Merge upstream v1.2.20 into the fork

Merges upstream tag v1.2.20 (6aa3dade) into our 1.2.19+sec tree. The merge
base is bc3de30's descendant 9e39a50 -- upstream's own v1.2.19 -- so this is
an ordinary three-way merge, not a replay. Five conflict blocks in four
files, all resolved below.

No consensus change. CheckBlock, ConnectBlock, DisconnectBlock, ConnectInputs,
AcceptBlock, AcceptTransaction, GetNextWorkRequired and GetBlockValue hash
identical to v1.2.19; script.cpp and script.h are byte-identical on both
sides. main.cpp is +3 lines and main.h +2, all wallet-backend plumbing.
rpc.cpp is untouched, so the payout ledger arrives unchanged.

Makefile, VERSION. OURS, renumbered. 1.2.20+sec, for the same reason 1.2.19
carried +sec: this tree is not the upstream release of that number and the
string names every release artifact.

Makefile, AppImage recipe. OURS for the AppDir path, THEIRS for the bundled
library. Upstream's hunk reverts the icon paths to a hardcoded
/tmp/bitflash.AppDir, which is the local-user pre-placement hazard the fork
moved out of /tmp in the first place; taking their side wholesale would have
reintroduced it silently, inside a conflict about something else. The AppDir
stays $(APPDIR), and libsqlite3.so.0 joins the bundled list, which the new
backend genuinely needs.

src/Makefile, src/makefile.mingw, HEADERS. BOTH. Ours drops market.h,
theirs adds wallet_sqlite.h; the resolution does both. NODE_OBJS auto-merged
correctly in both files -- obj/wallet_sqlite.o present, obj/market.o still
gone -- and was verified rather than assumed, because that line has trapped
this fork before.

src/selftest.cpp, known-tests list. BOTH, union. Upstream adds eight
wallet-storage tests, we keep payout-ledger. The dispatch chain itself
auto-merged and still routes payout-ledger to RunPayoutLedgerSelfTest.

Hardening verified intact after merge: the TLS 1.2 floor in nostr.cpp, the
/rvrelay pin, opt-in managed Tor, strict sig3-on-onion descriptor
verification, and the marketplace removal. Upstream shipped no build logs or
__pycache__ this time; the three added files are docs/storage.md and
src/wallet_sqlite.{cpp,h}.

The SQLite backend this release introduces is NOT enabled here. An existing
wallet.dat resolves to Berkeley DB on every branch of the new selection
logic, and the conversion wizard is GUI-only and not compiled into the
headless node. The review findings that gate ever turning it on -- the
non-atomic backend marker, the connection-wide WriteHDMaster transaction,
and the encrypt-swap crash window -- are recorded on the tracker, not fixed
here.

1 files changed, 152 insertions, 31 deletions

diff --git a/src/db.h b/src/db.h
index 37a252f..859e3fb 100644
--- a/src/db.h
+++ b/src/db.h
@@ -46,7 +46,7 @@ public:
 };
 
 
-extern DbEnv dbenv;
+extern DbEnv& GetDbEnv();
 extern void DBFlush(bool fShutdown);
 // Close the environment and delete its logs. Only the encryption command calls
 // this: the logs hold the plaintext records the old wallet wrote.
@@ -235,7 +235,7 @@ public:
         if (!pdb)
             return false;
         DbTxn* ptxn = NULL;
-        int ret = dbenv.txn_begin(GetTxn(), &ptxn, 0);
+        int ret = GetDbEnv().txn_begin(GetTxn(), &ptxn, 0);
         if (!ptxn || ret != 0)
             return false;
         vTxn.push_back(ptxn);
@@ -333,6 +333,24 @@ private:
 // Legacy IP-based peer address database (CAddrDB / addr.dat) removed --
 // peer discovery is entirely Nostr/.btf-based now.
 
+bool WalletSQLiteRuntimeActive();
+bool WalletSQLiteRuntimeOpen(const string& strPath, string& strErrorRet, bool fMustExist=true);
+void WalletSQLiteRuntimeClose();
+bool WalletSQLiteRuntimeReadRecord(const vector<unsigned char>& vchKey,
+                                   vector<unsigned char>& vchValueRet);
+bool WalletSQLiteRuntimeWriteRecord(const vector<unsigned char>& vchKey,
+                                    const vector<unsigned char>& vchValue,
+                                    bool fOverwrite);
+bool WalletSQLiteRuntimeEraseRecord(const vector<unsigned char>& vchKey);
+bool WalletSQLiteRuntimeBeginTxn();
+bool WalletSQLiteRuntimeCommitTxn();
+void WalletSQLiteRuntimeRollbackTxn();
+bool WalletSQLiteRuntimeOpenReadOnly(const string& strPath, string& strErrorRet);
+bool WalletSQLiteRuntimeCheckpoint(string& strErrorRet);
+string ReadWalletBackendMarker();
+bool WriteWalletBackendMarker(const string& strBackend);
+bool CreateNewSQLiteWallet(const string& strPath);
+
 
 
 
@@ -340,64 +358,141 @@ private:
 class CWalletDB : public CDB
 {
 public:
-    CWalletDB(const char* pszMode="r+", bool fTxn=false) : CDB("wallet.dat", pszMode, fTxn) { }
+    CWalletDB(const char* pszMode="r+", bool fTxn=false);
 private:
     CWalletDB(const CWalletDB&);
     void operator=(const CWalletDB&);
+
+    template<typename K, typename T>
+    bool ReadWalletRecord(const K& key, T& value)
+    {
+        if (!WalletSQLiteRuntimeActive())
+            return Read(key, value);
+
+        CDataStream ssKey(SER_DISK);
+        ssKey.reserve(1000);
+        ssKey << key;
+        vector<unsigned char> vchKey(ssKey.begin(), ssKey.end());
+        vector<unsigned char> vchValue;
+
+        bool fOk = WalletSQLiteRuntimeReadRecord(vchKey, vchValue);
+        if (!vchKey.empty())
+            memset(&vchKey[0], 0, vchKey.size());
+        if (!ssKey.empty())
+            memset(&ssKey[0], 0, ssKey.size());
+        if (!fOk)
+            return false;
+
+        CDataStream ssValue(vchValue, SER_DISK);
+        ssValue >> value;
+        bool fReadOk = !ssValue.fail();
+        if (!vchValue.empty())
+            memset(&vchValue[0], 0, vchValue.size());
+        if (!ssValue.empty())
+            memset(&ssValue[0], 0, ssValue.size());
+        return fReadOk;
+    }
+
+    template<typename K, typename T>
+    bool WriteWalletRecord(const K& key, const T& value, bool fOverwrite=true)
+    {
+        if (!WalletSQLiteRuntimeActive())
+            return Write(key, value, fOverwrite);
+
+        CDataStream ssKey(SER_DISK);
+        ssKey.reserve(1000);
+        ssKey << key;
+        CDataStream ssValue(SER_DISK);
+        ssValue.reserve(10000);
+        ssValue << value;
+
+        vector<unsigned char> vchKey(ssKey.begin(), ssKey.end());
+        vector<unsigned char> vchValue(ssValue.begin(), ssValue.end());
+        bool fOk = WalletSQLiteRuntimeWriteRecord(vchKey, vchValue, fOverwrite);
+
+        if (!vchKey.empty())
+            memset(&vchKey[0], 0, vchKey.size());
+        if (!vchValue.empty())
+            memset(&vchValue[0], 0, vchValue.size());
+        if (!ssKey.empty())
+            memset(&ssKey[0], 0, ssKey.size());
+        if (!ssValue.empty())
+            memset(&ssValue[0], 0, ssValue.size());
+        return fOk;
+    }
+
+    template<typename K>
+    bool EraseWalletRecord(const K& key)
+    {
+        if (!WalletSQLiteRuntimeActive())
+            return Erase(key);
+
+        CDataStream ssKey(SER_DISK);
+        ssKey.reserve(1000);
+        ssKey << key;
+        vector<unsigned char> vchKey(ssKey.begin(), ssKey.end());
+        bool fOk = WalletSQLiteRuntimeEraseRecord(vchKey);
+
+        if (!vchKey.empty())
+            memset(&vchKey[0], 0, vchKey.size());
+        if (!ssKey.empty())
+            memset(&ssKey[0], 0, ssKey.size());
+        return fOk;
+    }
 public:
     bool ReadName(const string& strAddress, string& strName)
     {
         strName = "";
-        return Read(make_pair(string("name"), strAddress), strName);
+        return ReadWalletRecord(make_pair(string("name"), strAddress), strName);
     }
 
     bool WriteName(const string& strAddress, const string& strName)
     {
         mapAddressBook[strAddress] = strName;
-        return Write(make_pair(string("name"), strAddress), strName);
+        return WriteWalletRecord(make_pair(string("name"), strAddress), strName);
     }
 
     bool EraseName(const string& strAddress)
     {
         mapAddressBook.erase(strAddress);
-        return Erase(make_pair(string("name"), strAddress));
+        return EraseWalletRecord(make_pair(string("name"), strAddress));
     }
 
     bool ReadTx(uint256 hash, CWalletTx& wtx)
     {
-        return Read(make_pair(string("tx"), hash), wtx);
+        return ReadWalletRecord(make_pair(string("tx"), hash), wtx);
     }
 
     bool WriteTx(uint256 hash, const CWalletTx& wtx)
     {
-        return Write(make_pair(string("tx"), hash), wtx);
+        return WriteWalletRecord(make_pair(string("tx"), hash), wtx);
     }
 
     bool EraseTx(uint256 hash)
     {
-        return Erase(make_pair(string("tx"), hash));
+        return EraseWalletRecord(make_pair(string("tx"), hash));
     }
 
     bool ReadKey(const vector<unsigned char>& vchPubKey, CPrivKey& vchPrivKey)
     {
         vchPrivKey.clear();
-        return Read(make_pair(string("key"), vchPubKey), vchPrivKey);
+        return ReadWalletRecord(make_pair(string("key"), vchPubKey), vchPrivKey);
     }
 
     bool WriteKey(const vector<unsigned char>& vchPubKey, const CPrivKey& vchPrivKey)
     {
-        return Write(make_pair(string("key"), vchPubKey), vchPrivKey, false);
+        return WriteWalletRecord(make_pair(string("key"), vchPubKey), vchPrivKey, false);
     }
 
     bool ReadDefaultKey(vector<unsigned char>& vchPubKey)
     {
         vchPubKey.clear();
-        return Read(string("defaultkey"), vchPubKey);
+        return ReadWalletRecord(string("defaultkey"), vchPubKey);
     }
 
     bool WriteDefaultKey(const vector<unsigned char>& vchPubKey)
     {
-        return Write(string("defaultkey"), vchPubKey);
+        return WriteWalletRecord(string("defaultkey"), vchPubKey);
     }
 
     // --- Deterministic (BIP32) seed ---------------------------------------
@@ -415,62 +510,75 @@ public:
     {
         vchMasterRet.clear();
         vchChainCodeRet.clear();
-        return Read(string("hdmaster"), vchMasterRet)
-            && Read(string("hdchaincode"), vchChainCodeRet);
+        return ReadWalletRecord(string("hdmaster"), vchMasterRet)
+            && ReadWalletRecord(string("hdchaincode"), vchChainCodeRet);
     }
 
     bool WriteHDMaster(const vector<unsigned char>& vchMaster, const vector<unsigned char>& vchChainCode)
     {
-        return Write(string("hdmaster"), vchMaster)
-            && Write(string("hdchaincode"), vchChainCode);
+        // hdmaster and hdchaincode are halves of one seed: a wallet with one but
+        // not the other is an incomplete HD wallet (-walletstoragecheck flags
+        // exactly that). Under the SQLite runtime write them in one transaction
+        // so a failure or crash between the two cannot leave that half-state.
+        // Berkeley DB keeps its existing per-write behaviour -- the bracket is a
+        // no-op there.
+        if (!WalletSQLiteRuntimeBeginTxn())
+            return false;
+        if (!WriteWalletRecord(string("hdmaster"), vchMaster) ||
+            !WriteWalletRecord(string("hdchaincode"), vchChainCode))
+        {
+            WalletSQLiteRuntimeRollbackTxn();
+            return false;
+        }
+        return WalletSQLiteRuntimeCommitTxn();
     }
 
     bool WriteWalletMinVersion(int nVersion)
     {
-        return Write(string("walletminversion"), nVersion);
+        return WriteWalletRecord(string("walletminversion"), nVersion);
     }
 
     bool WriteMasterKey(unsigned int nID, const CWalletMasterKey& kMasterKey)
     {
-        return Write(make_pair(string("mkey"), nID), kMasterKey, true);
+        return WriteWalletRecord(make_pair(string("mkey"), nID), kMasterKey, true);
     }
 
     bool WriteCryptedKey(const vector<unsigned char>& vchPubKey,
                          const vector<unsigned char>& vchCryptedSecret)
     {
-        return Write(make_pair(string("ckey"), vchPubKey), vchCryptedSecret, false);
+        return WriteWalletRecord(make_pair(string("ckey"), vchPubKey), vchCryptedSecret, false);
     }
 
     bool WriteCryptedHDMaster(const vector<unsigned char>& vchCryptedMaster,
                               const vector<unsigned char>& vchCryptedChainCode)
     {
-        return Write(string("cryptedhdmaster"), vchCryptedMaster)
-            && Write(string("cryptedhdchaincode"), vchCryptedChainCode);
+        return WriteWalletRecord(string("cryptedhdmaster"), vchCryptedMaster)
+            && WriteWalletRecord(string("cryptedhdchaincode"), vchCryptedChainCode);
     }
 
     bool WriteHDNext(unsigned int nNext)
     {
-        return Write(string("hdnext"), nNext);
+        return WriteWalletRecord(string("hdnext"), nNext);
     }
 
     bool WriteHDSchema(int nSchema)
     {
-        return Write(string("hdschema"), nSchema);
+        return WriteWalletRecord(string("hdschema"), nSchema);
     }
 
     bool WriteHDCoinType(unsigned int nCoinType)
     {
-        return Write(string("hdcointype"), nCoinType);
+        return WriteWalletRecord(string("hdcointype"), nCoinType);
     }
 
     bool WriteHDReceiveNext(unsigned int nNext)
     {
-        return Write(string("hdreceivenext"), nNext);
+        return WriteWalletRecord(string("hdreceivenext"), nNext);
     }
 
     bool WriteHDChangeNext(unsigned int nNext)
     {
-        return Write(string("hdchangenext"), nNext);
+        return WriteWalletRecord(string("hdchangenext"), nNext);
     }
 
     // Keys generated ahead of time and not yet handed out. The private key of
@@ -478,30 +586,43 @@ public:
     // record only says that this one is still unspoken for.
     bool WritePool(int64 nIndex, const vector<unsigned char>& vchPubKey)
     {
-        return Write(make_pair(string("pool"), nIndex), vchPubKey);
+        return WriteWalletRecord(make_pair(string("pool"), nIndex), vchPubKey);
     }
 
     bool ErasePool(int64 nIndex)
     {
-        return Erase(make_pair(string("pool"), nIndex));
+        return EraseWalletRecord(make_pair(string("pool"), nIndex));
     }
 
     template<typename T>
     bool ReadSetting(const string& strKey, T& value)
     {
-        return Read(make_pair(string("setting"), strKey), value);
+        return ReadWalletRecord(make_pair(string("setting"), strKey), value);
     }
 
     template<typename T>
     bool WriteSetting(const string& strKey, const T& value)
     {
-        return Write(make_pair(string("setting"), strKey), value);
+        return WriteWalletRecord(make_pair(string("setting"), strKey), value);
     }
 
     bool LoadWallet(vector<unsigned char>& vchDefaultKeyRet);
 };
 
+class CWalletRecordVisitor
+{
+public:
+    virtual ~CWalletRecordVisitor() { }
+    virtual bool VisitWalletRecord(const CDataStream& ssKey,
+                                   const CDataStream& ssValue,
+                                   string& strErrorRet) = 0;
+};
+
+bool ScanWalletRecords(CWalletRecordVisitor& visitor, string& strErrorRet);
+
 bool LoadWallet();
+bool LoadWalletFromSQLite(const string& strPath);
+bool LoadWalletFromSQLiteRuntime(const string& strPath);
 
 // Writes a wallet.dat that opens on its own, anywhere -- see the definition in
 // db.cpp for why a plain file copy does not. Still a point-in-time snapshot: