Bring main onto the line this project actually ships

main had drifted to a history with no ancestor in common with the tree we
build and deploy. It sat at be63e83 (2026-08-09) with 28 commits; the shipped
line, deploy/soak-2026-08-21, had 383. The two shared nothing -- git
merge-base returns no result at all -- so anyone cloning this repository
landed on a default branch that was neither current nor related to the
running node.

The 28 commits on main were audited before this merge: every one is already
present in the tree by content, including the two that are hardest to see
because they were rewritten afterwards -- the payout reorg-safety work
(PayoutBlockStillOnChain, since evolved to re-check on every retry rather
than once at maturity) and the nostr relay certificate verification
(SSL_set1_host, now with a Windows root-store path). Nothing on main is lost
by this merge.

Recorded as a merge rather than a force-push: main only ever moves forward,
its old history stays reachable as the first parent, and this is revertible.
The tree is taken wholesale from the merged branch, so main's content is now
exactly what was built and tested.

What this brings onto main:

- compactblock: BIP152-style compact block relay ported from upstream 1.2.23,
  primitives and unit test only, with the RAND_bytes failure path closed and
  the reconstruction allocation bounded.
- upstream/main 17741d9: isolated testnet parameters and genesis, optional
  2 MB large pages for RandomX. Mainnet genesis verified byte-identical
  through upstream's BuildGenesisBlock() refactor.
- deploy: every image built on bookworm so binaries run on Debian 12, and the
  container build now honours the RandomX and libsecp256k1 pins it had been
  silently ignoring since before 1.2.15.

Gates at this tree: 15/15 selftests, compactblock's 17 checks, consensus
constants unchanged against e4f898c apart from the pre-existing
MAX_BLOCK_SIZE_GEN, mainnet genesis intact, money-log check ok.

1 files changed, 100 insertions, 10 deletions

diff --git a/src/Makefile b/src/Makefile
index 171afe0..c997ae3 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -2,10 +2,13 @@
 # Called by: make linux (root Makefile)
 
 CXX ?= g++
+FUZZ_CXX ?= clang++
 
 SECP_INC    ?= /usr/local/include
 SECP_LIB    ?= /usr/local/lib
-RANDOMX_DIR ?= $(HOME)/RandomX
+# The root Makefile exports RANDOMX_DIR (default: <repo>/randomx-build, built
+# by deps-randomx). This fallback only applies when src/ is built standalone.
+RANDOMX_DIR ?= $(abspath $(CURDIR)/..)/randomx-build
 
 IMGUI_DIR = imgui
 
@@ -29,14 +32,17 @@ WARNFLAGS = -Wformat -Werror=format \
             -Wno-narrowing -Wno-unused-result
 
 CXXFLAGS = -std=gnu++14 -O2 $(WARNFLAGS) -fpermissive -pthread \
-           -DSECP256K1_STATIC \
+           -DSECP256K1_STATIC -DBITFLASH_NODE_BUILD \
            -I$(SECP_INC) -I$(RANDOMX_DIR)/src \
            -I/usr/include/nlohmann \
            -I$(IMGUI_DIR)
+FUZZ_CXXFLAGS = $(filter-out -O2,$(CXXFLAGS)) -O1 -g -fno-omit-frame-pointer \
+                -fsanitize=fuzzer-no-link,address,undefined
+FUZZ_LDFLAGS = -fsanitize=fuzzer,address,undefined
 
 LIBS = -L$(SECP_LIB) -lsecp256k1 \
        -L$(RANDOMX_DIR)/build -lrandomx \
-       -lsodium -lssl -lcrypto -ldb_cxx -lpthread \
+       -lsodium -lssl -lcrypto -ldb_cxx -lsqlite3 -lpthread \
        -lglfw -lGL
 
 # Every header a .cpp here includes has to be listed, not just the interesting
@@ -49,7 +55,8 @@ LIBS = -L$(SECP_LIB) -lsecp256k1 \
 HEADERS = headers_core.h headers.h util.h main.h serialize.h uint256.h \
           key.h bignum.h script.h db.h base58.h net.h nostr.h \
           randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h \
-          selftest.h walletcmd.h compat.h sockcount.h font_roboto.h
+          selftest.h walletcmd.h wallet_sqlite.h compat.h sockcount.h proxy.h tor.h font_roboto.h \
+          compactblock.h
 
 IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
              obj/imgui_widgets.o obj/imgui_impl_glfw.o obj/imgui_impl_opengl3.o
@@ -57,7 +64,8 @@ IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
 NODE_OBJS = obj/util.o obj/script.o obj/db.o obj/net.o obj/main.o \
             obj/sha.o obj/nostr.o obj/randomx_pow.o \
             obj/btfaddr.o obj/btfchan.o obj/btfrv.o obj/btftunnel.o obj/rpc.o \
-            obj/selftest.o obj/bip32.o obj/walletcmd.o
+            obj/selftest.o obj/bip32.o obj/walletcmd.o obj/wallet_sqlite.o \
+            obj/proxy.o obj/tor.o obj/compactblock.o
 
 GUI_OBJS = obj/gui.o obj/main_gui.o
 
@@ -96,7 +104,7 @@ obj/imgui_impl_opengl3.o: $(IMGUI_DIR)/imgui_impl_opengl3.cpp
         $(CXX) -c $(CXXFLAGS) -o $@ $<
 
 bitflash: $(IMGUI_OBJS) $(NODE_OBJS) $(GUI_OBJS)
-        $(CXX) $(CXXFLAGS) -o $@ $^ $(LIBS)
+        $(CXX) $(CXXFLAGS) $(LDHARDFLAGS) -o $@ $^ $(LIBS)
         @echo "Built: bitflash"
 
 # ---- headless node ---------------------------------------------------------
@@ -110,13 +118,31 @@ bitflash: $(IMGUI_OBJS) $(NODE_OBJS) $(GUI_OBJS)
 # Objects go to obj-node/ because main_gui.cpp is compiled twice, with and
 # without -DBITFLASH_NO_GUI, and the two must not overwrite each other.
 
+# RandomX links a hand-written assembly JIT stub, jit_compiler_x86_static.S,
+# which carries no .note.GNU-stack marker. Older binutils -- Debian 12's, which
+# is what builds against the oldest glibc we ship to -- reads a missing marker
+# as "this object wants an executable stack" and marks the whole binary RWE,
+# switching NX off for the process. Newer toolchains default the other way, so
+# identical source produced GNU_STACK RW on Ubuntu 26.04 and RWE on bookworm,
+# announced by nothing louder than a linker warning in the middle of the build.
+#
+# Assert it here rather than inherit whichever default the build host happens
+# to carry. The JIT maps its own W^X pages and never executes from the stack,
+# so nothing needs the permission this takes away. Check with:
+#   readelf -lW bitflash-node | grep -A1 GNU_STACK   # expect RW, not RWE
+LDHARDFLAGS = -Wl,-z,noexecstack
+
 NODE_LIBS = -L$(SECP_LIB) -lsecp256k1 \
             -L$(RANDOMX_DIR)/build -lrandomx \
-            -lsodium -lssl -lcrypto -ldb_cxx -lpthread
+            -lsodium -lssl -lcrypto -ldb_cxx -lsqlite3 -lpthread
 
 NODE_ONLY_OBJS = $(patsubst obj/%,obj-node/%,$(NODE_OBJS)) \
                  obj-node/main_gui.o obj-node/headless.o
 
+FUZZ_BASE_OBJS = $(patsubst obj/%,obj-fuzz/%,$(NODE_OBJS))
+FUZZ_NET_MESSAGE_OBJS = $(FUZZ_BASE_OBJS) obj-fuzz/fuzz_net_message.o
+FUZZ_SCRIPT_OBJS = $(FUZZ_BASE_OBJS) obj-fuzz/fuzz_script.o
+
 obj-node/%.o: %.cpp $(HEADERS)
         @mkdir -p obj-node
         $(CXX) -c $(CXXFLAGS) -DBITFLASH_NO_GUI -o $@ $<
@@ -126,21 +152,85 @@ obj-node/sha.o: sha.cpp sha.h
         $(CXX) -c $(CXXFLAGS) -DBITFLASH_NO_GUI -O3 -o $@ $<
 
 bitflash-node: $(NODE_ONLY_OBJS)
-        $(CXX) $(CXXFLAGS) -o $@ $^ $(NODE_LIBS)
+        $(CXX) $(CXXFLAGS) $(LDHARDFLAGS) -o $@ $^ $(NODE_LIBS)
         @echo "Built: bitflash-node (headless, no libGL needed)"
 
+obj-fuzz/%.o: %.cpp $(HEADERS)
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
+
+obj-fuzz/sha.o: sha.cpp sha.h
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -O1 -o $@ $<
+
+obj-fuzz/fuzz_net_message.o: fuzz_net_message.cpp $(HEADERS)
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
+
+obj-fuzz/fuzz_script.o: fuzz_script.cpp $(HEADERS)
+        @mkdir -p obj-fuzz
+        $(FUZZ_CXX) -c $(FUZZ_CXXFLAGS) -DBITFLASH_FUZZ -o $@ $<
+
+fuzz-net-message: $(FUZZ_NET_MESSAGE_OBJS)
+        $(FUZZ_CXX) $(filter-out -fsanitize=fuzzer-no-link%,$(FUZZ_CXXFLAGS)) \
+          $(FUZZ_LDFLAGS) -o $@ $^ $(NODE_LIBS)
+        @echo "Built: fuzz-net-message"
+
+fuzz-script: $(FUZZ_SCRIPT_OBJS)
+        $(FUZZ_CXX) $(filter-out -fsanitize=fuzzer-no-link%,$(FUZZ_CXXFLAGS)) \
+          $(FUZZ_LDFLAGS) -o $@ $^ $(NODE_LIBS)
+        @echo "Built: fuzz-script"
+
+fuzz-net-message-smoke: fuzz-net-message
+        @mkdir -p ../work/fuzz-corpus/net-message
+        @printf '\277\040\134\375ping\000\000\000\000\000\000\000\000\000\000\000\000' > ../work/fuzz-corpus/net-message/ping-header
+        @printf '\277\040\134\375version\000\000\000\000\000\000\000\000\000' > ../work/fuzz-corpus/net-message/version-header
+        ./fuzz-net-message -runs=128 ../work/fuzz-corpus/net-message
+
+fuzz-script-smoke: fuzz-script
+        @mkdir -p ../work/fuzz-corpus/script
+        @printf '\000\121' > ../work/fuzz-corpus/script/op-true
+        @printf '\001\166\251\024\001\002\003\004\005\006\007\010\011\012\013\014\015\016\017\020\021\022\023\024\210\254' > ../work/fuzz-corpus/script/p2pkh-shape
+        @printf '\000\115\377\377' > ../work/fuzz-corpus/script/truncated-pushdata2
+        ./fuzz-script -runs=128 ../work/fuzz-corpus/script
+
 clean:
-        rm -rf obj obj-node bitflash bitflash-node test_bip32
+        rm -rf obj obj-node obj-fuzz bitflash bitflash-node fuzz-net-message fuzz-script test_bip32 test_compactblock
 
 test_bip32: test_bip32.cpp bip32.cpp bip32.h bip39_english.h
         $(CXX) $(CXXFLAGS) -o $@ test_bip32.cpp bip32.cpp -lssl -lcrypto
 
-tests: test_bip32 bitflash-node
+# Upstream shipped test_compactblock.cpp with no build rule at all, so it was
+# never compiled there. It links the standalone way test_bip32 does: it supplies
+# its own mapTransactions and GetAppDir so main.cpp stays out of the link, and
+# only needs sha.cpp/util.cpp for Hash() and the logging helpers.
+#
+# TEST_LIBS is overridable for the same reason NODE_LIBS is: the pinned dep tree
+# ships libsodium as a static archive only, so a build against it passes
+# TEST_LIBS="... -l:libsodium.a ...".
+TEST_LIBS ?= -lsodium -lssl -lcrypto -lpthread
+
+test_compactblock: test_compactblock.cpp compactblock.cpp compactblock.h $(HEADERS)
+        $(CXX) $(CXXFLAGS) -o $@ test_compactblock.cpp compactblock.cpp sha.cpp util.cpp \
+          $(TEST_LIBS)
+
+tests: test_bip32 test_compactblock bitflash-node
         ./test_bip32
+        ./test_compactblock
         ./bitflash-node -selftest=wallet-keypool
         ./bitflash-node -selftest=wallet-hd
         ./bitflash-node -selftest=wallet-format
+        ./bitflash-node -selftest=wallet-sqlite
+        ./bitflash-node -selftest=wallet-sqlite-migration
         ./bitflash-node -selftest=wallet-crypto
         ./bitflash-node -selftest=wallet-encrypt
         ./bitflash-node -selftest=net-message
+        ./bitflash-node -selftest=network-params
         ./bitflash-node -selftest=consensus-limits
+        ./bitflash-node -selftest=pool-stratum
+        ./bitflash-node -selftest=payout-ledger
+        ./bitflash-node -selftest=parse-money
+        ./bitflash-node -selftest=socks5-proxy
+        ./bitflash-node -selftest=managed-tor
+
+.PHONY: tests fuzz-net-message-smoke fuzz-script-smoke