Bring main onto the line this project actually ships

main had drifted to a history with no ancestor in common with the tree we
build and deploy. It sat at be63e83 (2026-08-09) with 28 commits; the shipped
line, deploy/soak-2026-08-21, had 383. The two shared nothing -- git
merge-base returns no result at all -- so anyone cloning this repository
landed on a default branch that was neither current nor related to the
running node.

The 28 commits on main were audited before this merge: every one is already
present in the tree by content, including the two that are hardest to see
because they were rewritten afterwards -- the payout reorg-safety work
(PayoutBlockStillOnChain, since evolved to re-check on every retry rather
than once at maturity) and the nostr relay certificate verification
(SSL_set1_host, now with a Windows root-store path). Nothing on main is lost
by this merge.

Recorded as a merge rather than a force-push: main only ever moves forward,
its old history stays reachable as the first parent, and this is revertible.
The tree is taken wholesale from the merged branch, so main's content is now
exactly what was built and tested.

What this brings onto main:

- compactblock: BIP152-style compact block relay ported from upstream 1.2.23,
  primitives and unit test only, with the RAND_bytes failure path closed and
  the reconstruction allocation bounded.
- upstream/main 17741d9: isolated testnet parameters and genesis, optional
  2 MB large pages for RandomX. Mainnet genesis verified byte-identical
  through upstream's BuildGenesisBlock() refactor.
- deploy: every image built on bookworm so binaries run on Debian 12, and the
  container build now honours the RandomX and libsecp256k1 pins it had been
  silently ignoring since before 1.2.15.

Gates at this tree: 15/15 selftests, compactblock's 17 checks, consensus
constants unchanged against e4f898c apart from the pre-existing
MAX_BLOCK_SIZE_GEN, mainnet genesis intact, money-log check ok.

1 files changed, 177 insertions, 79 deletions

diff --git a/src/nostr.cpp b/src/nostr.cpp
index 3f43302..f44dc08 100644
--- a/src/nostr.cpp
+++ b/src/nostr.cpp
@@ -7,6 +7,10 @@
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#ifdef _WIN32
+#include <wincrypt.h>
+#endif
 // We link libsecp256k1 statically (without this the header assumes DLL import).
 // Both makefiles also pass -DSECP256K1_STATIC; the guard keeps that from
 // warning while leaving this file correct if built without the flag.
@@ -26,6 +30,7 @@
 
 #include "btfaddr.h"
 #include "btfchan.h"
+#include "proxy.h"
 
 using json = nlohmann::json;
 
@@ -127,6 +132,8 @@ vector<string> vBtfMeetingRelays = {
 bool fBtfRelayPinned = false;
 string strBtfActiveRelay;
 static CCriticalSection cs_activeRelay;
+static string strBtfOnionEndpoint;
+static CCriticalSection cs_onionEndpoint;
 
 // Only the rendezvous we actually registered at (BtfSetActiveRelay, called from
 // ThreadBtfAccept once registration succeeds). Empty until then, on purpose: it
@@ -144,10 +151,43 @@ string BtfActiveRelay()
 
 void BtfSetActiveRelay(const string& relay)
 {
+    // With /rvrelay set, the descriptor must never name anything but the pin.
+    // No caller can reach here with another relay today -- both registration
+    // paths draw their list from BtfAllRelays(), which returns the pin alone --
+    // but the descriptor is the one thing a miner obeys, so the invariant is
+    // enforced at the sink instead of being retrusted to every future caller.
+    if (fBtfRelayPinned &&
+        find(vBtfMeetingRelays.begin(), vBtfMeetingRelays.end(), relay) == vBtfMeetingRelays.end())
+    {
+        LogPrint("pool", "refusing to advertise meeting relay %s: /rvrelay pins %s\n",
+                 relay.c_str(),
+                 vBtfMeetingRelays.empty() ? "an empty list" : vBtfMeetingRelays[0].c_str());
+        return;
+    }
     CRITICAL_BLOCK(cs_activeRelay)
         strBtfActiveRelay = relay;
 }
 
+bool BtfSetLocalOnionEndpoint(const string& endpoint, string& errOut)
+{
+    string norm;
+    if (!btf::NormalizeOnionEndpoint(endpoint, norm))
+    {
+        errOut = "expected v3 onion endpoint HOST.onion:PORT";
+        return false;
+    }
+    CRITICAL_BLOCK(cs_onionEndpoint)
+        strBtfOnionEndpoint = norm;
+    return true;
+}
+
+string BtfLocalOnionEndpoint()
+{
+    CRITICAL_BLOCK(cs_onionEndpoint)
+        return strBtfOnionEndpoint;
+    return "";
+}
+
 // A relay this node advertises on Nostr for others to discover (/announcerelay).
 string strBtfAnnounceRelay;
 // Relays learned from other operators' Nostr announcements.
@@ -196,6 +236,18 @@ vector<string> BtfAllRelays()
     return all;
 }
 
+// Relays learned from Nostr, whether or not a pin is in force. Reporting only:
+// it exists so the pool can name what /rvrelay is excluding. Anything choosing
+// a relay to register or dial at must keep using BtfAllRelays().
+vector<string> BtfDiscoveredRelays()
+{
+    vector<string> out;
+    CRITICAL_BLOCK(cs_discoveredRelays)
+        foreach(const string& r, g_discoveredRelays)
+            out.push_back(r);
+    return out;
+}
+
 
 //
 // Utilities
@@ -387,10 +439,16 @@ std::string BtfLocalDescriptor()
     string meeting;
     CRITICAL_BLOCK(cs_activeRelay)
         meeting = strBtfActiveRelay;
+    string onion = BtfLocalOnionEndpoint();
     if (meeting.empty())
-        return "";
+    {
+        if (onion.empty())
+            return "";
+        meeting = "rendezvous-pending";
+    }
     return btf::SignDescriptor(g_nostrKey.ctx, g_nostrKey.seckey,
-                               g_nostrKey.EncPubHex(), meeting, (uint64_t)GetTime());
+                               g_nostrKey.EncPubHex(), meeting, (uint64_t)GetTime(),
+                               onion);
 }
 
 // The shared secp256k1 context, so net.cpp can verify descriptors that arrive
@@ -468,6 +526,41 @@ static bool BuildSignedEvent(CNostrKey& key, int kind, const json& tags,
 static const uint64 MAX_WS_FRAME   = 1 << 20;  // 1 MiB per frame
 static const uint64 MAX_WS_MESSAGE = 4 << 20;  // 4 MiB reassembled
 
+static int BtfConnectedNodeCount()
+{
+    int nNodes = 0;
+    CRITICAL_BLOCK(cs_vNodes)
+    {
+        nNodes = (int)vNodes.size();
+    }
+    return nNodes;
+}
+
+#ifdef _WIN32
+static bool BtfLoadWindowsRootCertificates(SSL_CTX* sslctx)
+{
+    HCERTSTORE hStore = CertOpenSystemStoreA(0, "ROOT");
+    if (!hStore)
+        return false;
+
+    bool fLoaded = false;
+    X509_STORE* x509store = SSL_CTX_get_cert_store(sslctx);
+    PCCERT_CONTEXT pCert = NULL;
+    while ((pCert = CertEnumCertificatesInStore(hStore, pCert)) != NULL)
+    {
+        const unsigned char* p = pCert->pbCertEncoded;
+        X509* x509 = d2i_X509(NULL, &p, pCert->cbCertEncoded);
+        if (!x509)
+            continue;
+        if (X509_STORE_add_cert(x509store, x509) == 1)
+            fLoaded = true;
+        X509_free(x509);
+    }
+    CertCloseStore(hStore, 0);
+    return fLoaded;
+}
+#endif
+
 class CWebSocket
 {
 public:
@@ -523,53 +616,8 @@ public:
         size_t colon = host.find(':');
         if (colon != string::npos) { port = atoi(host.substr(colon + 1).c_str()); host = host.substr(0, colon); }
 
-        // Resolve and connect (TCP). AF_UNSPEC so we get both A and AAAA
-        // records back and try them in the order the resolver prefers,
-        // rather than hard-failing whenever the IPv4 path to a relay is
-        // filtered/rate-limited (increasingly common for CDN-fronted
-        // relays) while a working IPv6 route exists right there in the
-        // same getaddrinfo() result.
-        struct addrinfo hints, *res = NULL, *rp = NULL;
-        memset(&hints, 0, sizeof(hints));
-        hints.ai_family = AF_UNSPEC;
-        hints.ai_socktype = SOCK_STREAM;
-        char portstr[16]; sprintf(portstr, "%d", port);
-        if (getaddrinfo(host.c_str(), portstr, &hints, &res) != 0 || !res)
-            return error("Nostr: getaddrinfo %s failed", host.c_str());
-
-        bool fConnected = false;
-        for (rp = res; rp != NULL; rp = rp->ai_next)
-        {
-            hSocket = BtfSocketTag(socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol), SOCK_NOSTR);
-            if (hSocket == INVALID_SOCKET)
-                continue;
-
-            // Socket receive/send timeout: Windows takes a DWORD of
-            // milliseconds; POSIX takes a struct timeval.
-#ifdef _WIN32
-            DWORD tv = timeoutSec * 1000;
-            setsockopt(hSocket, SOL_SOCKET, SO_RCVTIMEO, (char*)&tv, sizeof(tv));
-            setsockopt(hSocket, SOL_SOCKET, SO_SNDTIMEO, (char*)&tv, sizeof(tv));
-#else
-            struct timeval tv;
-            tv.tv_sec = timeoutSec;
-            tv.tv_usec = 0;
-            setsockopt(hSocket, SOL_SOCKET, SO_RCVTIMEO, (char*)&tv, sizeof(tv));
-            setsockopt(hSocket, SOL_SOCKET, SO_SNDTIMEO, (char*)&tv, sizeof(tv));
-#endif
-
-            if (connect(hSocket, rp->ai_addr, (int)rp->ai_addrlen) == 0)
-            {
-                fConnected = true;
-                break;
-            }
-
-            BtfCloseSocket(hSocket);
-            hSocket = INVALID_SOCKET;
-        }
-        freeaddrinfo(res);
-
-        if (!fConnected)
+        hSocket = BtfConnectSocket(host, (unsigned short)port, SOCK_NOSTR, timeoutSec);
+        if (hSocket == INVALID_SOCKET)
             return error("Nostr: connect %s:%d failed", host.c_str(), port);
 
         // TLS
@@ -585,22 +633,35 @@ public:
             // so a MITM cannot forge them, but it could drop the rendezvous
             // registration (leaving the pool unreachable to miners) or answer
             // subscriptions with whatever it liked.
-            if (!SSL_CTX_set_default_verify_paths(sslctx))
-                return error("Nostr: no system CA store available, refusing %s", host.c_str());
             SSL_CTX_set_verify(sslctx, SSL_VERIFY_PEER, NULL);
+
+            // OpenSSL's default verify paths are usually empty on Windows, so
+            // the system ROOT store is loaded too -- without it verification
+            // fails closed there and every relay becomes unreachable.
+            bool fTrustLoaded = (SSL_CTX_set_default_verify_paths(sslctx) == 1);
+#ifdef _WIN32
+            fTrustLoaded = BtfLoadWindowsRootCertificates(sslctx) || fTrustLoaded;
+#endif
+            if (!fTrustLoaded)
+                return error("Nostr: failed to load TLS trust store");
+
+            // Floor the protocol version. Verification says who the peer is,
+            // not how weak a cipher suite we will agree to; without this a
+            // relay offering nothing better still gets TLS 1.0.
             SSL_CTX_set_min_proto_version(sslctx, TLS1_2_VERSION);
 
             ssl = SSL_new(sslctx);
             if (!ssl) return false;
             SSL_set_fd(ssl, (int)hSocket);
-            SSL_set_tlsext_host_name(ssl, host.c_str());  // SNI
+            if (SSL_set_tlsext_host_name(ssl, host.c_str()) != 1)  // SNI
+                return error("Nostr: failed to set TLS SNI for %s", host.c_str());
 
             // Verifying the chain is not enough on its own: without this the
             // relay could present any certificate a trusted CA ever issued,
             // for any name. SSL_set1_host binds the check to the host we asked
             // for.
-            if (!SSL_set1_host(ssl, host.c_str()))
-                return error("Nostr: cannot pin verification to %s", host.c_str());
+            if (SSL_set1_host(ssl, host.c_str()) != 1)
+                return error("Nostr: failed to set TLS hostname for %s", host.c_str());
 
             if (SSL_connect(ssl) != 1)
             {
@@ -846,17 +907,21 @@ static void PublishDescriptor(CWebSocket& ws, CNostrKey& key)
     // meeting_node is the rendezvous relay this node's hidden service
     // (ThreadBtfAccept in net.cpp) is registered at -- where clients dial us.
     string meeting_node = BtfActiveRelay();
+    string onion = BtfLocalOnionEndpoint();
     if (meeting_node.empty())
     {
-        // Not registered anywhere yet. Publishing now would advertise a meeting
-        // node we can't be reached at, and peers would waste dials on it. The
-        // ThreadNostrSeed loop republishes on every pass, so skipping costs
-        // nothing but the delay until ThreadBtfAccept registers.
-        LogPrint("nostr", "Nostr: skipping descriptor publish, no rendezvous registered yet\n");
-        return;
+        if (onion.empty())
+        {
+            // Not registered anywhere yet, and no direct onion endpoint exists.
+            // Publishing now would advertise a meeting node we can't be reached at.
+            LogPrint("nostr", "Nostr: skipping descriptor publish, no rendezvous registered yet\n");
+            return;
+        }
+        meeting_node = "rendezvous-pending";
     }
     string desc = btf::SignDescriptor(key.ctx, key.seckey, key.EncPubHex(),
-                                      meeting_node, (uint64_t)GetTime());
+                                      meeting_node, (uint64_t)GetTime(),
+                                      onion);
     if (desc.empty())
         return;
     json tags = json::array({ json::array({ "d", BTF_DESC_DTAG }) });
@@ -1062,7 +1127,8 @@ static void HandlePoolAnnouncement(const json& ev)
 // this socket for reuse, and only a completed exchange leaves it in a state
 // the next caller can trust.
 static bool ResolveDescriptor(CWebSocket& ws, void* ctx, const string& btfAddr,
-                              btf::Descriptor& out, bool& fExchangeOk)
+                              btf::Descriptor& out, bool& fExchangeOk,
+                              string* rawOut = NULL)
 {
     fExchangeOk = false;
     unsigned char pk[32];
@@ -1071,6 +1137,7 @@ static bool ResolveDescriptor(CWebSocket& ws, void* ctx, const string& btfAddr,
     json filter = json::object();
     filter["authors"] = json::array({ HexEncode(pk, 32) });
     filter["kinds"]   = json::array({ BTF_DESC_KIND });
+    filter["#d"]      = json::array({ BTF_DESC_DTAG });
     filter["limit"]   = 1;
     json req = json::array({ "REQ", "btf-resolve", filter });
     if (!ws.SendText(req.dump()))
@@ -1097,7 +1164,11 @@ static bool ResolveDescriptor(CWebSocket& ws, void* ctx, const string& btfAddr,
             const json& ev = j[2];
             if (!fFound && ev.contains("content") &&
                 btf::VerifyDescriptor(ctx, ev["content"].get<string>(), pk, out))
+            {
                 fFound = true;
+                if (rawOut)
+                    *rawOut = ev["content"].get<string>();
+            }
             // Deliberately keep reading to EOSE rather than returning here.
             // Returning early leaves the rest of the relay's answer queued on a
             // socket that goes straight back into the pool, and the next caller
@@ -1117,8 +1188,10 @@ static bool ResolveDescriptor(CWebSocket& ws, void* ctx, const string& btfAddr,
 // public discovery relays for the owner's self-certified descriptor. Used by
 // ConnectNodeBtf in net.cpp.
 bool BtfResolve(const std::string& btfAddr, std::string& meetingHostPort,
-                unsigned char enc_pub[32])
+                unsigned char enc_pub[32], std::string* onionHostPort)
 {
+    if (onionHostPort)
+        onionHostPort->clear();
     if (!EnsureNostrKey())
         return false;
     for (int i = 0; i < nNostrRelays && !fShutdown; i++)
@@ -1146,10 +1219,15 @@ bool BtfResolve(const std::string& btfAddr, std::string& meetingHostPort,
             }
             lease.fOk = fExchangeOk;
             if (d.meeting_node.empty() || d.meeting_node == "rendezvous-pending")
-                continue; // descriptor predates the owner's relay config
+            {
+                if (!onionHostPort || d.onion.empty())
+                    continue; // caller needs rendezvous, or descriptor has no direct path
+            }
             if (!HexDecode(d.enc, enc_pub, 32))
                 continue;
             meetingHostPort = d.meeting_node;
+            if (onionHostPort)
+                *onionHostPort = d.onion;
             return true;
         }
         CATCH_PRINT_EXCEPTION("BtfResolve")
@@ -1207,6 +1285,7 @@ bool BtfResolveMany(const std::vector<std::string>& btfAddrs,
             json filter = json::object();
             filter["authors"] = authors;
             filter["kinds"]   = json::array({ BTF_DESC_KIND });
+            filter["#d"]      = json::array({ BTF_DESC_DTAG });
             filter["limit"]   = (int)authors.size();
             json req = json::array({ "REQ", "btf-resolve-many", filter });
             if (!ws.SendText(req.dump()))
@@ -1237,12 +1316,15 @@ bool BtfResolveMany(const std::vector<std::string>& btfAddrs,
                     btf::Descriptor d;
                     if (!btf::VerifyDescriptor(g_nostrKey.ctx, ev["content"].get<string>(), pk, d))
                         continue;
-                    if (d.meeting_node.empty() || d.meeting_node == "rendezvous-pending")
+                    if ((d.meeting_node.empty() || d.meeting_node == "rendezvous-pending") &&
+                        d.onion.empty())
                         continue;
                     BtfResolvedPeer rp;
                     if (!HexDecode(d.enc, rp.enc_pub, 32))
                         continue;
                     rp.meetingHostPort = d.meeting_node;
+                    rp.onionHostPort = d.onion;
+                    rp.descriptor = ev["content"].get<string>();
                     out[ai->second] = rp;
                     pending.erase(ai->second);
                 }
@@ -1383,7 +1465,7 @@ static bool SeedFromRelay(CNostrKey& key, const string& relay)
                         else if (createdAt > it->second)  it->second = createdAt; // refresh
                     }
                     if (fNew && fDebug)
-                        LogPrint("nostr", "Nostr: discovered .btf peer %s\n", peerAddr.c_str());
+                        LogPrint("nostrdiscovery", "Nostr: discovered .btf peer %s\n", peerAddr.c_str());
                     if (++nPeers > 500) break;
                 }
                 else if (type == "EOSE")
@@ -1617,8 +1699,9 @@ static void ConnectDiscoveredBtfPeers()
     // plus a random sample, not one or the other.
     int64 now = GetTime();
     int nBudget = (int)BTF_DIALS_PER_PASS;
+    int nNodeCount = BtfConnectedNodeCount();
     {
-        int nRoom = (int)BTF_TARGET_CONN - (int)vNodes.size();
+        int nRoom = (int)BTF_TARGET_CONN - nNodeCount;
         if (nRoom < nBudget) nBudget = nRoom;
     }
     if (nBudget < 0) nBudget = 0;
@@ -1632,7 +1715,6 @@ static void ConnectDiscoveredBtfPeers()
         // Reliability slice: walk the tiered (good -> untried -> bad) order.
         for (const string& addr : peers)
         {
-            if ((int)vNodes.size() >= (int)BTF_TARGET_CONN) break;
             if ((int)candidates.size() >= nSortedSlots) break;
             map<string, int64>::iterator bi = g_btfPeerBackoff.find(addr);
             if (bi != g_btfPeerBackoff.end() && now < bi->second)
@@ -1657,7 +1739,7 @@ static void ConnectDiscoveredBtfPeers()
         int nWant = min(nRandomSlots, (int)pool.size());
         for (int i = 0; i < nWant; i++)
         {
-            if ((int)vNodes.size() + (int)candidates.size() >= (int)BTF_TARGET_CONN) break;
+            if (nNodeCount + (int)candidates.size() >= (int)BTF_TARGET_CONN) break;
             if ((int)candidates.size() >= nBudget) break;
             size_t j = i + (size_t)GetRand((uint64)(pool.size() - i));
             std::swap(pool[i], pool[j]);
@@ -1712,20 +1794,20 @@ static void ConnectDiscoveredBtfPeers()
     // not the shared Nostr relays, so there's no thundering-herd effect here.
     // Each thread writes its result back via shared state guarded by cs_btfPeerState.
     struct DialCtx { string addr; BtfResolvedPeer rp; };
-    vector<DialCtx*> ctxs;
     for (const string& addr : toDial)
     {
         DialCtx* ctx = new DialCtx{addr, resolved[addr]};
-        ctxs.push_back(ctx);
-        _beginthread([](void* arg) {
+        uintptr_t tid = _beginthread([](void* arg) {
             DialCtx* ctx = (DialCtx*)arg;
             string addr = ctx->addr;
             string meeting = ctx->rp.meetingHostPort;
+            string onion = ctx->rp.onionHostPort;
+            string desc = ctx->rp.descriptor;
             unsigned char enc_pub[32];
             memcpy(enc_pub, ctx->rp.enc_pub, 32);
             delete ctx;
 
-            CNode* pnode = ConnectNodeBtfResolved(addr, meeting, enc_pub);
+            CNode* pnode = ConnectNodeBtfResolved(addr, meeting, onion, enc_pub, desc);
             CRITICAL_BLOCK(cs_btfPeerState)
             {
                 if (pnode)
@@ -1750,6 +1832,21 @@ static void ConnectDiscoveredBtfPeers()
                 }
             }
         }, 0, ctx);
+        if (tid == (uintptr_t)-1)
+        {
+            LogPrint("nostr", "Nostr: failed to create .btf dial thread for %s\n", addr.c_str());
+            CRITICAL_BLOCK(cs_btfPeerState)
+            {
+                int n = ++g_btfPeerFails[addr];
+                int64 cap = (n >= BTF_CHRONIC_FAIL_THRESHOLD) ? BTF_BACKOFF_CAP_SECS_DEAD
+                                                               : BTF_BACKOFF_CAP_SECS;
+                int64 secs = 30;
+                for (int k = 1; k < n && secs < cap; k++) secs *= 2;
+                if (secs > cap) secs = cap;
+                g_btfPeerBackoff[addr] = GetTime() + secs;
+            }
+            delete ctx;
+        }
     }
 
     // Wait long enough for all parallel dials to finish (each has a 10s socket
@@ -1772,11 +1869,12 @@ void ThreadNostrSeed(void* parg)
     LogPrint("nostr", "Nostr: node pubkey = %s\n", key.PubKeyHex().c_str());
     LogPrint("nostr", "Nostr: node .btf address = %s\n", key.BtfAddress().c_str());
 
-    // The self-test below publishes a real descriptor, and PublishDescriptor now
-    // refuses to publish before ThreadBtfAccept has registered a rendezvous. Give
-    // registration a bounded head start so the test measures the publish/resolve
-    // chain instead of losing the race against it.
-    for (int i = 0; i < 60 && !fShutdown && BtfActiveRelay().empty(); i++)
+    // The self-test below publishes a real descriptor. Rendezvous-only nodes
+    // need ThreadBtfAccept to register first; Tor nodes can publish as soon as
+    // their signed onion endpoint exists, with rendezvous marked pending.
+    for (int i = 0; i < 60 && !fShutdown &&
+                    BtfActiveRelay().empty() &&
+                    BtfLocalOnionEndpoint().empty(); i++)
         Sleep(1000);
 
     // One-time self-test of the rendezvous: publish our descriptor to a relay,
@@ -1852,7 +1950,7 @@ void ThreadNostrSeed(void* parg)
 
         // Re-discover periodically. Sleep less aggressively when
         // we have no connections yet so we find peers faster on startup.
-        int nSleepSecs = vNodes.empty() ? 20 : 60;
+        int nSleepSecs = (BtfConnectedNodeCount() == 0) ? 20 : 60;
         for (int i = 0; i < nSleepSecs && !fShutdown; i++)
             Sleep(1000);
     }