JoinMarket-NG 0.37.0

Big performance improvements for wallet commands, direct-send and taker CJ coin control, PSBT signing, fidelity bond status tracking, better md0 protections to not harm makers' liquidity, plus a few bug fixes.

Added

• Allow direct-send to spend an explicit list of input UTXOs instead of auto-selecting (f3e1b65a)
• Add a repeatable --input-utxo flag to jm-wallet send for explicit coin control (924c4332)
• Allow makers to merge proven CoinJoin-only rotation funds in mixdepth zero (bb6321a2)
• Add secure offline PSBT signing for regular and fidelity bond UTXOs (f1d85b52)
• Speed up repeated wallet syncs while preserving complete Core and Neutrino history discovery (eadc135e)
• Reduce first-run and repeated Neutrino wallet sync times (06573fef)
• Add exact UTXO coin control to jm-taker CoinJoins and jmwalletd (09333af5)
• Add bond-weighted offer pick estimates and a responsive orderbook watcher UI (86401aee)

Fixed

• Map max_sweep_fee_change policy setting and enforce relative sweep fee tolerance (d5b7aab7)
• Enforce max_sweep_fee_change against actual sweep transaction size (45e98903)
• Abort release installs when commit resolution prevents signature verification (0ed769bc)
• UTXO-Selector now correctly displays cj-out, cj-change, (3bd2b7ac)
• Cancelling a send transaction now returns exit code 1 (0dfec038)
• Preserve user labels and local CoinJoin classifications in interactive UTXO selection (6625cafd)
• Return a clean non-zero status when an interactive send is cancelled (5a11a204)
• Preserve existing Tor settings during installation and prevent duplicate listeners (10558415)
• Show redeemed fidelity bonds as unfunded after sync-bonds refreshes the registry (eabc3ba4)
• Require public directory Compose deployments to configure their nick authentication identity (dc65019c)
• Show copy-ready UTXO outpoints in jm-wallet info --extended (b18d6411)
• Reject nonzero-fee relative offers of bondless makers when the zero-fee policy is enabled. (ddffc72c)
• Show the committed sweep mining fee budget during initial confirmation. (68f38992)
• Allow unclaimed sweep maker fees to increase the miner fee without aborting. (68f38992)
• Show CoinJoin maker and miner fees as percentages during confirmation. (589a5c2d)
• Try to restore the requested maker count before accepting a reduced CoinJoin. (8af8b748)
• Recover registered fidelity bonds when protocol and Bitcoin networks differ. (400ab222)
• Restore ping and nick authentication badges during direct maker feature discovery (40c6293c)
• Deduplicate shared fidelity bonds in watcher pick estimates (ed0b4a73)
• Explain why watcher offers have zero estimated pick chance (c1d1a828)

Configuration Changes

Existing config.toml files are not updated automatically. Review the bundled template changes below and apply the relevant options manually.

--- config.toml.template (0.36.0)
+++ config.toml.template (0.37.0)
@@ -412,11 +412,12 @@
 # merge_algorithm = "default"

 # Mixdepth 0 privacy restriction.
-# By default, UTXOs in mixdepth 0 are restricted to a single UTXO per CoinJoin
-# to prevent linking deposits and fidelity bonds. Outputs with exact protocol
-# CoinJoin provenance are always exempt because they already have CoinJoin
-# privacy. Set to true to disable the restriction entirely and allow merging
-# all md0 UTXOs (experienced makers only, reduces privacy).
+# By default, deposits and other unproven md0 UTXOs are restricted to one input
+# per CoinJoin. Exact protocol CoinJoin outputs and CoinJoin change recursively
+# proven to descend only from maker-rotation funds may be merged. Plain-send
+# change, deposit ancestry, reconstructed history, and incomplete history remain
+# restricted. Set to true to allow all md0 merges (usually unnecessary and
+# reduces privacy).
 # allow_mixdepth_zero_merge = false

 # Timeouts and intervals
@@ -477,6 +478,7 @@
 # Maximum acceptable coinjoin fees (paid to makers, not network/miner fees)
 # max_cj_fee_abs = 500        # Absolute fee in satoshis per maker
 # max_cj_fee_rel = "0.001"    # Relative fee (0.001 = 0.1%)
+# max_sweep_fee_change = 0.8  # Relative fee tolerance for sweep transactions

 # Maximum inputs a single maker may contribute to the CoinJoin.
 # The taker pays the mining fee for EVERY input, so a maker with many inputs
@@ -503,7 +505,7 @@
 # Fidelity bond settings
 # bondless_makers_allowance = 0.2  # 0.0-1.0: per-slot probability of picking a bondless maker
 # bond_value_exponent = 1.3
-# bondless_require_zero_fee = true
+# bondless_require_zero_fee = true  # Bondless makers must advertise a zero CoinJoin fee

 # Timeouts and intervals
 # maker_timeout_sec = 60         # Range: 10-3600 seconds
@@ -518,10 +520,14 @@
 # tx_broadcast = "random-peer"
 # broadcast_peer_count = 3

-# Minimum number of makers required for a CoinJoin to proceed.
-# Default: 4 (matches the upstream JoinMarket reference POLICY default; using
-# minimum_makers=1 is fingerprintable and degrades the privacy of the join).
+# The taker first tries to keep counterparty_count makers through fill and auth.
+# minimum_makers is only the final floor when replacements are exhausted or no
+# candidates remain. Default: 4 (matches the upstream JoinMarket reference
+# POLICY default; using minimum_makers=1 is fingerprintable and degrades privacy).
 # minimum_makers = 4
+# Maximum attempts to replace failed makers and restore counterparty_count.
+# Set to 0 to disable replacement. Default: 3 (range: 0-10).
+# max_maker_replacement_attempts = 3

 # ============================================================================
 # Tumbler Settings
@@ -554,13 +560,15 @@
 # host = "127.0.0.1"
 # port = 5222

-# Directory nick authentication (JMP-0005). "prefer_verified" negotiates the
-# extension while accepting legacy clients, "require_verified" rejects clients
-# without it, and "disabled" keeps the legacy handshake only.
+# Directory nick authentication (JMP-0005). Public directory nodes must set
+# nick_auth_directory_id to their canonical lowercase Tor v3 endpoint, including
+# the port. Without it, nick ownership authentication is not advertised or
+# performed. Never use a test ID for a public directory.
+# nick_auth_directory_id = "your56characterhostname.onion:5222"
+# "prefer_verified" authenticates capable clients while accepting legacy
+# clients, "require_verified" rejects clients without support, and "disabled"
+# intentionally turns off nick ownership authentication.
 # nick_auth_mode = "prefer_verified"
-# Stable identifier for this directory endpoint. Production onion directories
-# use their canonical "host.onion:port" endpoint; local tests may use a test ID.
-# nick_auth_directory_id = "test:jm-directory-5222"  # Local/test example only
 # nick_auth_timeout = 30.0

 # Limits