Set share_allow_version_mask_mismatch default to false

Author: Distortions81

README.md

@@ -47,7 +47,7 @@ Counts above were collected on March 1, 2026.
   - `data/config/services.toml` for service/integration settings (`auth`, `backblaze_backup`, `discord`, `status` links).
   - `data/config/policy.toml` for submit-policy/version/bans/timeouts.
   - `data/config/tuning.toml` for rate limits, vardiff, EMA tuning, and peer-cleaning controls.
-  - `data/config/version_bits.toml` for explicit per-bit block-version overrides (read-only; never rewritten by goPool). `data/config/policy.toml` `[version].bip110_enabled` toggles BIP-110 signaling (bit 4), `[version].share_allow_version_mask_mismatch` allows out-of-mask miner submit versions for compatibility (default `true`), and `version_bits.toml` can still force bit-level overrides afterward. BIP-110 reference: https://github.com/bitcoin/bips/blob/master/bip-0110.mediawiki
+  - `data/config/version_bits.toml` for explicit per-bit block-version overrides (read-only; never rewritten by goPool). `data/config/policy.toml` `[version].bip110_enabled` toggles BIP-110 signaling (bit 4), `[version].share_allow_version_mask_mismatch` allows out-of-mask miner submit versions for compatibility (default `false`), and `version_bits.toml` can still force bit-level overrides afterward. BIP-110 reference: https://github.com/bitcoin/bips/blob/master/bip-0110.mediawiki
   - `data/config/secrets.toml` for sensitive credentials (RPC user/pass, Discord/Clerk secrets, Backblaze keys).
 - `data/config/admin.toml` controls the optional admin UI at `/admin`. The file is auto-generated on first run with `enabled = false` and a random password (read the file to see the generated secret). Update it to enable the panel, pick fresh credentials, and keep the file private. goPool writes `password_sha256` on startup and clears the plaintext password after the first successful login; subsequent logins use the hash. The admin UI provides a field-based editor for the in-memory config, can force-write `config.toml` + split override files, and includes a reboot control; reboot requests require typing `REBOOT` and resubmitting the admin password.
 - `[logging]` uses boolean toggles: `debug` enables verbose runtime logs, and `net_debug` enables raw network tracing (`net-debug.log`). You can also force these at startup with `-debug` and `-net-debug`.

data/config/examples/policy.toml.example

@@ -66,4 +66,4 @@
   bip110_enabled = false
   min_version_bits = 1
   share_allow_degraded_version_bits = true
-  share_allow_version_mask_mismatch = true
+  share_allow_version_mask_mismatch = false

defaults.go

@@ -64,7 +64,7 @@ func defaultConfig() Config {
 		ConnectionTimeout:                   defaultConnectionTimeout,
 		VersionMask:                         defaultVersionMask,
 		MinVersionBits:                      defaultMinVersionBits,
-		ShareAllowVersionMaskMismatch:       true,
+		ShareAllowVersionMaskMismatch:       false,
 		ShareAllowDegradedVersionBits:       true,
 		BIP110Enabled:                       false,
 		VersionBitOverrides:                 nil,

documentation/stratum-v1.md

@@ -26,7 +26,7 @@ Code pointers:
   - Alias for `mining.authorize` (CKPool compatibility).
 - `mining.submit`
   - Standard 5 params plus an optional 6th `version` field (used for version-rolling support).
-  - Version policy can be relaxed with `policy.toml [version].share_allow_version_mask_mismatch = true` (default), which allows out-of-mask version bits for compatibility (for example BIP-110 bit 4 signaling).
+  - Version policy can be relaxed with `policy.toml [version].share_allow_version_mask_mismatch = true`, which allows out-of-mask version bits for compatibility (for example BIP-110 bit 4 signaling). Default is `false`.
 - `mining.ping` (and `client.ping`)
   - Replies with `"pong"`.
 - `client.get_version`

documentation/version-bits.md

@@ -61,9 +61,9 @@ goPool applies version changes in this order:
 goPool rejects miner-submitted version changes outside the negotiated
 version-rolling mask:
 
-- `true` (default): allow out-of-mask submits for compatibility (for example
+- `true`: allow out-of-mask submits for compatibility (for example
   miners signaling BIP-110 bit 4).
-- `false`: strict mask enforcement (`invalid version mask` policy reject on
+- `false` (default): strict mask enforcement (`invalid version mask` policy reject on
   non-block shares).
 
 ## Bitcoin version bits reference

miner_submit_modes_test.go

@@ -581,7 +581,7 @@ func TestPrepareSubmissionTask_VersionRollingPolicyBoundaries(t *testing.T) {
 		}
 	})
 
-	t.Run("version outside mask allowed by default compatibility mode", func(t *testing.T) {
+	t.Run("version outside mask allowed when compatibility mode enabled", func(t *testing.T) {
 		mc, req := newVersionReq("00000010")
 		mc.minVerBits = 0
 		mc.cfg.ShareAllowVersionMaskMismatch = true