Bring main onto the line this project actually ships

main had drifted to a history with no ancestor in common with the tree we
build and deploy. It sat at be63e83 (2026-08-09) with 28 commits; the shipped
line, deploy/soak-2026-08-21, had 383. The two shared nothing -- git
merge-base returns no result at all -- so anyone cloning this repository
landed on a default branch that was neither current nor related to the
running node.

The 28 commits on main were audited before this merge: every one is already
present in the tree by content, including the two that are hardest to see
because they were rewritten afterwards -- the payout reorg-safety work
(PayoutBlockStillOnChain, since evolved to re-check on every retry rather
than once at maturity) and the nostr relay certificate verification
(SSL_set1_host, now with a Windows root-store path). Nothing on main is lost
by this merge.

Recorded as a merge rather than a force-push: main only ever moves forward,
its old history stays reachable as the first parent, and this is revertible.
The tree is taken wholesale from the merged branch, so main's content is now
exactly what was built and tested.

What this brings onto main:

- compactblock: BIP152-style compact block relay ported from upstream 1.2.23,
  primitives and unit test only, with the RAND_bytes failure path closed and
  the reconstruction allocation bounded.
- upstream/main 17741d9: isolated testnet parameters and genesis, optional
  2 MB large pages for RandomX. Mainnet genesis verified byte-identical
  through upstream's BuildGenesisBlock() refactor.
- deploy: every image built on bookworm so binaries run on Debian 12, and the
  container build now honours the RandomX and libsecp256k1 pins it had been
  silently ignoring since before 1.2.15.

Gates at this tree: 15/15 selftests, compactblock's 17 checks, consensus
constants unchanged against e4f898c apart from the pre-existing
MAX_BLOCK_SIZE_GEN, mainnet genesis intact, money-log check ok.

1 files changed, 138 insertions, 31 deletions

diff --git a/Makefile b/Makefile
index abd75c5..342ec07 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,7 @@
 #
 #   make linux    build Bitflash-*-x86_64.AppImage
 #   make windows  build Bitflash-*-windows.zip (from MSYS2 UCRT64)
+#   make windows-tor build Bitflash-*-windows-with-tor.zip
 #   make tests    build and run standalone unit tests
 #   make checksums create SHA256SUMS for release assets
 #   make verify-release TAG=v1.2.13
@@ -10,7 +11,10 @@
 ROOT    := $(shell pwd)
 NPROC   := $(shell nproc 2>/dev/null || echo 2)
 SUDO    := $(shell [ "$$(id -u)" = "0" ] && echo "" || echo "sudo")
-VERSION := 1.2.15
+# Not "1.2.20". This tree is upstream v1.2.20 plus our own hardening commits and
+# a hand-merged payout ledger, so a binary built here must not be mistakable for
+# the upstream release of that number -- it names every release artifact.
+VERSION := 1.2.20+sec
 
 # ---- Pinned third-party sources -------------------------------------------
 #
@@ -33,10 +37,23 @@ VERSION := 1.2.15
 # resolves the object by its own hash). Bump deliberately, and rebuild and
 # resync before shipping the result.
 #
+# The check has to decide the exit status, so each recipe below joins its
+# commands with && the whole way to the closing echo. Ending that chain with a
+# `;` meant a failed `test` only skipped the build steps: the echo still ran,
+# the target still exited 0, and make announced a pinned dependency that
+# nothing had verified.
+#
 # RandomX pin is the commit this tree has been building and syncing against
-# (post-v2.0.1 master, 2026-05-24) -- chosen to change nothing today.
+# (post-v2.0.1 master, 2026-05-24) -- identical to upstream's pin.
+#
+# libsecp256k1 is pinned to upstream v1.2.18's commit rather than the one this
+# fork carried, so signature validation matches the binaries the rest of the
+# network runs. Consensus code must not differ from the network by accident.
+# There must be exactly ONE assignment of each of these variables in this file:
+# upstream defines them near the top too, and GNU Make takes the last `:=`, so
+# a second block silently decides the build.
 SECP256K1_REPO   := https://github.com/bitcoin-core/secp256k1
-SECP256K1_COMMIT := 6e2c8bc4ecdc6e71dbe7a368f360d8d453ce435d
+SECP256K1_COMMIT := 7fecac74aed8e1fd9078380d67dd04663705c989
 RANDOMX_REPO     := https://github.com/tevador/RandomX
 RANDOMX_COMMIT   := 1e9d4b2df63fa6edf46b06789486e23c0fcaa55a
 
@@ -48,6 +65,32 @@ APPIMAGETOOL_SHA256 := ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3c
 
 # ---- Linux ----------------------------------------------------------------
 
+# RandomX used to build in $(HOME)/RandomX, and deps-randomx would rm -rf that
+# path whenever the library was missing -- deleting a tree the build did not
+# create and does not own (issue #27; a hand-managed pinned checkout there is
+# what this machine's miners build against). The default is now in-tree, like
+# secp256k1-build. A host that deliberately keeps RandomX elsewhere can set
+# RANDOMX_DIR=... explicitly; the recipe below will still never delete a
+# directory that lacks the marker file this build writes after a successful
+# build. Exported so src/Makefile's own RANDOMX_DIR ?= picks the same tree.
+#
+# Every use of it below is quoted, and the recipe rejects a value that cannot
+# name exactly one directory before it reaches anything destructive. Unquoted,
+# the marker guard could be stepped around: a value holding a glob that matches
+# two directories made `[ -d $(RANDOMX_DIR) ]` a two-argument test, which dies
+# with "unexpected operator" instead of answering, so the && short-circuited,
+# the guard was skipped, and the rm -rf below ran against every match. A value
+# holding a space or a `&&` broke the outer test the same way and reported
+# "already built". Whitespace and glob characters are refused outright rather
+# than merely quoted, because src/Makefile interpolates this same value into
+# -I$(RANDOMX_DIR)/src and -L$(RANDOMX_DIR)/build unquoted, where neither can
+# survive. A relative value is refused rather than silently made absolute: it
+# would mean two different directories to this Makefile and to src/Makefile,
+# whose cwd is src/, and a command-line assignment reaches the sub-make through
+# MAKEFLAGS, where it outranks anything exported from here.
+RANDOMX_DIR ?= $(ROOT)/randomx-build
+export RANDOMX_DIR
+
 linux: deps-linux
         $(MAKE) -C src -f Makefile -j$(NPROC)
         strip src/bitflash
@@ -67,46 +110,79 @@ linux-node: deps-linux
 
 deps-linux: deps-apt deps-secp256k1 deps-randomx
 
+# libboost-dev, not libboost-system-dev: Boost.System has been header-only
+# since 1.69 and Ubuntu 26.04 (resolute) no longer ships the -system package.
+# This tree only includes two boost headers and links no boost library. The
+# apt-get update comes first: a fresh image's package lists are empty, and
+# install then fails on the first name it cannot find.
+#
+# A failed update is deliberately not fatal: one unreachable repository should
+# not block an install the lists already on disk can satisfy. It does say so,
+# though -- "unable to locate package" several seconds later is otherwise hard
+# to connect back to it. The install is the last command in the branch, so its
+# status is the target's, and that one does abort.
 deps-apt:
         @if command -v apt-get >/dev/null 2>&1; then \
+          $(SUDO) apt-get update || \
+            echo "  warning: apt-get update failed, using the package lists on disk"; \
           $(SUDO) apt-get install -y build-essential cmake git pkg-config autoconf \
             libtool libssl-dev libdb5.3++-dev libsodium-dev nlohmann-json3-dev \
-            libboost-system-dev libglfw3-dev libgl-dev python3-pil; \
+            libboost-dev libglfw3-dev libgl-dev libsqlite3-dev \
+            python3-pil clang; \
         else \
           echo "Not an apt system — install: g++ cmake git autoconf libtool"; \
-          echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl python3-pil"; \
+          echo "  libssl libdb++ libsodium nlohmann-json boost glfw3 opengl sqlite3 python3-pil"; \
         fi
 
 deps-secp256k1:
         @if [ ! -f /usr/local/lib/libsecp256k1.a ]; then \
           echo "==> building libsecp256k1"; \
-          rm -rf $(ROOT)/secp256k1-build; \
-          git init -q $(ROOT)/secp256k1-build; \
+          rm -rf $(ROOT)/secp256k1-build && \
+          git init -q $(ROOT)/secp256k1-build && \
           cd $(ROOT)/secp256k1-build && \
           git remote add origin $(SECP256K1_REPO) && \
           git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
-          git checkout -q $(SECP256K1_COMMIT) && \
-          ./autogen.sh && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+          echo "==> libsecp256k1 pinned at $(SECP256K1_COMMIT)" && \
+          cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
-          make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig; \
+          make -j$(NPROC) && $(SUDO) make install && $(SUDO) ldconfig && \
           echo "==> libsecp256k1 done"; \
         else \
           echo "==> libsecp256k1 already installed"; \
         fi
 
 deps-randomx:
-        @if [ ! -f $(HOME)/RandomX/build/librandomx.a ]; then \
+        @ws="$$(printf ' \t')"; \
+        case "$(RANDOMX_DIR)" in \
+          "")        echo "ERROR: RANDOMX_DIR is empty"; exit 1 ;; \
+          /)         echo "ERROR: RANDOMX_DIR is /, refusing"; exit 1 ;; \
+          *[$$ws]*)  echo "ERROR: RANDOMX_DIR contains whitespace: $(RANDOMX_DIR)"; exit 1 ;; \
+          *[*?[]*)   echo "ERROR: RANDOMX_DIR contains a glob character: $(RANDOMX_DIR)"; exit 1 ;; \
+          /*)        ;; \
+          *)         echo "ERROR: RANDOMX_DIR must be an absolute path: $(RANDOMX_DIR)"; exit 1 ;; \
+        esac
+        @if [ ! -f "$(RANDOMX_DIR)/build/librandomx.a" ]; then \
+          if [ -d "$(RANDOMX_DIR)" ] && [ ! -f "$(RANDOMX_DIR)/.bitflash-built" ]; then \
+            echo "ERROR: $(RANDOMX_DIR) exists but was not created by this build"; \
+            echo "       refusing to rm -rf it -- remove it yourself or set RANDOMX_DIR"; \
+            exit 1; \
+          fi; \
           echo "==> building RandomX"; \
-          rm -rf $(HOME)/RandomX; \
-          git init -q $(HOME)/RandomX; \
-          cd $(HOME)/RandomX && \
+          rm -rf "$(RANDOMX_DIR)" && \
+          git init -q "$(RANDOMX_DIR)" && \
+          cd "$(RANDOMX_DIR)" && \
           git remote add origin $(RANDOMX_REPO) && \
           git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
-          git checkout -q $(RANDOMX_COMMIT); \
-          mkdir -p $(HOME)/RandomX/build; \
-          cd $(HOME)/RandomX/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
-          make -j$(NPROC) randomx; \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+          echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
+          mkdir -p "$(RANDOMX_DIR)/build" && \
+          cd "$(RANDOMX_DIR)/build" && cmake .. -DCMAKE_BUILD_TYPE=Release && \
+          make -j$(NPROC) randomx && \
+          touch "$(RANDOMX_DIR)/.bitflash-built" && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \
@@ -157,13 +233,22 @@ img = ico.convert('RGBA'); \
 img.save(d + '/bitflash.png'); \
 import shutil; shutil.copy(d + '/bitflash.png', \
 d + '/usr/share/icons/hicolor/256x256/apps/bitflash.png')"
-        @for lib in libsodium.so.23 libdb_cxx-5.3.so libglfw.so.3; do \
+        @for lib in libsodium.so.23 libdb_cxx-5.3.so libsqlite3.so.0 libglfw.so.3; do \
           path=$$(ldconfig -p | grep " $$lib " | awk '{print $$NF}' | head -1); \
           [ -z "$$path" ] && path=$$(find /usr/lib /lib -name "$$lib" 2>/dev/null | head -1); \
           [ -n "$$path" ] && cp -L "$$path" $(APPDIR)/usr/lib/ && echo "  bundled $$lib" || echo "  missing $$lib"; \
         done
+# appimagetool's output used to be piped through grep ... || true, which
+# discarded its exit status: the target succeeded and announced "Built:"
+# even when no AppImage existed. Run the tool bare so its status decides,
+# then require the artefact to exist, be non-empty, and be newer than the
+# binary it was packaged from before saying so.
         @ARCH=x86_64 $(APPIMAGETOOL) --no-appstream $(APPDIR) \
-          $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage 2>&1 | grep -E "^Built|^Error" || true
+          $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage
+        @test -s $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage || \
+          { echo "ERROR: Bitflash-$(VERSION)-x86_64.AppImage missing or empty"; exit 1; }
+        @test $(ROOT)/Bitflash-$(VERSION)-x86_64.AppImage -nt src/bitflash || \
+          { echo "ERROR: Bitflash-$(VERSION)-x86_64.AppImage is not newer than src/bitflash"; exit 1; }
         @echo "Built: Bitflash-$(VERSION)-x86_64.AppImage"
 
 # ---- Windows (MSYS2 UCRT64) -----------------------------------------------
@@ -175,29 +260,42 @@ deps-windows:
           mingw-w64-ucrt-x86_64-glfw \
           mingw-w64-ucrt-x86_64-openssl \
           mingw-w64-ucrt-x86_64-db \
+          mingw-w64-ucrt-x86_64-sqlite3 \
           mingw-w64-ucrt-x86_64-libsodium \
           mingw-w64-ucrt-x86_64-nlohmann-json \
           mingw-w64-ucrt-x86_64-boost \
           mingw-w64-ucrt-x86_64-cmake \
           autoconf automake libtool
         @if [ ! -f deps/lib/libsecp256k1.a ]; then \
-          rm -rf secp256k1-build; \
-          git clone --depth 1 https://github.com/bitcoin-core/secp256k1 secp256k1-build; \
-          cd secp256k1-build && ./autogen.sh && \
+          rm -rf secp256k1-build && \
+          git init -q secp256k1-build && \
+          cd secp256k1-build && \
+          git remote add origin $(SECP256K1_REPO) && \
+          git fetch -q --depth 1 origin $(SECP256K1_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(SECP256K1_COMMIT)" && \
+          echo "==> secp256k1 pinned at $(SECP256K1_COMMIT)" && \
+          cd $(ROOT)/secp256k1-build && ./autogen.sh && \
           ./configure --prefix=$(ROOT)/deps \
             --enable-module-schnorrsig --enable-module-extrakeys \
             --disable-shared --with-pic --disable-benchmark --disable-tests && \
-          make install; \
+          make install && \
           echo "==> secp256k1 done"; \
         else \
           echo "==> secp256k1 already built"; \
         fi
         @if [ ! -f RandomX/build/librandomx.a ]; then \
-          rm -rf RandomX; \
-          git clone --depth 1 https://github.com/tevador/RandomX; \
-          mkdir -p RandomX/build; \
-          cd RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
-          make randomx; \
+          rm -rf RandomX && \
+          git init -q RandomX && \
+          cd RandomX && \
+          git remote add origin $(RANDOMX_REPO) && \
+          git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
+          git checkout -q --detach FETCH_HEAD && \
+          test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
+          echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
+          mkdir -p $(ROOT)/RandomX/build && \
+          cd $(ROOT)/RandomX/build && cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release && \
+          make randomx && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \
@@ -213,6 +311,9 @@ windows: deps-windows
         @zip -r Bitflash-$(VERSION)-windows.zip Bitflash-$(VERSION)-windows/
         @echo "Built: Bitflash-$(VERSION)-windows.zip"
 
+windows-tor: windows
+        ./scripts/package-windows-tor.sh
+
 # ---- Clean ----------------------------------------------------------------
 
 clean:
@@ -224,6 +325,12 @@ clean:
 tests:
         $(MAKE) -C src -f Makefile tests
 
+fuzz-net-message-smoke: deps-linux
+        $(MAKE) -C src -f Makefile fuzz-net-message-smoke
+
+fuzz-script-smoke: deps-linux
+        $(MAKE) -C src -f Makefile fuzz-script-smoke
+
 checksums:
         ./scripts/make-release-checksums.sh
 
@@ -233,6 +340,6 @@ sign-checksums:
 verify-release:
         ./scripts/verify-release.sh $(if $(TAG),$(TAG),latest)
 
-.PHONY: linux windows clean appimage \
-        tests checksums sign-checksums verify-release \
+.PHONY: linux windows windows-tor clean appimage \
+        tests fuzz-net-message-smoke fuzz-script-smoke checksums sign-checksums verify-release \
         deps-linux deps-windows deps-apt deps-secp256k1 deps-randomx