # max_cj_fee_rel = "0.001"    # Relative fee (0.001 = 0.1%)

+# Maximum inputs a single maker may contribute to the CoinJoin.
+# The taker pays the mining fee for EVERY input, so a maker with many inputs
+# consolidates its UTXOs at your expense: each extra input costs you about
+# 68 vbytes times the fee rate. Makers above the cap are dropped and replaced.
+# Worst-case mining fee added by counterparties is roughly
+# counterparty_count * max_maker_utxos * 68 * fee_rate satoshis.
+# Set to 0 to disable the cap (not recommended).
+# max_maker_utxos = 15
+
 # PoDLE commitment requirements (control which UTXOs can be used as PoDLE inputs).
 # These match the reference JoinMarket defaults; loosening them weakens the
 # anti-DoS commitment scheme.