wallet: refuse to mint a wallet a headless node never asked for

v1.2.20 makes SQLite the default backend for a datadir that holds no
wallet. On a desktop that is a first run. On a headless node it is usually
a fault -- the datadir is not mounted, or wallet.dat was caught mid-rename
by a backup -- and the new default turns that fault into a silent loss of
custody rather than a loud failure.

The damage is not the empty wallet, it is the marker. Creating the wallet
also writes <datadir>/wallet-backend = sqlite, and every later start reads
that marker first: putting the real wallet.dat back no longer does
anything, because the node stays on the empty SQLite wallet it made.
1.2.19 had the same fail-open on a missing wallet, but it created a
wallet.dat, and restoring the backup over it recovered the funds. That
runbook stops working here.

So refuse when the startup is headless and no wallet of either kind is
present, and say which flag makes it deliberate: /createwallet to start a
new one, or /walletbackend=bdb for the Berkeley DB path. A node that meant
to create a wallet says so; a node that lost its datadir gets an error
instead of a fresh identity and a re-paid ledger.

Upstream keeps the old behaviour; this is a fork divergence, and the
three findings that would gate enabling the SQLite backend at all -- the
non-atomic backend marker, WriteHDMaster's connection-wide transaction,
and the encrypt-swap crash window -- remain open against upstream.

1 files changed, 21 insertions, 5 deletions

diff --git a/src/selftest.cpp b/src/selftest.cpp
index 2ada8f3..c62d70f 100644
--- a/src/selftest.cpp
+++ b/src/selftest.cpp
@@ -2580,7 +2580,11 @@ static int RunWalletBackendDefaultSelfTest()
 
     try
     {
-        // 1. Fresh datadir, no flag -> new wallet.sqlite, marker "sqlite", no wallet.dat.
+        // 1. Fresh datadir, no flag -> this fork refuses, where upstream creates.
+        //    An empty datadir on a headless node is far more often a mount or
+        //    backup fault than a first run, and creating a wallet also pins the
+        //    backend marker, after which restoring the real wallet is a no-op.
+        //    Nothing may be left behind: no wallet of either kind, no marker.
         string d1 = tmp + "/fresh";
         nFail += Check(MakeDirLocal(d1), "fresh scenario dir can be created") ? 0 : 1;
         vector<string> a1;
@@ -2588,19 +2592,31 @@ static int RunWalletBackendDefaultSelfTest()
         a1.push_back("-nomanagedtor");
         a1.push_back("-nogui");
         a1.push_back("-newaddress");
-        int r1 = RunBitflashChild(strExe, a1);
+        int r0 = RunBitflashChild(strExe, a1);
+        nFail += Check(r0 != 0 &&
+                       !FileExists((d1 + "/wallet.sqlite").c_str()) &&
+                       !FileExists((d1 + "/wallet.dat").c_str()) &&
+                       !FileExists((d1 + "/wallet-backend").c_str()),
+                       "a flagless headless start refuses to create a wallet") ? 0 : 1;
+
+        // 1a. -createwallet says it was meant: new wallet.sqlite, marker
+        //     "sqlite", no wallet.dat.
+        vector<string> a1c = a1;
+        a1c.push_back("-createwallet");
+        int r1 = RunBitflashChild(strExe, a1c);
         nFail += Check(r1 == 0 &&
                        FileExists((d1 + "/wallet.sqlite").c_str()) &&
                        !FileExists((d1 + "/wallet.dat").c_str()) &&
                        FileContainsText(d1 + "/wallet-backend", "sqlite"),
-                       "a fresh install starts on SQLite (new default) and records the marker") ? 0 : 1;
+                       "-createwallet starts a fresh install on SQLite and records the marker") ? 0 : 1;
 
-        // 1b. Second run reuses it, still SQLite, still no wallet.dat.
+        // 1b. Second run reuses it without the flag -- the refusal only guards
+        //     creation, so an existing wallet still starts flagless.
         int r1b = RunBitflashChild(strExe, a1);
         nFail += Check(r1b == 0 &&
                        FileExists((d1 + "/wallet.sqlite").c_str()) &&
                        !FileExists((d1 + "/wallet.dat").c_str()),
-                       "the recorded SQLite choice survives a restart") ? 0 : 1;
+                       "the recorded SQLite choice survives a flagless restart") ? 0 : 1;
 
         // 2. Existing wallet.dat, no flag -> stays on Berkeley DB.
         string d2 = tmp + "/existing-bdb";