Bring main onto the line this project actually ships

main had drifted to a history with no ancestor in common with the tree we
build and deploy. It sat at be63e83 (2026-08-09) with 28 commits; the shipped
line, deploy/soak-2026-08-21, had 383. The two shared nothing -- git
merge-base returns no result at all -- so anyone cloning this repository
landed on a default branch that was neither current nor related to the
running node.

The 28 commits on main were audited before this merge: every one is already
present in the tree by content, including the two that are hardest to see
because they were rewritten afterwards -- the payout reorg-safety work
(PayoutBlockStillOnChain, since evolved to re-check on every retry rather
than once at maturity) and the nostr relay certificate verification
(SSL_set1_host, now with a Windows root-store path). Nothing on main is lost
by this merge.

Recorded as a merge rather than a force-push: main only ever moves forward,
its old history stays reachable as the first parent, and this is revertible.
The tree is taken wholesale from the merged branch, so main's content is now
exactly what was built and tested.

What this brings onto main:

- compactblock: BIP152-style compact block relay ported from upstream 1.2.23,
  primitives and unit test only, with the RAND_bytes failure path closed and
  the reconstruction allocation bounded.
- upstream/main 17741d9: isolated testnet parameters and genesis, optional
  2 MB large pages for RandomX. Mainnet genesis verified byte-identical
  through upstream's BuildGenesisBlock() refactor.
- deploy: every image built on bookworm so binaries run on Debian 12, and the
  container build now honours the RandomX and libsecp256k1 pins it had been
  silently ignoring since before 1.2.15.

Gates at this tree: 15/15 selftests, compactblock's 17 checks, consensus
constants unchanged against e4f898c apart from the pre-existing
MAX_BLOCK_SIZE_GEN, mainnet genesis intact, money-log check ok.

1 files changed, 152 insertions, 31 deletions

diff --git a/src/db.h b/src/db.h
index 37a252f..859e3fb 100644
--- a/src/db.h
+++ b/src/db.h
@@ -46,7 +46,7 @@ public:
 };
 
 
-extern DbEnv dbenv;
+extern DbEnv& GetDbEnv();
 extern void DBFlush(bool fShutdown);
 // Close the environment and delete its logs. Only the encryption command calls
 // this: the logs hold the plaintext records the old wallet wrote.
@@ -235,7 +235,7 @@ public:
         if (!pdb)
             return false;
         DbTxn* ptxn = NULL;
-        int ret = dbenv.txn_begin(GetTxn(), &ptxn, 0);
+        int ret = GetDbEnv().txn_begin(GetTxn(), &ptxn, 0);
         if (!ptxn || ret != 0)
             return false;
         vTxn.push_back(ptxn);
@@ -333,6 +333,24 @@ private:
 // Legacy IP-based peer address database (CAddrDB / addr.dat) removed --
 // peer discovery is entirely Nostr/.btf-based now.
 
+bool WalletSQLiteRuntimeActive();
+bool WalletSQLiteRuntimeOpen(const string& strPath, string& strErrorRet, bool fMustExist=true);
+void WalletSQLiteRuntimeClose();
+bool WalletSQLiteRuntimeReadRecord(const vector<unsigned char>& vchKey,
+                                   vector<unsigned char>& vchValueRet);
+bool WalletSQLiteRuntimeWriteRecord(const vector<unsigned char>& vchKey,
+                                    const vector<unsigned char>& vchValue,
+                                    bool fOverwrite);
+bool WalletSQLiteRuntimeEraseRecord(const vector<unsigned char>& vchKey);
+bool WalletSQLiteRuntimeBeginTxn();
+bool WalletSQLiteRuntimeCommitTxn();
+void WalletSQLiteRuntimeRollbackTxn();
+bool WalletSQLiteRuntimeOpenReadOnly(const string& strPath, string& strErrorRet);
+bool WalletSQLiteRuntimeCheckpoint(string& strErrorRet);
+string ReadWalletBackendMarker();
+bool WriteWalletBackendMarker(const string& strBackend);
+bool CreateNewSQLiteWallet(const string& strPath);
+
 
 
 
@@ -340,64 +358,141 @@ private:
 class CWalletDB : public CDB
 {
 public:
-    CWalletDB(const char* pszMode="r+", bool fTxn=false) : CDB("wallet.dat", pszMode, fTxn) { }
+    CWalletDB(const char* pszMode="r+", bool fTxn=false);
 private:
     CWalletDB(const CWalletDB&);
     void operator=(const CWalletDB&);
+
+    template<typename K, typename T>
+    bool ReadWalletRecord(const K& key, T& value)
+    {
+        if (!WalletSQLiteRuntimeActive())
+            return Read(key, value);
+
+        CDataStream ssKey(SER_DISK);
+        ssKey.reserve(1000);
+        ssKey << key;
+        vector<unsigned char> vchKey(ssKey.begin(), ssKey.end());
+        vector<unsigned char> vchValue;
+
+        bool fOk = WalletSQLiteRuntimeReadRecord(vchKey, vchValue);
+        if (!vchKey.empty())
+            memset(&vchKey[0], 0, vchKey.size());
+        if (!ssKey.empty())
+            memset(&ssKey[0], 0, ssKey.size());
+        if (!fOk)
+            return false;
+
+        CDataStream ssValue(vchValue, SER_DISK);
+        ssValue >> value;
+        bool fReadOk = !ssValue.fail();
+        if (!vchValue.empty())
+            memset(&vchValue[0], 0, vchValue.size());
+        if (!ssValue.empty())
+            memset(&ssValue[0], 0, ssValue.size());
+        return fReadOk;
+    }
+
+    template<typename K, typename T>
+    bool WriteWalletRecord(const K& key, const T& value, bool fOverwrite=true)
+    {
+        if (!WalletSQLiteRuntimeActive())
+            return Write(key, value, fOverwrite);
+
+        CDataStream ssKey(SER_DISK);
+        ssKey.reserve(1000);
+        ssKey << key;
+        CDataStream ssValue(SER_DISK);
+        ssValue.reserve(10000);
+        ssValue << value;
+
+        vector<unsigned char> vchKey(ssKey.begin(), ssKey.end());
+        vector<unsigned char> vchValue(ssValue.begin(), ssValue.end());
+        bool fOk = WalletSQLiteRuntimeWriteRecord(vchKey, vchValue, fOverwrite);
+
+        if (!vchKey.empty())
+            memset(&vchKey[0], 0, vchKey.size());
+        if (!vchValue.empty())
+            memset(&vchValue[0], 0, vchValue.size());
+        if (!ssKey.empty())
+            memset(&ssKey[0], 0, ssKey.size());
+        if (!ssValue.empty())
+            memset(&ssValue[0], 0, ssValue.size());
+        return fOk;
+    }
+
+    template<typename K>
+    bool EraseWalletRecord(const K& key)
+    {
+        if (!WalletSQLiteRuntimeActive())
+            return Erase(key);
+
+        CDataStream ssKey(SER_DISK);
+        ssKey.reserve(1000);
+        ssKey << key;
+        vector<unsigned char> vchKey(ssKey.begin(), ssKey.end());
+        bool fOk = WalletSQLiteRuntimeEraseRecord(vchKey);
+
+        if (!vchKey.empty())
+            memset(&vchKey[0], 0, vchKey.size());
+        if (!ssKey.empty())
+            memset(&ssKey[0], 0, ssKey.size());
+        return fOk;
+    }
 public:
     bool ReadName(const string& strAddress, string& strName)
     {
         strName = "";
-        return Read(make_pair(string("name"), strAddress), strName);
+        return ReadWalletRecord(make_pair(string("name"), strAddress), strName);
     }
 
     bool WriteName(const string& strAddress, const string& strName)
     {
         mapAddressBook[strAddress] = strName;
-        return Write(make_pair(string("name"), strAddress), strName);
+        return WriteWalletRecord(make_pair(string("name"), strAddress), strName);
     }
 
     bool EraseName(const string& strAddress)
     {
         mapAddressBook.erase(strAddress);
-        return Erase(make_pair(string("name"), strAddress));
+        return EraseWalletRecord(make_pair(string("name"), strAddress));
     }
 
     bool ReadTx(uint256 hash, CWalletTx& wtx)
     {
-        return Read(make_pair(string("tx"), hash), wtx);
+        return ReadWalletRecord(make_pair(string("tx"), hash), wtx);
     }
 
     bool WriteTx(uint256 hash, const CWalletTx& wtx)
     {
-        return Write(make_pair(string("tx"), hash), wtx);
+        return WriteWalletRecord(make_pair(string("tx"), hash), wtx);
     }
 
     bool EraseTx(uint256 hash)
     {
-        return Erase(make_pair(string("tx"), hash));
+        return EraseWalletRecord(make_pair(string("tx"), hash));
     }
 
     bool ReadKey(const vector<unsigned char>& vchPubKey, CPrivKey& vchPrivKey)
     {
         vchPrivKey.clear();
-        return Read(make_pair(string("key"), vchPubKey), vchPrivKey);
+        return ReadWalletRecord(make_pair(string("key"), vchPubKey), vchPrivKey);
     }
 
     bool WriteKey(const vector<unsigned char>& vchPubKey, const CPrivKey& vchPrivKey)
     {
-        return Write(make_pair(string("key"), vchPubKey), vchPrivKey, false);
+        return WriteWalletRecord(make_pair(string("key"), vchPubKey), vchPrivKey, false);
     }
 
     bool ReadDefaultKey(vector<unsigned char>& vchPubKey)
     {
         vchPubKey.clear();
-        return Read(string("defaultkey"), vchPubKey);
+        return ReadWalletRecord(string("defaultkey"), vchPubKey);
     }
 
     bool WriteDefaultKey(const vector<unsigned char>& vchPubKey)
     {
-        return Write(string("defaultkey"), vchPubKey);
+        return WriteWalletRecord(string("defaultkey"), vchPubKey);
     }
 
     // --- Deterministic (BIP32) seed ---------------------------------------
@@ -415,62 +510,75 @@ public:
     {
         vchMasterRet.clear();
         vchChainCodeRet.clear();
-        return Read(string("hdmaster"), vchMasterRet)
-            && Read(string("hdchaincode"), vchChainCodeRet);
+        return ReadWalletRecord(string("hdmaster"), vchMasterRet)
+            && ReadWalletRecord(string("hdchaincode"), vchChainCodeRet);
     }
 
     bool WriteHDMaster(const vector<unsigned char>& vchMaster, const vector<unsigned char>& vchChainCode)
     {
-        return Write(string("hdmaster"), vchMaster)
-            && Write(string("hdchaincode"), vchChainCode);
+        // hdmaster and hdchaincode are halves of one seed: a wallet with one but
+        // not the other is an incomplete HD wallet (-walletstoragecheck flags
+        // exactly that). Under the SQLite runtime write them in one transaction
+        // so a failure or crash between the two cannot leave that half-state.
+        // Berkeley DB keeps its existing per-write behaviour -- the bracket is a
+        // no-op there.
+        if (!WalletSQLiteRuntimeBeginTxn())
+            return false;
+        if (!WriteWalletRecord(string("hdmaster"), vchMaster) ||
+            !WriteWalletRecord(string("hdchaincode"), vchChainCode))
+        {
+            WalletSQLiteRuntimeRollbackTxn();
+            return false;
+        }
+        return WalletSQLiteRuntimeCommitTxn();
     }
 
     bool WriteWalletMinVersion(int nVersion)
     {
-        return Write(string("walletminversion"), nVersion);
+        return WriteWalletRecord(string("walletminversion"), nVersion);
     }
 
     bool WriteMasterKey(unsigned int nID, const CWalletMasterKey& kMasterKey)
     {
-        return Write(make_pair(string("mkey"), nID), kMasterKey, true);
+        return WriteWalletRecord(make_pair(string("mkey"), nID), kMasterKey, true);
     }
 
     bool WriteCryptedKey(const vector<unsigned char>& vchPubKey,
                          const vector<unsigned char>& vchCryptedSecret)
     {
-        return Write(make_pair(string("ckey"), vchPubKey), vchCryptedSecret, false);
+        return WriteWalletRecord(make_pair(string("ckey"), vchPubKey), vchCryptedSecret, false);
     }
 
     bool WriteCryptedHDMaster(const vector<unsigned char>& vchCryptedMaster,
                               const vector<unsigned char>& vchCryptedChainCode)
     {
-        return Write(string("cryptedhdmaster"), vchCryptedMaster)
-            && Write(string("cryptedhdchaincode"), vchCryptedChainCode);
+        return WriteWalletRecord(string("cryptedhdmaster"), vchCryptedMaster)
+            && WriteWalletRecord(string("cryptedhdchaincode"), vchCryptedChainCode);
     }
 
     bool WriteHDNext(unsigned int nNext)
     {
-        return Write(string("hdnext"), nNext);
+        return WriteWalletRecord(string("hdnext"), nNext);
     }
 
     bool WriteHDSchema(int nSchema)
     {
-        return Write(string("hdschema"), nSchema);
+        return WriteWalletRecord(string("hdschema"), nSchema);
     }
 
     bool WriteHDCoinType(unsigned int nCoinType)
     {
-        return Write(string("hdcointype"), nCoinType);
+        return WriteWalletRecord(string("hdcointype"), nCoinType);
     }
 
     bool WriteHDReceiveNext(unsigned int nNext)
     {
-        return Write(string("hdreceivenext"), nNext);
+        return WriteWalletRecord(string("hdreceivenext"), nNext);
     }
 
     bool WriteHDChangeNext(unsigned int nNext)
     {
-        return Write(string("hdchangenext"), nNext);
+        return WriteWalletRecord(string("hdchangenext"), nNext);
     }
 
     // Keys generated ahead of time and not yet handed out. The private key of
@@ -478,30 +586,43 @@ public:
     // record only says that this one is still unspoken for.
     bool WritePool(int64 nIndex, const vector<unsigned char>& vchPubKey)
     {
-        return Write(make_pair(string("pool"), nIndex), vchPubKey);
+        return WriteWalletRecord(make_pair(string("pool"), nIndex), vchPubKey);
     }
 
     bool ErasePool(int64 nIndex)
     {
-        return Erase(make_pair(string("pool"), nIndex));
+        return EraseWalletRecord(make_pair(string("pool"), nIndex));
     }
 
     template<typename T>
     bool ReadSetting(const string& strKey, T& value)
     {
-        return Read(make_pair(string("setting"), strKey), value);
+        return ReadWalletRecord(make_pair(string("setting"), strKey), value);
     }
 
     template<typename T>
     bool WriteSetting(const string& strKey, const T& value)
     {
-        return Write(make_pair(string("setting"), strKey), value);
+        return WriteWalletRecord(make_pair(string("setting"), strKey), value);
     }
 
     bool LoadWallet(vector<unsigned char>& vchDefaultKeyRet);
 };
 
+class CWalletRecordVisitor
+{
+public:
+    virtual ~CWalletRecordVisitor() { }
+    virtual bool VisitWalletRecord(const CDataStream& ssKey,
+                                   const CDataStream& ssValue,
+                                   string& strErrorRet) = 0;
+};
+
+bool ScanWalletRecords(CWalletRecordVisitor& visitor, string& strErrorRet);
+
 bool LoadWallet();
+bool LoadWalletFromSQLite(const string& strPath);
+bool LoadWalletFromSQLiteRuntime(const string& strPath);
 
 // Writes a wallet.dat that opens on its own, anywhere -- see the definition in
 // db.cpp for why a plain file copy does not. Still a point-in-time snapshot: