[sebastianst]

Stacked on #22946, which pins deposit-gas parity before this dependency update.

Updates OP's execution client without accepting the Engine API stall in an unpatched release. Once disk persistence completes while a payload worker still holds an overlay lease, the release-only pin can stop serving forkchoice and new-payload requests until that worker finishes.

The pin now uses ethereum-optimism/reth:optimism at 0fbe428: the selected release, upstream #26708, and one squashed CI maintenance commit. The old op-rs state-root-receiver patch is already upstream; the new handoff backport is not in the selected release. An upstream main-branch merge is not sufficient evidence to drop it.

Behavior and operator impact

The bump corrects finalize-on-error journal cleanup and destroyed-account storage-wipe handling while preserving deposit gas-cap exemptions and pre-Regolith refund semantics. debug_executePayload additionally returns ancestor headers. The SP1 guest retains accelerated SHA-256 coverage for both dependency lines.

BREAKING CHANGE: operators using --engine.sparse-trie-max-hot-slots, its --engine.sparse-trie-max-storage-tries alias, or --engine.sparse-trie-max-hot-accounts must remove those flags from launch configuration. The persistence threshold default rises from 2 to 7. --engine.memory-block-buffer-target no longer shows a CLI default: its effective value is min(persistence threshold, 5), so with the new default threshold it changes from 0 to 5 blocks kept in memory; pass --engine.memory-block-buffer-target 0 to keep the old behaviour. testing_buildBlockV1 no longer skips invalid transactions by default. To retain prior configurable defaults, set persistence/buffer options explicitly and pass --testing.skip-invalid-transactions.

The published CLI reference deliberately stays at its finalized manifest release, per the generator contract; it must not be regenerated from this unreleased branch. The checked-in CLI surface snapshot covers this branch's interface.

The fork and OP lockfiles also take the approved TLS security fixes rather than advisory exceptions. The fork's compact compatibility check uses the selected release commit (upstream tags are not mirrored), while PR and merge-queue comparisons retain their actual base. CI support remains one replayable commit.

Deliberate limitation

This is a temporary responsiveness fix, not a persistence-fairness or bounded-memory guarantee. Upstream #26710 still applies: endless overlapping builds or a hung worker can prevent the active-build tracker from draining, stopping persistence and allowing memory to grow. The regression exercises finite overlapping OP builds, cancellation and post-drain catch-up; it does not cover perpetual overlap, deadline expiry, reorg/backfill or crash/restart durability. Backfill actions that arrive while a payload job, persistence run or handoff is active are dropped until the next sync trigger, as in upstream v2.5.2 (reth#26559); reth#26911 replaces that with pending revalidation and arrives with the v2.6.0 bump that follows this PR.

Batched validator forwarding, SystemCallCommitEvm, and sender-recovery-cache integration remain outside this change.

Review fixes from the change-driven bump review

Five reviewers went over every reth, revm, alloy and alloy-evm change this bump pulls in (not just the tagged mirrors). Fixed here:

• debug_executionWitness in the historical-proofs override now takes BlockId like upstream, so installing the ExEx no longer narrows the method to a number or tag. The proofs state factory rejects a hash that names a non-canonical block (the proofs storage is canonical-only and overlaid by number), and the witness selects its parent state by parent hash like upstream.
• eth_getMultiProof (new upstream method, installed by default on the core and auth EthApi) is removed from every OP node's served surface rather than maintained in the historical proofs override: no OP user has asked for it, and a proofs-history node cannot answer it consistently from live state. It comes back when there is a user (op-reth: eth_getMultiProof is deliberately not served #22990). The override trait is tagged as a mirror of EthApi's proof methods.
• OpReceiptEnvelope and OpReceipt deliberately do not adopt alloy 2.4's missing-type legacy fallback (fix(consensus): default missing receipt type to legacy alloy-rs/alloy#4107, for Geth-derived chains that omit the field; no OP client does): the derives stay, a receipt without type is rejected, and the mirror tags record the divergence.
• UPSTREAM-MIRROR tags for the alloy-family copies (OpReceiptEnvelope, OpReceipt, OpExecutionPayload); the checker now narrows a crate resolved at several incompatible versions to the range rust/Cargo.toml asks for before reporting ambiguous-version.
• Operator-fee refund uses saturating_sub for gas used, since revm 42 can credit remaining from the reservoir after the fact.
• Destroyed-account storage zeroing in the proofs provider and the buffered overlay is pinned by focused tests on both stores (untouched persisted slot, buffer-only slot, destroy-and-recreate, create-and-destroy, cursor error propagation); the provider test module now also runs under --all-features.

Follow-ups filed instead of widening this PR: #22969 (eth_simulateV1 ignores the EIP-7825 cap on OP chains), #22970 (seal the in-flight payload on getPayload), #22971 (deposit gas-cap exemption in OpHandler::tx_gas), #22972 (OP engine defaults, deployment flag audit, sender-recovery cache), #22973 (evidence gaps: arkworks 0.6 vectors, c-kzg transmute, hasher ordering, kona V2 payload test, receipt-strictness tests, trace-by-index, witness rollout ordering).

Verification

Check	Result
Workspace type-check (--workspace --tests --locked) and op-reth binary build	Pass
Workspace Clippy (--all-features --all-targets, warnings denied)	Pass
Workspace runtime tests, excluding proposer and online-filtered tests	2,909 passed; 11 skipped
Proposer runtime tests, all features, serial execution	232 passed
Real OP deferred-handoff regression	Unpatched release fails with the expected FCU stall; final patched node passes, including finite overlap/cancellation and persistence catch-up
Production-profile bounded-stack beacon blob parser	Pass
Doctests, strict rustdoc, no_std, formatting and mirror checks	Pass
SP1 guest precompile-patch, lock, lint-configuration and formatting checks	Pass
Complete all-features cargo-deny checks	Pass in both the fork and OP workspaces

The local all-features runtime tests use the author-approved TRACY_NO_INVARIANT_CHECK=1 workaround because this VM does not advertise invariant TSC support. No repository or production default changes; these runs are not profiling evidence. Actual CLI smoke checks confirm removed flags are rejected and supported explicit persistence/buffer/testing options still parse.

Not run locally: Go acceptance/devnet suites or SP1 guest ELF build/execution/lint. The guest checks above cover metadata and formatting, not guest execution.

Accepted inherited CI failure: the fork's ef-tests::valid_blocks exceeds its unchanged 60-second timeout on all three attempts. Current job 993 matches pre-reset job 770 at the original fork tip. The EF/execution/storage code is unchanged by this backport. The author approved documenting this separately rather than skipping cases or increasing the test budget: 28 fork checks pass, one times out, and the aggregate reth-act check remains failed.

Closes #22890

🤖 Co-created with Claude Opus 5 and Claude Fable 5.1

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ss5Vsih1Jhvd4eWB9UJoi8

[opgitgovernance]

This pr has been automatically marked as stale and will be closed in 5 days if no updates

[wiz-0f98cca50a]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	-

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.