3 files changed, 31 insertions, 3 deletions

diff --git a/src/main_gui.cpp b/src/main_gui.cpp
index 0b4e091..d0969b5 100644
--- a/src/main_gui.cpp
+++ b/src/main_gui.cpp
@@ -261,8 +261,20 @@ static void ParseStartupArguments(int argc, char* argv[])
     string rvRelay = argval2(argc, argv, "/rvrelay", "-rvrelay");
     if (!rvRelay.empty())
     {
-        vBtfMeetingRelays.clear();
-        vBtfMeetingRelays.push_back(rvRelay);
+        if (!LooksLikeRelay(rvRelay))
+        {
+            // A malformed pin must not replace the seed list: with the pin
+            // set, no discovered relay can ever mask the typo, and the pool
+            // would publish a garbage (or no) meeting node forever.
+            fprintf(stderr, "Ignoring /rvrelay=%s: expected host:port\n",
+                    rvRelay.c_str());
+        }
+        else
+        {
+            vBtfMeetingRelays.clear();
+            vBtfMeetingRelays.push_back(rvRelay);
+            fBtfRelayPinned = true;
+        }
     }
 
     string announceRelay = argval2(argc, argv, "/announcerelay", "-announcerelay");
diff --git a/src/nostr.cpp b/src/nostr.cpp
index 21104bc..6d85bf6 100644
--- a/src/nostr.cpp
+++ b/src/nostr.cpp
@@ -110,6 +110,12 @@ vector<string> vBtfMeetingRelays = {
     "31.44.4.249:8434",     // New Jersey, US
     "90.156.222.107:8434",  // Almaty, KZ
 };
+// True when the operator pinned the relay list with /rvrelay: discovered
+// relays must NOT be merged in (BtfAllRelays), otherwise one accept thread
+// per discovered relay is spawned and each one optimistically overwrites the
+// advertised meeting node (BtfSetActiveRelay) before registering -- a
+// discovered but unreachable relay then flaps the published .btf descriptor.
+bool fBtfRelayPinned = false;
 string strBtfActiveRelay;
 static CCriticalSection cs_activeRelay;
 
@@ -144,7 +150,7 @@ static map<string, BtfPoolAnnouncement> g_discoveredPools;
 static CCriticalSection cs_discoveredPools;
 
 // Basic sanity: "host:port" with a numeric 1..65535 port and a plausible host.
-static bool LooksLikeRelay(const string& r)
+bool LooksLikeRelay(const string& r)
 {
     size_t colon = r.rfind(':');
     if (colon == string::npos || colon == 0 || colon + 1 >= r.size())
@@ -172,6 +178,8 @@ static bool LooksLikeRelay(const string& r)
 vector<string> BtfAllRelays()
 {
     vector<string> all = vBtfMeetingRelays;
+    if (fBtfRelayPinned)
+        return all;
     CRITICAL_BLOCK(cs_discoveredRelays)
         foreach(const string& r, g_discoveredRelays)
             if (find(all.begin(), all.end(), r) == all.end())
diff --git a/src/nostr.h b/src/nostr.h
index b5eb5e3..827b2f3 100644
--- a/src/nostr.h
+++ b/src/nostr.h
@@ -43,6 +43,14 @@ void BtfSetActiveRelay(const std::string& relay);
 // If set (via /announcerelay=host:port), this node announces that relay on
 // Nostr so other nodes discover it automatically -- no manual seed-list edit.
 extern std::string strBtfAnnounceRelay;
+// True when /rvrelay pinned the meeting relay list: BtfAllRelays then returns
+// ONLY vBtfMeetingRelays, never Nostr-discovered volunteer relays. Without
+// this, a pool that pins one public relay still spawns an accept thread per
+// discovered relay, and each thread's optimistic BtfSetActiveRelay makes the
+// published descriptor flap to relays the pool may not be reachable at.
+extern bool fBtfRelayPinned;
+// Basic sanity check on a "host:port" relay address (numeric port 1..65535).
+bool LooksLikeRelay(const std::string& r);
 // Every relay to try: curated seeds + relays discovered from Nostr announcements.
 std::vector<std::string> BtfAllRelays();