Merge upstream v1.2.20 into the fork

Merges upstream tag v1.2.20 (6aa3dade) into our 1.2.19+sec tree. The merge
base is bc3de30's descendant 9e39a50 -- upstream's own v1.2.19 -- so this is
an ordinary three-way merge, not a replay. Five conflict blocks in four
files, all resolved below.

No consensus change. CheckBlock, ConnectBlock, DisconnectBlock, ConnectInputs,
AcceptBlock, AcceptTransaction, GetNextWorkRequired and GetBlockValue hash
identical to v1.2.19; script.cpp and script.h are byte-identical on both
sides. main.cpp is +3 lines and main.h +2, all wallet-backend plumbing.
rpc.cpp is untouched, so the payout ledger arrives unchanged.

Makefile, VERSION. OURS, renumbered. 1.2.20+sec, for the same reason 1.2.19
carried +sec: this tree is not the upstream release of that number and the
string names every release artifact.

Makefile, AppImage recipe. OURS for the AppDir path, THEIRS for the bundled
library. Upstream's hunk reverts the icon paths to a hardcoded
/tmp/bitflash.AppDir, which is the local-user pre-placement hazard the fork
moved out of /tmp in the first place; taking their side wholesale would have
reintroduced it silently, inside a conflict about something else. The AppDir
stays $(APPDIR), and libsqlite3.so.0 joins the bundled list, which the new
backend genuinely needs.

src/Makefile, src/makefile.mingw, HEADERS. BOTH. Ours drops market.h,
theirs adds wallet_sqlite.h; the resolution does both. NODE_OBJS auto-merged
correctly in both files -- obj/wallet_sqlite.o present, obj/market.o still
gone -- and was verified rather than assumed, because that line has trapped
this fork before.

src/selftest.cpp, known-tests list. BOTH, union. Upstream adds eight
wallet-storage tests, we keep payout-ledger. The dispatch chain itself
auto-merged and still routes payout-ledger to RunPayoutLedgerSelfTest.

Hardening verified intact after merge: the TLS 1.2 floor in nostr.cpp, the
/rvrelay pin, opt-in managed Tor, strict sig3-on-onion descriptor
verification, and the marketplace removal. Upstream shipped no build logs or
__pycache__ this time; the three added files are docs/storage.md and
src/wallet_sqlite.{cpp,h}.

The SQLite backend this release introduces is NOT enabled here. An existing
wallet.dat resolves to Berkeley DB on every branch of the new selection
logic, and the conversion wizard is GUI-only and not compiled into the
headless node. The review findings that gate ever turning it on -- the
non-atomic backend marker, the connection-wide WriteHDMaster transaction,
and the encrypt-swap crash window -- are recorded on the tracker, not fixed
here.

1 files changed, 34 insertions, 0 deletions

diff --git a/src/walletcmd.h b/src/walletcmd.h
index 007b8b5..7013d44 100644
--- a/src/walletcmd.h
+++ b/src/walletcmd.h
@@ -62,6 +62,40 @@ int CmdShowDerived(int nCount);
 // by the installed recovery phrase or still depends on wallet.dat-only keys.
 int CmdRecoveryAudit();
 
+// Diagnostic: count wallet.dat record types without printing keys,
+// addresses, transaction ids, labels, or other wallet values.
+int CmdWalletStorageAudit(const std::string& strJsonOut = "");
+
+// Diagnostic: fail closed when wallet.dat contains an internally inconsistent
+// or migration-unsafe mix of storage records.
+int CmdWalletStorageCheck();
+
+// Copy every raw wallet.dat record into a SQLite key/value store, preserving
+// serialized bytes. A migration/scripting tool; it does not change which backend
+// the runtime wallet opens.
+int CmdWalletSQLiteExport(const std::string& strDest);
+
+// Export the currently-loaded wallet to a SQLite file (shared by the command
+// above and the GUI wizard). Returns false with an error on any failure.
+bool ExportActiveWalletToSQLite(const std::string& strDest, int& nCopiedRet,
+                                std::string& strErrorRet);
+
+// Convert the running Berkeley DB wallet to SQLite and record the backend
+// marker so the next start opens it. wallet.dat is left untouched as fallback.
+bool DoConvertWalletToSQLite(int& nCopiedRet, std::string& strErrorRet);
+
+// Diagnostic/migration staging: compare a SQLite wallet export with the current
+// wallet.dat raw records. Prints counts only, never record keys or values.
+int CmdWalletSQLiteVerify(const std::string& strPath);
+
+// Diagnostic/migration staging: rebuild wallet.dat from a SQLite export in an
+// empty data directory. Refuses to overwrite an existing wallet.dat.
+int CmdWalletSQLiteRestore(const std::string& strPath);
+
+// Diagnostic/migration staging: parse a SQLite wallet export as the runtime
+// wallet loader would. Prints counts only, never record keys or values.
+int CmdWalletSQLiteLoadCheck(const std::string& strPath);
+
 // Rewrite wallet.dat so private keys and the HD seed are encrypted with the
 // given passphrase. Returns 0 on success and exits without starting the node.
 int CmdEncryptWallet(const std::string& strPassphrase);