Keep HD change recoverable and bound message stalls (#109)

Change from an HD wallet now goes to a newly derived phrase-backed key instead of reusing a spent input's key. Reusing an input key silently moved value back to a key the phrase cannot reproduce; if derivation fails the transaction is refused rather than creating unrecoverable change. Legacy wallets with no seed keep the 0.1.0 behaviour. Restore also scans past the pre-generated key-pool window before treating an empty batch as the end.

The message parser no longer consumes a header it cannot complete: it reads from a copy, so the O(n) reinsert and the 100 ms sleep inside the shared message thread are gone, and a peer that sits on an incomplete payload is disconnected after two minutes. The wire cap drops from 256 MB to MAX_SIZE. New net-message self-test covers complete, incomplete, stale and oversized headers.

Verified here: clean rebuild, all self-tests pass, lock order checked (no path takes cs_keyPool before cs_mapWallet), and a node built from this branch synced from genesis to the chain tip on the live network with zero rejections.

1 files changed, 1 insertions, 0 deletions

diff --git a/src/Makefile b/src/Makefile
index 5ded7d6..88dc08f 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -139,3 +139,4 @@ tests: test_bip32 bitflash-node
         ./test_bip32
         ./bitflash-node -selftest=wallet-keypool
         ./bitflash-node -selftest=wallet-hd
+        ./bitflash-node -selftest=net-message