Bring main onto the line this project actually ships

main had drifted to a history with no ancestor in common with the tree we
build and deploy. It sat at be63e83 (2026-08-09) with 28 commits; the shipped
line, deploy/soak-2026-08-21, had 383. The two shared nothing -- git
merge-base returns no result at all -- so anyone cloning this repository
landed on a default branch that was neither current nor related to the
running node.

The 28 commits on main were audited before this merge: every one is already
present in the tree by content, including the two that are hardest to see
because they were rewritten afterwards -- the payout reorg-safety work
(PayoutBlockStillOnChain, since evolved to re-check on every retry rather
than once at maturity) and the nostr relay certificate verification
(SSL_set1_host, now with a Windows root-store path). Nothing on main is lost
by this merge.

Recorded as a merge rather than a force-push: main only ever moves forward,
its old history stays reachable as the first parent, and this is revertible.
The tree is taken wholesale from the merged branch, so main's content is now
exactly what was built and tested.

What this brings onto main:

- compactblock: BIP152-style compact block relay ported from upstream 1.2.23,
  primitives and unit test only, with the RAND_bytes failure path closed and
  the reconstruction allocation bounded.
- upstream/main 17741d9: isolated testnet parameters and genesis, optional
  2 MB large pages for RandomX. Mainnet genesis verified byte-identical
  through upstream's BuildGenesisBlock() refactor.
- deploy: every image built on bookworm so binaries run on Debian 12, and the
  container build now honours the RandomX and libsecp256k1 pins it had been
  silently ignoring since before 1.2.15.

Gates at this tree: 15/15 selftests, compactblock's 17 checks, consensus
constants unchanged against e4f898c apart from the pre-existing
MAX_BLOCK_SIZE_GEN, mainnet genesis intact, money-log check ok.

1 files changed, 133 insertions, 0 deletions

diff --git a/src/test_compactblock.cpp b/src/test_compactblock.cpp
new file mode 100644
index 0000000..f4b5583
--- /dev/null
+++ b/src/test_compactblock.cpp
@@ -0,0 +1,133 @@
+// Standalone test of compactblock.cpp's core logic: build a compact block,
+// reconstruct it from a simulated mempool, including the missing-tx path.
+// Not wired into the P2P layer -- proves BuildCompactBlock/
+// TryReconstructBlock/FillMissingAndFinish are correct in isolation.
+
+#include "headers.h"
+#include "compactblock.h"
+#include <cstdio>
+#include <cassert>
+
+// main.cpp defines this; we're not linking main.cpp, so define it here.
+map<uint256, CTransaction> mapTransactions;
+string GetAppDir() { return "."; } // util.h's debug-log path helper needs this
+
+static int g_fail = 0;
+#define CHECK(cond, msg) do { \
+    if (cond) printf("  ok   %s\n", msg); \
+    else { printf("  FAIL %s\n", msg); g_fail++; } \
+} while (0)
+
+// Build a syntactically-valid-enough CTransaction that GetHash()s uniquely
+// per `nSeed` -- doesn't need to be consensus-valid, this test only
+// exercises short-ID computation and reconstruction, not script validation.
+static CTransaction MakeTx(int nSeed)
+{
+    CTransaction tx;
+    tx.nVersion = 1;
+    tx.nLockTime = nSeed; // cheapest way to make each tx's serialization (and hash) unique
+    return tx;
+}
+
+int main()
+{
+    // Build a block: coinbase + 20 regular transactions.
+    CBlock block;
+    block.nVersion = 1;
+    block.hashPrevBlock = uint256("0x00000000000000000000000000000000000000000000000000000000000abc");
+    block.nTime = 1234567890;
+    block.nBits = 0x1f0fffff;
+    block.nNonce = 42;
+    block.vtx.push_back(MakeTx(0)); // coinbase
+    for (int i = 1; i <= 20; i++)
+        block.vtx.push_back(MakeTx(i));
+    block.hashMerkleRoot = block.BuildMerkleTree();
+
+    printf("build_and_reconstruct_full_mempool\n");
+    {
+        CCmpctBlock cmpct;
+        CHECK(BuildCompactBlock(block, cmpct), "BuildCompactBlock succeeds");
+        CHECK(cmpct.vPrefilledIndex.size() == 1 && cmpct.vPrefilledIndex[0] == 0, "only the coinbase is prefilled");
+        CHECK(cmpct.vShortTxId.size() == 20, "one short ID per remaining tx");
+
+        // Simulate a peer with every transaction already in its mempool.
+        mapTransactions.clear();
+        for (size_t i = 1; i < block.vtx.size(); i++)
+            mapTransactions[block.vtx[i].GetHash()] = block.vtx[i];
+
+        CBlock rebuilt;
+        vector<unsigned int> vMissing;
+        CHECK(TryReconstructBlock(cmpct, rebuilt, vMissing), "fully reconstructs when mempool has everything");
+        CHECK(vMissing.empty(), "nothing reported missing");
+        CHECK(rebuilt.GetHash() == block.GetHash(), "reconstructed block hash matches original exactly");
+        CHECK(rebuilt.vtx.size() == block.vtx.size(), "same transaction count");
+        bool fAllMatch = true;
+        for (size_t i = 0; i < block.vtx.size(); i++)
+            if (rebuilt.vtx[i].GetHash() != block.vtx[i].GetHash()) fAllMatch = false;
+        CHECK(fAllMatch, "every transaction in the right position");
+    }
+
+    printf("partial_mempool_then_getblocktxn_completes_it\n");
+    {
+        CCmpctBlock cmpct;
+        BuildCompactBlock(block, cmpct);
+
+        // Simulate a peer missing 3 of the 20 non-coinbase transactions.
+        mapTransactions.clear();
+        vector<unsigned int> expectMissing;
+        for (size_t i = 1; i < block.vtx.size(); i++)
+        {
+            if (i == 5 || i == 12 || i == 19) { expectMissing.push_back((unsigned int)i); continue; }
+            mapTransactions[block.vtx[i].GetHash()] = block.vtx[i];
+        }
+
+        CBlock rebuilt;
+        vector<unsigned int> vMissing;
+        CHECK(!TryReconstructBlock(cmpct, rebuilt, vMissing), "reports incomplete when mempool is missing some tx");
+        CHECK(vMissing == expectMissing, "missing indices are exactly the ones not in mempool");
+
+        // Simulate the getblocktxn round trip: peer sends back the missing txs.
+        vector<CTransaction> vTxn;
+        foreach(unsigned int idx, vMissing)
+            vTxn.push_back(block.vtx[idx]);
+
+        CHECK(FillMissingAndFinish(rebuilt, vMissing, vTxn), "FillMissingAndFinish succeeds with matching response");
+        CHECK(rebuilt.GetHash() == block.GetHash(), "block hash matches after filling in the missing tx");
+    }
+
+    printf("mismatched_blocktxn_response_rejected\n");
+    {
+        CCmpctBlock cmpct;
+        BuildCompactBlock(block, cmpct);
+        mapTransactions.clear();
+        mapTransactions[block.vtx[1].GetHash()] = block.vtx[1]; // only one in mempool
+
+        CBlock rebuilt;
+        vector<unsigned int> vMissing;
+        TryReconstructBlock(cmpct, rebuilt, vMissing);
+        CHECK(vMissing.size() == 19, "19 missing when mempool has only 1 of 20");
+
+        vector<CTransaction> vWrongCount;
+        vWrongCount.push_back(block.vtx[2]); // way fewer than vMissing.size()
+        CHECK(!FillMissingAndFinish(rebuilt, vMissing, vWrongCount), "rejects a response with the wrong tx count");
+    }
+
+    printf("different_blocks_give_different_short_ids_for_same_tx\n");
+    {
+        // Same transaction, two different (simulated) blocks -- short IDs
+        // must differ, since they're keyed per-block (hashPrevBlock +
+        // fresh nonce each time), not just derived from the txid alone.
+        CTransaction tx = MakeTx(99);
+        uint256 prevA = uint256("0x1111111111111111111111111111111111111111111111111111111111111111");
+        uint256 prevB = uint256("0x2222222222222222222222222222222222222222222222222222222222222222");
+        uint64 id1 = ComputeShortTxId(prevA, 0xAAAABBBBCCCCDDDDULL, tx.GetHash());
+        uint64 id2 = ComputeShortTxId(prevB, 0xAAAABBBBCCCCDDDDULL, tx.GetHash());
+        uint64 id3 = ComputeShortTxId(prevA, 0x1111222233334444ULL, tx.GetHash());
+        CHECK(id1 != id2, "different hashPrevBlock -> different short ID");
+        CHECK(id1 != id3, "different nonce -> different short ID");
+        CHECK(id1 <= 0xFFFFFFFFFFFFULL, "short ID fits in 48 bits");
+    }
+
+    printf("\n%s (%d failures)\n", g_fail == 0 ? "ALL TESTS PASSED" : "TESTS FAILED", g_fail);
+    return g_fail == 0 ? 0 : 1;
+}