pool: refuse jobs when no peer has reported a height for 20 minutes

The peer-height gate replaced a tip-age check that was wrong in both
directions. It is a strict improvement and it is still blind in the one
case that matters most.

When the node goes deaf -- peers still in vNodes, nothing arriving -- no
peer announces anything, GetPeerMedianHeight() returns -1, and the
fallback mines our best chain. That fallback is right for a node that has
not been told yet and wrong for a node that has stopped being able to
hear, and a height nobody sent cannot tell those apart. A wedged node is
exactly a node with no peer height information, so the gate was silent
for the whole of heights 3966-4085: 120 blocks, 5890.50 BTF voided.

Time can tell them apart. GetPeerHeightAgeSecs() measures how long since
any peer reported a height, counting from first use rather than the epoch
so a starting node does not refuse jobs before its first handshake. Past
20 minutes the pool stops issuing jobs and says so unconditionally in the
log. /poolmineblind overrides it: without an escape hatch a genuinely
isolated pool that is 90% of the hashrate could never restart its own
chain, which is the deadlock the tip-age check used to cause.

Also stop nStartingHeight from going stale. It was a snapshot taken once
during the version handshake and never touched again, so on a long-lived
connection the median is built from heights the peers had hours ago, and
the behind-the-network check drifts toward 'everyone is behind us' and
quietly stops firing. A peer that hands us a block is demonstrably at
least at that block's height.

(cherry picked from commit 0800c18faf703b4acde1b131d0b742d37a86d92b)

1 files changed, 15 insertions, 0 deletions

diff --git a/src/main.cpp b/src/main.cpp
index 382a008..5d0b70a 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -88,6 +88,7 @@ string strSetDataDir;
 int nDropMessagesTest = 0;
 bool fSoloMineTest = false; // /solomine: mine without requiring a peer (local test)
 bool fPoolNoAnnounce = false; // /noannounce: operator serves miners but never publishes pool announcements
+bool fPoolMineBlind = false; // /poolmineblind: issue jobs even when no peer has reported a height
 
 // Settings
 int fGenerateBitcoins;
@@ -3172,7 +3173,21 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
         pfrom->AddInventoryKnown(inv);
 
         if (ProcessBlock(pfrom, pblock.release()))
+        {
             mapAlreadyAskedFor.erase(inv);
+
+            // A peer that just handed us a block is demonstrably at least at
+            // that block's height. Without this, nStartingHeight is a snapshot
+            // taken once during the version handshake and never touched again,
+            // so on a long-lived connection it is the peer's height from
+            // however many hours ago it happened to connect. The pool's
+            // behind-the-network check compares against the median of those
+            // numbers, so as connections age it drifts toward "everyone is
+            // behind us" and quietly stops firing -- the opposite of its job.
+            map<uint256, CBlockIndex*>::iterator mi = mapBlockIndex.find(inv.hash);
+            if (mi != mapBlockIndex.end() && mi->second)
+                pfrom->nStartingHeight = max(pfrom->nStartingHeight, mi->second->nHeight);
+        }
     }