Bring main onto the line this project actually ships

main had drifted to a history with no ancestor in common with the tree we
build and deploy. It sat at be63e83 (2026-08-09) with 28 commits; the shipped
line, deploy/soak-2026-08-21, had 383. The two shared nothing -- git
merge-base returns no result at all -- so anyone cloning this repository
landed on a default branch that was neither current nor related to the
running node.

The 28 commits on main were audited before this merge: every one is already
present in the tree by content, including the two that are hardest to see
because they were rewritten afterwards -- the payout reorg-safety work
(PayoutBlockStillOnChain, since evolved to re-check on every retry rather
than once at maturity) and the nostr relay certificate verification
(SSL_set1_host, now with a Windows root-store path). Nothing on main is lost
by this merge.

Recorded as a merge rather than a force-push: main only ever moves forward,
its old history stays reachable as the first parent, and this is revertible.
The tree is taken wholesale from the merged branch, so main's content is now
exactly what was built and tested.

What this brings onto main:

- compactblock: BIP152-style compact block relay ported from upstream 1.2.23,
  primitives and unit test only, with the RAND_bytes failure path closed and
  the reconstruction allocation bounded.
- upstream/main 17741d9: isolated testnet parameters and genesis, optional
  2 MB large pages for RandomX. Mainnet genesis verified byte-identical
  through upstream's BuildGenesisBlock() refactor.
- deploy: every image built on bookworm so binaries run on Debian 12, and the
  container build now honours the RandomX and libsecp256k1 pins it had been
  silently ignoring since before 1.2.15.

Gates at this tree: 15/15 selftests, compactblock's 17 checks, consensus
constants unchanged against e4f898c apart from the pre-existing
MAX_BLOCK_SIZE_GEN, mainnet genesis intact, money-log check ok.

1 files changed, 263 insertions, 12 deletions

diff --git a/src/gui.cpp b/src/gui.cpp
index 8f1d204..ff6059a 100644
--- a/src/gui.cpp
+++ b/src/gui.cpp
@@ -11,10 +11,16 @@
 #include <ctime>
 #include <cstdio>
 #include <sstream>
+#ifdef _WIN32
+#include <shellapi.h>   // ShellExecuteA, to open the website in the browser
+#else
+#include <unistd.h>
+#endif
 #include <iomanip>
 #include <atomic>
 #include <mutex>
 #include <thread>
+#include <system_error>
 #include "bip32.h"
 #include "walletcmd.h"
 #include "font_roboto.h"
@@ -172,7 +178,11 @@ static bool PathIsInsideDataDir(const std::string& strPath)
 
 static void SetDefaultBackupPath()
 {
-    std::string path = DefaultBackupDir() + "/wallet-backup-" + BackupTimeSuffix() + ".dat";
+    // Match the extension to the live backend: BackupWallet copies wallet.sqlite
+    // under the SQLite backend and wallet.dat under Berkeley DB, so a ".dat"
+    // default name would put SQLite contents in a misleadingly-named file.
+    const char* pszExt = WalletSQLiteRuntimeActive() ? ".sqlite" : ".dat";
+    std::string path = DefaultBackupDir() + "/wallet-backup-" + BackupTimeSuffix() + pszExt;
     strncpy(g_backupPath, path.c_str(), sizeof(g_backupPath)-1);
     g_backupPath[sizeof(g_backupPath)-1] = '\0';
 }
@@ -910,8 +920,16 @@ static void DrawOptionsDialog()
 
             if (nMineMode == MINE_OPERATOR) {
                 if (!gPoolServerRunning) {
-                    gPoolServerRunning = true;
-                    _beginthread(ThreadRPCServer, 0, NULL);
+                    // Claim the server is up only once it is. The flag used to
+                    // be set first and the result never looked at, so a refused
+                    // spawn left an operator with a pool that reports itself
+                    // running, no RPC server for miners to reach, and nothing
+                    // anywhere saying why. The flag also latches: with it set,
+                    // this branch is never retried.
+                    if (_beginthread(ThreadRPCServer, 0, NULL) == (uintptr_t)-1)
+                        printf("Error: _beginthread(ThreadRPCServer) failed -- pool server not started\n");
+                    else
+                        gPoolServerRunning = true;
                 } else if (!gPoolRunning) {
                     gPoolRunning = true;
                 }
@@ -1124,11 +1142,28 @@ static void DrawRestorePhraseDialog()
                 }
                 g_restoreDerived.store(0);
                 g_restoreRecovered.store(0);
+                // Set before the spawn, not after: RestoreThread clears this
+                // flag itself when it finishes, and a short restore can beat
+                // us back here and have its `false` overwritten, leaving the
+                // dialog disabled forever.
                 g_restoreRunning.store(true);
                 // On its own thread: a restore walks the whole chain once per
                 // batch and would otherwise freeze the window for as long as it
-                // takes.
-                std::thread(RestoreThread, std::string(g_restoreInput)).detach();
+                // takes. A refused spawn is one restore that does not happen,
+                // not a reason to take the window down with an uncaught
+                // std::system_error -- and the flag has to come back off, or
+                // the dialog sits greyed out reporting a search nobody is
+                // running.
+                try
+                {
+                    std::thread(RestoreThread, std::string(g_restoreInput)).detach();
+                }
+                catch (const std::system_error& e)
+                {
+                    g_restoreRunning.store(false);
+                    std::lock_guard<std::mutex> lock(g_restoreResultMutex);
+                    g_restoreResult = std::string("Could not start the search: ") + e.what();
+                }
             }
         }
         if (fBusy)
@@ -1250,15 +1285,15 @@ static void DrawWalletSafetyDialog()
         if (g_recoveryAudit.fHaveSeed)
         {
             ImGui::Text("Derivation schema: %s", HDKeySchemaName(g_recoveryAudit.nSchema).c_str());
-            ImGui::Text("BIP44 coin type: %u (provisional BITFLASH)", g_recoveryAudit.nCoinType);
+            ImGui::Text("BIP44 coin type: %u (SLIP-0044 BITFLASH)", g_recoveryAudit.nCoinType);
         }
         ImGui::Text("Phrase-backed spendable balance: %s BTF",
                     FmtMoney(g_recoveryAudit.nRecoverableCredit).c_str());
-        ImGui::Text("Wallet.dat-only spendable balance: %s BTF",
+        ImGui::Text("Not phrase-backed spendable balance: %s BTF",
                     FmtMoney(g_recoveryAudit.nLegacyCredit).c_str());
         ImGui::Text("Phrase-backed immature mining rewards: %s BTF",
                     FmtMoney(g_recoveryAudit.nRecoverableImmatureCredit).c_str());
-        ImGui::Text("Wallet.dat-only immature mining rewards: %s BTF",
+        ImGui::Text("Not phrase-backed immature mining rewards: %s BTF",
                     FmtMoney(g_recoveryAudit.nLegacyImmatureCredit).c_str());
         if (!g_recoveryAudit.fDeriveComplete)
         {
@@ -1272,8 +1307,8 @@ static void DrawWalletSafetyDialog()
             ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(1.0f, 0.75f, 0.25f, 1.0f));
             ImGui::TextWrapped(
                 "Some coins are on keys the phrase does not reproduce. "
-                "Keep wallet.dat backups until that balance has been moved to a "
-                "phrase-backed address.");
+                "Keep a file backup of this wallet until that balance has been "
+                "moved to a phrase-backed address.");
             ImGui::PopStyleColor();
         }
         else if (HaveHDSeed() &&
@@ -1369,16 +1404,38 @@ static void DrawDiagnosticsDialog()
     ImGui::End();
 }
 
+static void OpenURL(const char* pszUrl)
+{
+#ifdef _WIN32
+    ShellExecuteA(NULL, "open", pszUrl, NULL, NULL, SW_SHOWNORMAL);
+#else
+    std::string cmd = std::string("xdg-open '") + pszUrl + "' >/dev/null 2>&1 &";
+    int r = system(cmd.c_str());
+    (void)r;
+#endif
+}
+
 static void DrawAboutDialog()
 {
     if (!g_showAbout) return;
-    ImGui::SetNextWindowSize(ImVec2(380.0f, 170.0f), ImGuiCond_Always);
+    ImGui::SetNextWindowSize(ImVec2(380.0f, 205.0f), ImGuiCond_Always);
     ImGui::SetNextWindowPos(ImGui::GetMainViewport()->GetCenter(),
                             ImGuiCond_Always, ImVec2(0.5f, 0.5f));
     if (ImGui::Begin("About Bitflash", &g_showAbout,
         ImGuiWindowFlags_NoResize | ImGuiWindowFlags_NoCollapse))
     {
-        ImGui::TextColored(ImVec4(1.0f, 0.6f, 0.0f, 1.0f), "Bitflash  BTF  v1.1.0");
+        ImGui::TextColored(ImVec4(1.0f, 0.6f, 0.0f, 1.0f),
+                           "Bitflash  BTF  v" BITFLASH_VERSION_STRING);
+        ImGui::Spacing();
+        ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(0.40f, 0.70f, 1.0f, 1.0f));
+        ImGui::TextUnformatted("https://bitflash.network");
+        ImGui::PopStyleColor();
+        if (ImGui::IsItemHovered())
+        {
+            ImGui::SetMouseCursor(ImGuiMouseCursor_Hand);
+            if (ImGui::IsMouseClicked(0))
+                OpenURL("https://bitflash.network");
+        }
         ImGui::Spacing();
         ImGui::TextWrapped(
             "CPU-only cryptocurrency. RandomX proof of work. "
@@ -1391,6 +1448,184 @@ static void DrawAboutDialog()
     ImGui::End();
 }
 
+// First-run offer to move a Berkeley DB wallet to the SQLite backend. Only the
+// button actions touch anything: "Convert" exports wallet.dat to wallet.sqlite
+// and records the backend marker (wallet.dat is left untouched, so a restart
+// picks up SQLite while the old file stays as a fallback); "Keep Berkeley DB"
+// just records that choice so the offer does not return; "Decide later" leaves
+// no marker and asks again next start.
+static bool        g_showBackendWizard = false;
+static std::string g_wizardStatus;
+static bool        g_wizardConverted   = false;
+static int         g_restartArgc       = 0;
+static char**      g_restartArgv       = NULL;
+
+#ifdef _WIN32
+// Quote one argument so CommandLineToArgvW parses it back to exactly this
+// string: only backslashes that immediately precede a double quote (including
+// the closing one) are doubled, so ordinary Windows paths are not mangled.
+static std::string QuoteArgWin(const std::string& a)
+{
+    if (!a.empty() && a.find_first_of(" \t\"") == std::string::npos)
+        return a;
+    std::string r = "\"";
+    size_t bs = 0;
+    for (size_t i = 0; i < a.size(); i++)
+    {
+        if (a[i] == '\\') { bs++; continue; }
+        if (a[i] == '"') { r.append(bs * 2 + 1, '\\'); r += '"'; bs = 0; continue; }
+        r.append(bs, '\\'); bs = 0; r += a[i];
+    }
+    r.append(bs * 2, '\\');
+    r += "\"";
+    return r;
+}
+#endif
+
+// Relaunch Bitflash with the same arguments and datadir, then ask this instance
+// to exit -- but only once the relaunch has actually started, so a failure never
+// leaves the user with no node running. The new instance waits (-restartwait)
+// before it opens the network port and the block index, so this one is gone
+// first and they never fight over the same files.
+static void RestartApplication()
+{
+    bool fLaunched = false;
+#ifdef _WIN32
+    char exePath[MAX_PATH];
+    if (GetModuleFileNameA(NULL, exePath, MAX_PATH) == 0)
+        return;
+    std::string strCmd = QuoteArgWin(exePath);
+    bool fHasDataDir = false;
+    for (int i = 1; i < g_restartArgc; i++)
+    {
+        std::string a = g_restartArgv[i] ? g_restartArgv[i] : "";
+        if (a.find("-datadir=") == 0 || a.find("/datadir=") == 0)
+            fHasDataDir = true;
+        strCmd += " " + QuoteArgWin(a);
+    }
+    if (!fHasDataDir)
+        strCmd += " " + QuoteArgWin("-datadir=" + GetAppDir());
+    strCmd += " -restartwait";
+
+    std::vector<char> cmdBuf(strCmd.begin(), strCmd.end());
+    cmdBuf.push_back('\0');
+    STARTUPINFOA si; memset(&si, 0, sizeof(si)); si.cb = sizeof(si);
+    PROCESS_INFORMATION pi; memset(&pi, 0, sizeof(pi));
+    if (CreateProcessA(NULL, &cmdBuf[0], NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi))
+    {
+        CloseHandle(pi.hProcess);
+        CloseHandle(pi.hThread);
+        fLaunched = true;
+    }
+#else
+    pid_t pid = fork();
+    if (pid == 0)
+    {
+        // Child: wait for the parent to release the port and files, then re-exec.
+        // /proc/self/exe is the reliable absolute path; argv[0] may be relative
+        // or a bare name that execv() cannot resolve.
+        sleep(2);
+        char exePath[4096];
+        ssize_t len = readlink("/proc/self/exe", exePath, sizeof(exePath) - 1);
+        if (len > 0)
+        {
+            exePath[len] = '\0';
+            execv(exePath, g_restartArgv);
+        }
+        if (g_restartArgv)
+            execv(g_restartArgv[0], g_restartArgv);
+        _exit(127);
+    }
+    fLaunched = (pid > 0);
+#endif
+
+    if (fLaunched)
+    {
+        fShutdown = true;
+        if (glfwGetCurrentContext())
+            glfwSetWindowShouldClose(glfwGetCurrentContext(), true);
+    }
+    else
+        g_wizardStatus = "Could not relaunch automatically -- please restart "
+                         "Bitflash yourself to switch to the SQLite wallet.";
+}
+
+static void DrawBackendWizardDialog()
+{
+    if (!g_showBackendWizard) return;
+    ImGui::SetNextWindowSize(ImVec2(560.0f, 0.0f), ImGuiCond_Always);
+    ImGui::SetNextWindowPos(ImGui::GetMainViewport()->GetCenter(),
+                            ImGuiCond_Always, ImVec2(0.5f, 0.5f));
+    if (ImGui::Begin("Wallet Storage", &g_showBackendWizard,
+        ImGuiWindowFlags_NoResize | ImGuiWindowFlags_NoCollapse))
+    {
+        if (g_wizardConverted)
+        {
+            ImGui::TextColored(ImVec4(0.35f, 1.0f, 0.45f, 1.0f), "Converted to SQLite.");
+            ImGui::TextWrapped("%s", g_wizardStatus.c_str());
+            ImGui::Spacing();
+            ImGui::TextWrapped(
+                "The switch takes effect when Bitflash restarts. Until then it is "
+                "still running on the old Berkeley DB wallet. Your wallet.dat is "
+                "kept untouched as a fallback.");
+            ImGui::Spacing();
+            if (ImGui::Button("Restart Now", ImVec2(140.0f, 0.0f)))
+                RestartApplication();
+            ImGui::SameLine();
+            if (ImGui::Button("Later", ImVec2(120.0f, 0.0f)))
+                g_showBackendWizard = false;
+            ImGui::Spacing();
+            ImGui::TextDisabled(
+                "If you keep mining before restarting, new coins go to the old "
+                "wallet until you switch.");
+        }
+        else
+        {
+            ImGui::TextWrapped(
+                "Bitflash can store your wallet in a new SQLite format: a single "
+                "file that is easier to back up and does not depend on the "
+                "database/ directory beside it.");
+            ImGui::Spacing();
+            ImGui::TextWrapped(
+                "Your current Berkeley DB wallet (wallet.dat) is kept exactly as it "
+                "is -- nothing is deleted, and you can go back to it at any time. "
+                "The change takes effect after you restart.");
+            ImGui::Spacing();
+            if (ImGui::Button("Convert to SQLite", ImVec2(180.0f, 0.0f)))
+            {
+                int nCopied = 0;
+                std::string strError;
+                if (DoConvertWalletToSQLite(nCopied, strError))
+                {
+                    g_wizardStatus =
+                        strprintf("%d record(s) copied to wallet.sqlite.", nCopied);
+                    g_wizardConverted = true;
+                }
+                else
+                    g_wizardStatus = "Conversion failed: " + strError;
+            }
+            ImGui::SameLine();
+            if (ImGui::Button("Keep Berkeley DB", ImVec2(160.0f, 0.0f)))
+            {
+                WriteWalletBackendMarker("bdb");
+                g_showBackendWizard = false;
+            }
+            ImGui::SameLine();
+            if (ImGui::Button("Decide later", ImVec2(120.0f, 0.0f)))
+                g_showBackendWizard = false;
+
+            if (!g_wizardStatus.empty())
+            {
+                ImGui::Spacing();
+                ImGui::PushStyleColor(ImGuiCol_Text, ImVec4(1.0f, 0.45f, 0.35f, 1.0f));
+                ImGui::TextWrapped("%s", g_wizardStatus.c_str());
+                ImGui::PopStyleColor();
+            }
+        }
+    }
+    ImGui::End();
+}
+
 // ---------------------------------------------------------------------------
 // Entry point
 // ---------------------------------------------------------------------------
@@ -1457,6 +1692,21 @@ int RunGUI(int argc, char* argv[])
     g_mineRadio = nMineMode;
     strncpy(g_participantPool, strParticipantPool.c_str(), sizeof(g_participantPool)-1);
 
+    // Kept for the wizard's "Restart Now": relaunch with the same command line.
+    g_restartArgc = argc;
+    g_restartArgv = argv;
+
+    // First run on a Berkeley DB wallet with no recorded choice yet: offer to
+    // convert to SQLite. Never when already on SQLite, once wallet.sqlite exists,
+    // or once a choice has been recorded in the backend marker.
+    if (!WalletSQLiteRuntimeActive() &&
+        FileExists((GetAppDir() + "/wallet.dat").c_str()) &&
+        !FileExists((GetAppDir() + "/wallet.sqlite").c_str()) &&
+        ReadWalletBackendMarker().empty())
+    {
+        g_showBackendWizard = true;
+    }
+
     int frame = 0;
     while (!glfwWindowShouldClose(window) && !fShutdown)
     {
@@ -1480,6 +1730,7 @@ int RunGUI(int argc, char* argv[])
         DrawRestorePhraseDialog();
         DrawDiagnosticsDialog();
         DrawAboutDialog();
+        DrawBackendWizardDialog();
         DrawStatusBar();
 
         ImGui::Render();