1 files changed, 1033 insertions, 144 deletions

diff --git a/src/main.cpp b/src/main.cpp
index 5d266ff..0fa6b89 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -14,6 +14,7 @@
 #include <atomic>
 #include <mutex>
 #include <thread>
+#include <system_error>
 #include "bip32.h"
 #include "btfaddr.h"
 #include "btftunnel.h"
@@ -82,6 +83,137 @@ CBlockIndex* pindexBest = NULL;
 map<uint256, CBlock*> mapOrphanBlocks;
 multimap<uint256, CBlock*> mapOrphanBlocksByPrev;
 
+// Block bodies we have sent a getdata for and not yet received, so the
+// failover pass in SendMessages can tell "requested and being served" from
+// "requested and gone quiet" and re-issue the request to a different peer
+// (#33). Keyed by block hash; setAsked is the peers already tried since the
+// round last restarted, so the retry rotates instead of hammering the
+// announcer that is not serving. Guarded by cs_main, which both the message
+// handlers and SendMessages already hold.
+//
+// Capped small on purpose. At the tip there is one block in flight; during
+// initial download there are legitimately hundreds outstanding to one peer,
+// and rotating those would duplicate the whole download to every other peer.
+//
+// The cap is a shared resource and nothing on the path from inv to insertion
+// can tell a real block hash from 32 random bytes -- AlreadyHave only asks
+// whether we already hold the block, and there is no header to check work
+// against. So the table does not refuse a new hash when it is full; it makes
+// room. See MakeRoomInBlockFetch for the rule, which is what stops one peer
+// filling all eight slots and switching failover off for everybody.
+//
+// The initialisers matter: the insertion path uses operator[] and then tests
+// nTimeFirstAsked == 0 to detect a fresh entry. That worked on
+// value-initialisation alone, but only for as long as nobody gave this struct
+// a constructor.
+struct CBlockFetch
+{
+    int64 nTimeFirstAsked = 0;  // when the first getdata for this block went out
+    int64 nTimeAsked      = 0;  // when the latest getdata went out
+    CAddress addrAnnounced;     // peer whose announcement put this hash here
+    set<CAddress> setAsked;     // peers tried since the round last restarted
+};
+map<uint256, CBlockFetch> mapBlockFetch;
+static const int BLOCK_FETCH_TRACK_MAX = 8;
+// A block nobody has served for this long is not a fetch problem: the hash may
+// have been announced and never existed. Drop the entry rather than getdata
+// forever; a re-announcement recreates it.
+static const int BLOCK_FETCH_GIVEUP_SECS = 10 * 60;
+
+// Failover firing at all is worth saying out loud: it means peers are
+// announcing blocks they then do not serve, which is the pathology of #33 and
+// the thing nobody could otherwise see. Naming the peer on every re-request is
+// a different matter. A peer can drive that line as often as it likes by
+// announcing hashes it will not serve, and what it prints is a peer address,
+// which is the one thing the .btf transport otherwise takes trouble not to
+// spread around. So the per-peer detail sits behind the net category and the
+// unconditional line is a count over a window no peer can shorten: the first
+// failover after a quiet spell prints at once, because the change from "blocks
+// arrive" to "blocks are announced and not served" is the event worth seeing,
+// and everything after it is summarised once a minute.
+static const int BLOCK_FETCH_REPORT_SECS = 60;
+static int64 nBlockFetchWindowStart = 0;
+static int   nBlockFetchFailovers   = 0;
+
+// How stale our own best block may be before we stop calling this the tip.
+// Blocks target two minutes, so this is thirty intervals: far longer than any
+// stall worth failing over from -- the one in #33 ran sixteen minutes -- and
+// far shorter than catching up, which starts hours or days back.
+static const int BLOCK_FETCH_TIP_AGE_SECS = 60 * 60;
+
+// Whether this node is tracking the tip rather than still catching up.
+//
+// Measured off the age of our own best block, not off any height a peer told
+// us. nStartingHeight is optional in the version message and every node
+// released so far sends the short form, so it is -1 for essentially every
+// peer; and where it is filled in later it is filled in from the height of a
+// block that peer served us, which during catch-up tracks our own height and
+// would report "at the tip" for the whole download. Block timestamps are the
+// one clock here that peers cannot move: CheckBlock refuses anything more than
+// two hours ahead and AcceptBlock refuses anything at or before the previous
+// median, so the only way to make this read "at the tip" falsely is to mine,
+// and all that buys is the 15s spacing this code had unconditionally anyway.
+bool IsBlockFetchNearTip()
+{
+    return pindexBest && (int64)pindexBest->nTime > GetTime() - BLOCK_FETCH_TIP_AGE_SECS;
+}
+
+// Drop one entry so a hash announced by addrNew can be tracked.
+//
+// Refusing the insertion instead was a remote off-switch for the whole
+// feature. An inv carrying eight hashes that never existed filled every slot
+// -- nothing between inv and here can tell those from real blocks -- and no
+// genuinely new block was tracked again until the give-up timer expired ten
+// minutes later, re-armable for one message per ten minutes from a single
+// connection.
+//
+// So evict instead, by occupancy: a peer may only take a slot from a peer
+// holding strictly more slots than itself, and otherwise recycles one of its
+// own. That is what keeps eviction from becoming the same attack in a new
+// shape. A peer that has filled the table is by definition the heaviest
+// holder, so its own entries are the only ones it can displace, while a peer
+// announcing its first block holds nothing and therefore always evicts from
+// the heaviest -- a genuine announcement is never refused a slot, whatever the
+// attacker holds or however many connections it holds it from. The one case
+// that costs a real fetch is eight distinct peers holding one entry each,
+// where a ninth takes the oldest; that is a busy healthy node, not an attack,
+// and losing the oldest of eight beats refusing the ninth.
+static void MakeRoomInBlockFetch(const CAddress& addrNew)
+{
+    if (mapBlockFetch.empty())
+        return;
+
+    map<CAddress, int> mapHeld;
+    for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end(); ++mi)
+        mapHeld[(*mi).second.addrAnnounced]++;
+
+    int nMine = mapHeld.count(addrNew) ? mapHeld[addrNew] : 0;
+
+    int nMax = 0;
+    CAddress addrVictim;
+    for (map<CAddress, int>::iterator mi = mapHeld.begin(); mi != mapHeld.end(); ++mi)
+        if ((*mi).second > nMax)
+        {
+            nMax = (*mi).second;
+            addrVictim = (*mi).first;
+        }
+
+    // Nobody is holding more than this peer, so it recycles its own oldest
+    // rather than taking a slot off an equal.
+    if (nMax <= nMine)
+        addrVictim = addrNew;
+
+    map<uint256, CBlockFetch>::iterator miVictim = mapBlockFetch.end();
+    for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end(); ++mi)
+        if ((*mi).second.addrAnnounced == addrVictim &&
+            (miVictim == mapBlockFetch.end() ||
+             (*mi).second.nTimeFirstAsked < (*miVictim).second.nTimeFirstAsked))
+            miVictim = mi;
+
+    if (miVictim != mapBlockFetch.end())
+        mapBlockFetch.erase(miVictim);
+}
+
 map<uint256, CDataStream*> mapOrphanTransactions;
 multimap<uint256, CDataStream*> mapOrphanTransactionsByPrev;
 
@@ -105,6 +237,8 @@ CKey keyUser;
 string strSetDataDir;
 int nDropMessagesTest = 0;
 bool fSoloMineTest = false; // /solomine: mine without requiring a peer (local test)
+bool fPoolNoAnnounce = false; // /noannounce: operator serves miners but never publishes pool announcements
+bool fPoolMineBlind = false; // /poolmineblind: issue jobs even when no peer has reported a height
 
 // Settings
 int fGenerateBitcoins;
@@ -120,6 +254,9 @@ CAddress addrIncoming;
 int    nMineMode        = MINE_RELAY;
 bool   fMineModeFromCommandLine = false;
 string strParticipantPool;           // participant mode: pool .btf address
+string strPayoutAddress;             // participant: /payoutaddr override (mine without a wallet)
+string strPayoutFile;                // participant: /payoutfile with one address per line, rotated per reconnect
+int    nHashThreads      = 0;        // participant: /hashthreads override (0 = cores-1)
 string strPoolName       = "Bitflash Pool";
 string strPoolDashboardUrl;
 string strPoolStatusFile;
@@ -238,12 +375,32 @@ int MinerThreadCount()
 {
     if (nMinerThreads > 0)
         return nMinerThreads;
-    unsigned int nCores = std::thread::hardware_concurrency();
+    unsigned int nCores = AvailableCoreCount();
     if (nCores <= 1)
         return 1;
     return (int)(nCores - 1);
 }
 
+// Hash threads one participant session runs.
+//
+// Explicit /hashthreads=N is honored exactly, including 1 -- a miner who says
+// one means one. Automatic leaves a core to the node, the Stratum I/O loop and
+// everything else the process still has to do, for the same reason
+// MinerThreadCount() does.
+//
+// Lives here, next to that function, because the two are easy to confuse and
+// StartMinerThreads() needs to be able to tell them apart: only ONE session
+// runs in participant mode, and this is what sizes it.
+int ParticipantHashThreadCount()
+{
+    if (nHashThreads > 0)
+        return nHashThreads;
+    int nWorkers = (int)AvailableCoreCount();
+    if (nWorkers < 2)
+        nWorkers = 2;
+    return nWorkers - 1;
+}
+
 static void SecureClearBytes(vector<unsigned char>& vch);
 static void SecureClearKeyingMaterial(CKeyingMaterial& vch);
 
@@ -1626,7 +1783,7 @@ int CMerkleTx::GetBlocksToMaturity() const
 {
     if (!IsCoinBase())
         return 0;
-    return max(0, (COINBASE_MATURITY+20) - GetDepthInMainChain());
+    return max(0, COINBASE_SPENDABLE_DEPTH - GetDepthInMainChain());
 }
 
 
@@ -1762,7 +1919,7 @@ void CWalletTx::RelayWalletTransaction(CTxDB& txdb)
         uint256 hash = GetHash();
         if (!txdb.ContainsTx(hash))
         {
-            if (LogAcceptsCategory("net")) printf("Relaying wtx %s\n", hash.ToString().substr(0,6).c_str());
+            if (LogAcceptsCategory("relay")) printf("Relaying wtx %s\n", hash.ToString().substr(0,6).c_str());
             RelayMessage(CInv(MSG_TX, hash), (CTransaction)*this);
         }
     }
@@ -2738,7 +2895,35 @@ bool LoadBlockIndex(bool fAllowNew)
         //     CTxOut(nValue=50.00000000, scriptPubKey=0x5F1DF16B2B704C8A578D0B)
         //   vMerkleTree: 4a5e1e
 
-        // Bitflash genesis block -- own header (fair launch, 2026 stable relaunch)
+        // Bitflash genesis block -- own header (fair launch)
+        //
+        // Upstream moved the construction into BuildGenesisBlock() so mainnet
+        // and the isolated testnet can share it. The mainnet inputs it uses are
+        // byte-identical to what this block built inline before the merge --
+        // timestamp string, nTime, nNonce, scriptPubKey, nBits and nVersion all
+        // verified equal against MAINNET_GENESIS_* -- so the mainnet genesis
+        // hash is unchanged. The warning below is why that was checked rather
+        // than assumed, and it still applies to those constants:
+        //
+        // Do not change MAINNET_GENESIS_TIMESTAMP, the scriptPubKey,
+        // MAINNET_GENESIS_TIME or MAINNET_GENESIS_NONCE. They are the inputs to
+        // the genesis hash, and the genesis hash is consensus. Changing one on
+        // its own trips the assert below, which is loud and reverts cleanly;
+        // changing one and regenerating GENESIS_NONCE and hashGenesisBlock to
+        // match -- which is exactly what the re-mining branch below prints out
+        // and invites -- gives a node that starts without complaint, builds its
+        // own chain from height 0, and rejects every real peer as being on a
+        // different chain. That one fails silently, and the damage scales with
+        // how many people run the "fixed" build.
+        //
+        // MAINNET_GENESIS_TIME is 1753315200, which is 2025-07-24T00:00:00Z,
+        // while the headline in MAINNET_GENESIS_TIMESTAMP reads 2026 -- as does
+        // the comment upstream put on that constant, which is wrong about the
+        // year. This is a known discrepancy and not a typo in the value: it is
+        // only consensus-critical as an input to the genesis hash, the block
+        // hashes to hashGenesisBlock with it, and every node on the network
+        // agrees. The mismatch is in the launched chain and cannot be corrected
+        // -- see the warning above before deciding otherwise.
         CBlock block = BuildGenesisBlock();
 
         // If the nonce has not been found yet, mine the genesis once (RandomX)
@@ -2764,6 +2949,11 @@ bool LoadBlockIndex(bool fAllowNew)
             printf("powhash = %s\n", block.GetPoWHash().ToString().c_str());
             printf("hash    = %s\n", block.GetHash().ToString().c_str());
             printf("merkle  = %s\n", block.hashMerkleRoot.ToString().c_str());
+            printf("----------------------------------------\n");
+            printf("These constants bring up a NEW chain. Do not paste them\n");
+            printf("into a build for this network to make an edited nTime or\n");
+            printf("pszTimestamp fit -- a node whose genesis differs starts\n");
+            printf("cleanly on a chain of its own and rejects every real peer.\n");
             printf("========================================\n");
         }
 
@@ -2890,9 +3080,10 @@ bool AlreadyHave(CTxDB& txdb, const CInv& inv)
     {
     case MSG_TX:        return mapTransactions.count(inv.hash) || txdb.ContainsTx(inv.hash);
     case MSG_BLOCK:     return mapBlockIndex.count(inv.hash) || mapOrphanBlocks.count(inv.hash);
-    case MSG_REVIEW:    return true;
-    case MSG_PRODUCT:   return mapProducts.count(inv.hash);
     }
+    // MSG_REVIEW / MSG_PRODUCT / MSG_TABLE are the 2009 marketplace inventory
+    // types. Nothing announces or serves them any more (see ProcessMessage),
+    // so they fall through to the default and are never requested.
     // Don't know what it is, just say we already got one
     return true;
 }
@@ -2935,11 +3126,13 @@ bool ProcessMessages(CNode* pfrom)
             if (LogAcceptsCategory("net")) printf("\n\nPROCESSMESSAGE SKIPPED %d BYTES\n\n", (int)(pstart - vRecv.begin()));
         vRecv.erase(vRecv.begin(), pstart);
 
-        // Read the header from a copy first. The old path consumed the header,
-        // noticed the payload was incomplete, inserted the header back at the
-        // front of the receive buffer, then slept inside the shared message
-        // thread. A peer could announce a large payload and drip bytes forever,
-        // making every pass pay for an O(n) insert and a 100 ms stall.
+        // Read the header from a copy first, and do not consume it until the
+        // whole body is here. The old path consumed the header, noticed the
+        // payload was incomplete, inserted the header back at the front of the
+        // receive buffer, then slept inside the shared message thread. A peer
+        // could announce a large payload and drip bytes forever, making every
+        // pass pay for an O(n) insert and a 100 ms stall -- a cheap way for one
+        // peer to slow the thread that serves all of them. (upstream #109)
         CMessageHeader hdr;
         CDataStream vHeader(vRecv.begin(), vRecv.begin() + sizeof(CMessageHeader),
                             vRecv.nType, vRecv.nVersion);
@@ -2949,7 +3142,10 @@ bool ProcessMessages(CNode* pfrom)
             if (LogAcceptsCategory("net")) printf("\n\nPROCESSMESSAGE: ERRORS IN HEADER %s\n\n\n", hdr.GetCommand().c_str());
             if (hdr.nMessageSize > MAX_PROTOCOL_MESSAGE_SIZE)
                 pfrom->fDisconnect = true;
-            pfrom->nIncompleteMessageStart = 0;
+            pfrom->nMsgWaitSince = 0;
+            pfrom->nMsgWaitSize  = 0;
+            // The header was read from a copy, so it is still in vRecv. Skip it
+            // explicitly or this loop never advances.
             vRecv.ignore(sizeof(CMessageHeader));
             continue;
         }
@@ -2960,30 +3156,63 @@ bool ProcessMessages(CNode* pfrom)
         unsigned int nPayloadAvailable = vRecv.size() - sizeof(CMessageHeader);
         if (nMessageSize > nPayloadAvailable)
         {
-            if (pfrom->nIncompleteMessageStart == 0 ||
-                pfrom->nIncompleteMessageSize != nMessageSize ||
-                pfrom->strIncompleteMessageCommand != strCommand)
+            // Wait for the rest of the message. The header stays in vRecv.
+            //
+            // This is the mechanism the original note asked for: "need a
+            // mechanism to give up waiting for overlong message size error".
+            // Without one the wait is unbounded, and unbounded here means
+            // permanent. The header stays at the front of vRecv and the loop
+            // breaks; if the body never completes, every later pass re-reads
+            // that same header and breaks in the same place. The peer is never
+            // parsed again -- no blocks, no inv, not even its version message,
+            // so it never reports a height either, which is why a wedged node
+            // has peers and GetPeerMedianHeight() still returns -1.
+            //
+            // Nothing rescues it. A header could claim up to 256 MB and still
+            // pass CMessageHeader::IsValid() -- now capped at
+            // MAX_PROTOCOL_MESSAGE_SIZE -- and any byte that arrives
+            // refreshes nLastRecv, so the inactivity timeout that drops a
+            // silent peer never fires on one that is merely unreadable. The
+            // socket stays ESTABLISHED and select() keeps offering it.
+            // Measured on a wedged pool: this branch ran 2014 times in the
+            // deaf window, against 607 in the healthy window before it.
+            if (LogAcceptsCategory("net")) printf("MESSAGE-BREAK 2\n");
+            //
+            // Time the STALL, not the wait. A big message on a slow link is
+            // still arriving, and dropping that peer would be a bug of our own
+            // making; what must be caught is a buffer that has stopped growing
+            // while we go on expecting more. So the clock restarts whenever
+            // even one more byte has landed since the last look.
+            //
+            // Upstream #109 times this differently: it restarts the clock only
+            // when the (size, command) pair changes, which drops a peer sending
+            // one big message slowly but honestly. Progress is the better test,
+            // so that half is kept as it was.
+            int64 nNow = GetTime();
+            if (pfrom->nMsgWaitSince == 0 || nPayloadAvailable > pfrom->nMsgWaitSize)
             {
-                pfrom->nIncompleteMessageStart = GetTime();
-                pfrom->nIncompleteMessageSize = nMessageSize;
-                pfrom->strIncompleteMessageCommand = strCommand;
+                pfrom->nMsgWaitSince = nNow;
+                pfrom->nMsgWaitSize  = nPayloadAvailable;
             }
-            else if (GetTime() - pfrom->nIncompleteMessageStart >
-                     BTF_INCOMPLETE_MESSAGE_TIMEOUT_SECS)
+            else if (nNow - pfrom->nMsgWaitSince > BTF_MSG_WAIT_MAX_SECS)
             {
-                LogPrint("net",
-                         "disconnecting %s: incomplete %s message, %u of %u bytes after %d seconds\n",
-                         pfrom->addr.ToString().c_str(), strCommand.c_str(),
-                         nPayloadAvailable, nMessageSize,
-                         BTF_INCOMPLETE_MESSAGE_TIMEOUT_SECS);
+                // Deliberately not behind a debug category. This is the node
+                // going deaf to a peer, which is the thing nobody could see.
+                printf("peer %s announced a %u byte '%s' and has sent nothing more "
+                       "for %d s (%d of %u payload bytes) -- dropping, this peer is unreadable\n",
+                       pfrom->addr.ToString().c_str(), nMessageSize,
+                       strCommand.c_str(), (int)(nNow - pfrom->nMsgWaitSince),
+                       (int)nPayloadAvailable, nMessageSize);
                 pfrom->fDisconnect = true;
             }
+            // No re-insert, no Sleep(): the header was never consumed, so there
+            // is nothing to put back, and sleeping here stalls every peer.
             break;
         }
-        pfrom->nIncompleteMessageStart = 0;
-        pfrom->nIncompleteMessageSize = 0;
-        pfrom->strIncompleteMessageCommand.clear();
         vRecv.ignore(sizeof(CMessageHeader));
+        // The body arrived, so this peer is readable again.
+        pfrom->nMsgWaitSince = 0;
+        pfrom->nMsgWaitSize  = 0;
 
         // Copy message to its own buffer
         CDataStream vMsg(vRecv.begin(), vRecv.begin() + nMessageSize, vRecv.nType, vRecv.nVersion);
@@ -3012,7 +3241,6 @@ bool ProcessMessages(CNode* pfrom)
 
 bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
 {
-    static map<unsigned int, vector<unsigned char> > mapReuseKey;
     if (LogAcceptsCategory("net")) { printf("received: %-12s (%d bytes)  ", strCommand.c_str(), (int)vRecv.size()); for (int i = 0; i < min(vRecv.size(), (unsigned int)25); i++) printf("%02x ", vRecv[i] & 0xff); printf("\n"); }
     if (nDropMessagesTest > 0 && GetRand(nDropMessagesTest) == 0)
     {
@@ -3251,22 +3479,18 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
     }
 
 
-    else if (strCommand == "review")
-    {
-        CDataStream vMsg(vRecv);
-        CReview review;
-        vRecv >> review;
-
-        CInv inv(MSG_REVIEW, review.GetHash());
-        pfrom->AddInventoryKnown(inv);
-
-        if (review.AcceptReview())
-        {
-            // Relay the original message as-is in case it's a higher version than we know how to parse
-            RelayMessage(inv, vMsg);
-            mapAlreadyAskedFor.erase(inv);
-        }
-    }
+    // "review" used to be handled here. It took a CReview off the wire from an
+    // unauthenticated peer, checked a signature the sender had made with a key
+    // of its own choosing -- which proves possession of that key and authorises
+    // nothing -- and then appended the message to reviews.dat by reading the
+    // whole vector for the target hash, pushing one entry, and writing all of
+    // it back. That is quadratic disk for a stream an attacker controls, on a
+    // record whose mapValue is an unbounded map<string,string> read straight
+    // from the socket, followed by AddAtomsAndPropagate walking a link graph
+    // the same peer supplied, and finally RelayMessage forwarding it to every
+    // other node. Unbounded remote disk growth with network amplification and
+    // no authorisation anywhere in the path. The marketplace it belonged to has
+    // not existed since 2009; the handler is gone rather than bounded.
 
 
     else if (strCommand == "block")
@@ -3275,47 +3499,98 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
         vRecv >> *pblock;
 
         //// debug print
-        if (LogAcceptsCategory("net")) { printf("received block:\n"); pblock->print(); }
+        if (LogAcceptsCategory("relay")) { printf("received block:\n"); pblock->print(); }
 
         CInv inv(MSG_BLOCK, pblock->GetHash());
         pfrom->AddInventoryKnown(inv);
 
+        // GetHash() covers the 80-byte header and nothing else, so the hash
+        // coming out right does not make this the block we asked for. Every
+        // peer that saw X announced holds X's header, and can answer our
+        // getdata with that header bolted onto a transaction list of its own
+        // invention -- the reply still hashes to X. hashMerkleRoot is the only
+        // thing binding the header to the body, so check it here, before the
+        // mapBlockFetch entry is touched and before CheckBlock spends a
+        // RandomX hash on a body already known to be forged.
+        //
+        // There is no honest way to arrive here. Peer traffic rides the .btf
+        // channel, which is XChaCha20-Poly1305, so a body that arrives at all
+        // arrived intact: a mismatch is the peer's own construction, not line
+        // noise. Drop the peer and leave the fetch outstanding so the failover
+        // sweep asks somebody else for the real X, rather than recording X as
+        // delivered on the strength of a header anyone could copy.
+        if (pblock->hashMerkleRoot != pblock->BuildMerkleTree())
+        {
+            if (LogAcceptsCategory("net"))
+                printf("peer %s served a forged body for %s\n",
+                       pfrom->addr.ToString().c_str(), inv.ToString().c_str());
+            // One line per connection: ProcessMessages keeps draining the
+            // receive buffer after fDisconnect is set, so a peer that packs
+            // many forged bodies into one buffer must not get one log line
+            // for each of them.
+            if (!pfrom->fDisconnect)
+                printf("block fetch: a peer answered the request for %s with a body that is not "
+                       "that block -- dropping it\n", inv.hash.ToString().substr(0,14).c_str());
+            pfrom->fDisconnect = true;
+            return error("ProcessMessage() : forged block body for %s",
+                         inv.hash.ToString().substr(0,14).c_str());
+        }
+
         if (ProcessBlock(pfrom, pblock.release()))
+        {
             mapAlreadyAskedFor.erase(inv);
-    }
-
 
-    else if (strCommand == "checkorder" || strCommand == "submitorder")
-    {
-        // Legacy Bitcoin 0.1 marketplace messages are not part of Bitflash's
-        // supported protocol. They used to let a remote peer make this wallet
-        // reserve a key or import/broadcast a wallet transaction. Keep the
-        // command names explicit so old peers get a quiet no-op instead of a
-        // wallet side effect.
-        if (LogAcceptsCategory("net"))
-            printf("ProcessMessage(%s) : disabled legacy order message\n", strCommand.c_str());
-        vRecv.clear();
+            // The body arrived and validated, so the fetch really is over:
+            // the block is now in mapBlockIndex, or parked in mapOrphanBlocks,
+            // and either way AlreadyHave answers for it from here on.
+            //
+            // This has to stay inside the success branch, next to the erase
+            // above. When validation rejects a body nothing is stored,
+            // AlreadyHave stays false, and the mapAskFor entry was already
+            // consumed when the getdata went out -- so erasing the tracking
+            // here would leave the block requested from nobody at all until
+            // some peer happened to re-announce it. That is exactly the stall
+            // of #33, and erasing before ProcessBlock made it reachable on
+            // demand.
+            mapBlockFetch.erase(inv.hash);
+
+            // A peer that just handed us a block is demonstrably at least at
+            // that block's height. Without this, nStartingHeight is a snapshot
+            // taken once during the version handshake and never touched again,
+            // so on a long-lived connection it is the peer's height from
+            // however many hours ago it happened to connect. The pool's
+            // behind-the-network check compares against the median of those
+            // numbers, so as connections age it drifts toward "everyone is
+            // behind us" and quietly stops firing -- the opposite of its job.
+            map<uint256, CBlockIndex*>::iterator mi = mapBlockIndex.find(inv.hash);
+            if (mi != mapBlockIndex.end() && mi->second)
+                pfrom->nStartingHeight = max(pfrom->nStartingHeight, mi->second->nHeight);
+        }
     }
 
 
-    else if (strCommand == "reply")
-    {
-        uint256 hashReply;
-        vRecv >> hashReply;
-
-        CRequestTracker tracker;
-        CRITICAL_BLOCK(pfrom->cs_mapRequests)
-        {
-            map<uint256, CRequestTracker>::iterator mi = pfrom->mapRequests.find(hashReply);
-            if (mi != pfrom->mapRequests.end())
-            {
-                tracker = (*mi).second;
-                pfrom->mapRequests.erase(mi);
-            }
-        }
-        if (!tracker.IsNull())
-            tracker.fn(tracker.param1, vRecv);
-    }
+    // "checkorder", "submitorder" and "reply" -- the 2009 buy-from-a-merchant
+    // exchange -- used to be handled here. All three are gone.
+    //
+    // "checkorder" called GenerateNewKey() for any peer that asked, which is
+    // AddKey() and a wallet.dat write, and handed the pubkey back. The comment
+    // said "keep giving the same key to the same ip until they use it", and on
+    // a 2009 network of routable IPs that held. It does not hold here: every
+    // inbound peer arrives through a rendezvous tunnel and is tagged with
+    // BtfMarkerAddr() over three random bytes (net.cpp), so addr.ip is freshly
+    // random per connection and the cache never hits. Reconnect in a loop and
+    // the node mints a key per connection -- unbounded wallet growth, unbounded
+    // growth of the static map that held them, and every one of those keys
+    // missing from every backup taken beforehand, which for this pre-BIP32
+    // wallet is how coins are lost.
+    //
+    // "submitorder" took a CWalletTx from an unauthenticated peer and, if it
+    // was merely a valid transaction, AddToWallet()'d it. Valid is not the same
+    // as ours: any peer could write chosen transactions into wallet.dat.
+    //
+    // "reply" dispatched to a CRequestTracker callback. Nothing in this tree
+    // has ever called PushRequest, so mapRequests was permanently empty and the
+    // handler could only ever be a parser for hostile input.
 
 
     else if (strCommand == "ping")
@@ -3403,12 +3678,119 @@ bool SendMessages(CNode* pto)
             const CInv& inv = (*pto->mapAskFor.begin()).second;
             if (LogAcceptsCategory("net")) printf("sending getdata: %s\n", inv.ToString().c_str());
             if (!AlreadyHave(txdb, inv))
+            {
                 vAskFor.push_back(inv);
+                // Blocks get their delivery tracked so the failover pass
+                // below can chase the ones that go quiet.
+                if (inv.type == MSG_BLOCK)
+                {
+                    // Full, and this is a hash we are not already tracking:
+                    // make room rather than drop it on the floor, or one peer
+                    // announcing eight hashes turns failover off for everyone.
+                    if (!mapBlockFetch.count(inv.hash) &&
+                        mapBlockFetch.size() >= BLOCK_FETCH_TRACK_MAX)
+                        MakeRoomInBlockFetch(pto->addr);
+
+                    if (mapBlockFetch.count(inv.hash) ||
+                        mapBlockFetch.size() < BLOCK_FETCH_TRACK_MAX)
+                    {
+                        CBlockFetch& fetch = mapBlockFetch[inv.hash];
+                        if (fetch.nTimeFirstAsked == 0)
+                        {
+                            fetch.nTimeFirstAsked = GetTime();
+                            // Who is answerable for this hash existing. Set
+                            // once, on creation: the failover sweep asks other
+                            // peers later, and none of them chose to announce
+                            // it, so none of them should be charged for it.
+                            fetch.addrAnnounced = pto->addr;
+                        }
+                        fetch.nTimeAsked = GetTime();
+                        fetch.setAsked.insert(pto->addr);
+                    }
+                }
+            }
             pto->mapAskFor.erase(pto->mapAskFor.begin());
         }
         if (!vAskFor.empty())
             pto->PushMessage("getdata", vAskFor);
 
+
+        //
+        // Message: getdata (block fetch failover)
+        //
+        // A requested block that has not arrived in BLOCK_FETCH_RETRY_SECS is
+        // not still in transit -- a body is at most 1 MB and somebody
+        // demonstrably has it -- so ask somebody else instead of waiting on
+        // whoever was asked first (#33). Each peer the message handler visits
+        // takes at most one turn per block per round; once every connected
+        // peer has had its turn and a further interval passes with nobody
+        // new to ask, the round restarts. A peer that declared itself a
+        // client cannot serve block bodies and is no use as a target.
+        if (!pto->fClient)
+        {
+            vector<CInv> vFailover;
+            int64 nNowSecs = GetTime();
+            for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end();)
+            {
+                CBlockFetch& fetch = (*mi).second;
+                CInv inv(MSG_BLOCK, (*mi).first);
+                if (AlreadyHave(txdb, inv))
+                {
+                    // Arrived by some other road -- our own miner, an orphan
+                    // parked in mapOrphanBlocks. Nothing left to chase.
+                    mapBlockFetch.erase(mi++);
+                    continue;
+                }
+                if (nNowSecs - fetch.nTimeFirstAsked > BLOCK_FETCH_GIVEUP_SECS)
+                {
+                    printf("block fetch: giving up on %s -- no peer served it in %d s\n",
+                           inv.ToString().c_str(), (int)(nNowSecs - fetch.nTimeFirstAsked));
+                    mapBlockFetch.erase(mi++);
+                    continue;
+                }
+                if (nNowSecs - fetch.nTimeAsked >= BLOCK_FETCH_RETRY_SECS)
+                {
+                    // The handler loop visits every peer within ~100ms, so a
+                    // request stale by two full intervals means nobody outside
+                    // setAsked was there to ask. Start the round over.
+                    if (nNowSecs - fetch.nTimeAsked >= 2 * BLOCK_FETCH_RETRY_SECS)
+                        fetch.setAsked.clear();
+                    if (!fetch.setAsked.count(pto->addr))
+                    {
+                        // Which block, how long, and which peer we are trying
+                        // next. Behind the category because it names a peer
+                        // and a peer decides how often it is written.
+                        if (LogAcceptsCategory("net"))
+                            printf("block fetch failover: %s unanswered for %d s, re-requesting from %s\n",
+                                   inv.ToString().c_str(), (int)(nNowSecs - fetch.nTimeAsked),
+                                   pto->addr.ToString().c_str());
+
+                        // The unconditional half: no addresses, and at most
+                        // one line per BLOCK_FETCH_REPORT_SECS however hard a
+                        // peer tries. See the counters for the reasoning.
+                        nBlockFetchFailovers++;
+                        if (nNowSecs - nBlockFetchWindowStart >= BLOCK_FETCH_REPORT_SECS)
+                        {
+                            printf("block fetch: %d block request%s went unanswered and %s been "
+                                   "re-asked of other peers (%d tracked)\n",
+                                   nBlockFetchFailovers, nBlockFetchFailovers == 1 ? "" : "s",
+                                   nBlockFetchFailovers == 1 ? "has" : "have",
+                                   (int)mapBlockFetch.size());
+                            nBlockFetchWindowStart = nNowSecs;
+                            nBlockFetchFailovers   = 0;
+                        }
+
+                        vFailover.push_back(inv);
+                        fetch.nTimeAsked = nNowSecs;
+                        fetch.setAsked.insert(pto->addr);
+                    }
+                }
+                ++mi;
+            }
+            if (!vFailover.empty())
+                pto->PushMessage("getdata", vFailover);
+        }
+
     }
     return true;
 }
@@ -3573,6 +3955,110 @@ static bool StratumRecvLine(SOCKET s, std::string& buf,
 // How long to wait for a mining.notify after authorize before giving up
 static const int64 STUCK_NO_JOB_TIMEOUT_SECS = 120;
 
+// ------------------------------------------------------------------
+// Multi-threaded pool worker. The original loop hashed a single nonce
+// per blocking 50ms socket poll, capping one instance at ~20 H/s no
+// matter how many cores the machine has. The socket and job bookkeeping
+// stay on the calling thread; N hash threads grind nonce ranges on their
+// own RandomX VMs (all sharing the one ~2 GB dataset) and drop found
+// shares on a queue the I/O thread drains and submits.
+// ------------------------------------------------------------------
+struct ParticipantJobShared
+{
+    std::mutex mtx;
+    unsigned char header[80];
+    uint256 target;
+    std::string jobId;
+    uint64 jobSeq;
+    bool haveJob;
+    bool stop;
+    ParticipantJobShared() : jobSeq(0), haveJob(false), stop(false)
+    {
+        memset(header, 0, sizeof(header));
+    }
+};
+
+struct ParticipantShareHit
+{
+    uint64 jobSeq;
+    std::string jobId;
+    unsigned int nonce;
+};
+
+static void ParticipantHashWorker(ParticipantJobShared* sh, int idx, int nWorkers,
+                                  std::vector<ParticipantShareHit>* hits,
+                                  std::mutex* hitsMtx)
+{
+    void* vm = RandomXCreateMinerVM();
+    if (!vm)
+    {
+        LogPrint("worker", "[worker] hash thread %d: RandomX VM creation failed\n", idx);
+        return;
+    }
+
+    unsigned char header[80];
+    uint256 target;
+    std::string jobId;
+    uint64 mySeq = 0;
+    bool active = false;
+    unsigned int nNonce = 0;
+    uint64 localHashes = 0;
+
+    while (!fShutdown)
+    {
+        {
+            std::lock_guard<std::mutex> lk(sh->mtx);
+            if (sh->stop)
+                break;
+            if (sh->haveJob && sh->jobSeq != mySeq)
+            {
+                memcpy(header, sh->header, 80);
+                target = sh->target;
+                jobId  = sh->jobId;
+                mySeq  = sh->jobSeq;
+                nNonce = (unsigned int)(idx + 1);
+                active = true;
+            }
+        }
+        if (!active)
+        {
+            Sleep(50);
+            continue;
+        }
+
+        memcpy(header + 76, &nNonce, 4);
+        uint256 hash = RandomXHashWithVM(vm, header, 80);
+        localHashes++;
+        if ((localHashes & 0x3ff) == 0)
+            gParticipantHashes.fetch_add(0x400);
+
+        if (hash <= target)
+        {
+            LogPrint("worker", "[worker] share found! nonce=%u job=%s (thread %d)\n",
+                     nNonce, jobId.c_str(), idx);
+            std::lock_guard<std::mutex> lk(*hitsMtx);
+            hits->push_back(ParticipantShareHit{mySeq, jobId, nNonce});
+        }
+
+        unsigned int next = nNonce + (unsigned int)nWorkers;
+        if (next < nNonce) // wrapped past 2^32: range exhausted, wait for next job
+            active = false;
+        else
+            nNonce = next;
+    }
+
+    gParticipantHashes.fetch_add(localHashes & 0x3ff);
+    RandomXDestroyMinerVM(vm);
+}
+
+// Run one participant session: resolve the pool, open the tunnel, subscribe,
+// hash, submit shares. Returns true only if the pool actually handed out work
+// -- at least one well-formed mining.notify arrived. Everything else is false,
+// including a tunnel that opened and was dropped before any job.
+//
+// The caller's reconnect backoff keys off this return value, so any path added
+// here that leaves the session without work MUST return false. "The session
+// ended tidily" is not the question being asked.
 static bool PoolParticipantMiner()
 {
     // ------------------------------------------------------------------
@@ -3587,6 +4073,51 @@ static bool PoolParticipantMiner()
     LogPrint("worker", "[worker] connecting to pool %s\n", strParticipantPool.c_str());
     SetParticipantMiningStatus("resolving pool address");
 
+    // ------------------------------------------------------------------
+    // Steps 1-2: connect to the pool. Two address forms:
+    //   tcp:HOST:PORT  -- plain TCP straight to the pool's stratum port
+    //                     (e.g. our own operator node on this machine),
+    //                     no .btf resolution or rendezvous tunnel involved
+    //   <name>.btf     -- resolve via Nostr, dial through a rendezvous relay
+    // ------------------------------------------------------------------
+    btf_socket_t s = INVALID_SOCKET;
+    if (strParticipantPool.compare(0, 4, "tcp:") == 0)
+    {
+        std::string hp = strParticipantPool.substr(4);
+        size_t colon = hp.rfind(':');
+        if (colon == std::string::npos) {
+            LogPrint("worker", "[worker] bad tcp pool address '%s' (want tcp:host:port)\n",
+                     strParticipantPool.c_str());
+            SetParticipantMiningStatus("bad pool address");
+            return false;
+        }
+        std::string host = hp.substr(0, colon);
+        int port = atoi(hp.substr(colon + 1).c_str());
+        unsigned long ip = inet_addr(host.c_str());
+        if (port <= 0 || port > 65535 || ip == INADDR_NONE) {
+            LogPrint("worker", "[worker] bad tcp pool endpoint '%s'\n", hp.c_str());
+            SetParticipantMiningStatus("bad pool endpoint");
+            return false;
+        }
+        SetParticipantMiningStatus("connecting to pool (direct tcp)");
+        struct sockaddr_in sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sin_family = AF_INET;
+        sa.sin_port = htons((unsigned short)port);
+        sa.sin_addr.s_addr = ip;
+        SOCKET cs = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+        if (cs == INVALID_SOCKET || connect(cs, (struct sockaddr*)&sa, sizeof(sa)) == SOCKET_ERROR) {
+            LogPrint("worker", "[worker] direct connect to %s FAILED\n", hp.c_str());
+            SetParticipantMiningStatus("pool connect failed");
+            if (cs != INVALID_SOCKET) closesocket(cs);
+            return false;
+        }
+        LogPrint("worker", "[worker] connected directly to pool %s\n", hp.c_str());
+        s = (btf_socket_t)cs;
+        goto connected;
+    }
+
+    {
     unsigned char target_pubkey[32];
     if (!btf::ParseAddress(strParticipantPool, target_pubkey)) {
         LogPrint("worker", "[worker] invalid .btf address: %s\n", strParticipantPool.c_str());
@@ -3605,6 +4136,33 @@ static bool PoolParticipantMiner()
     }
     LogPrint("worker", "[worker] pool resolved to meeting node %s\n", meetingHostPort.c_str());
 
+    // The descriptor names ONE meeting node, but the pool parks a
+    // registration at every relay it knows (one accept thread per relay,
+    // rpc.cpp:AcceptOneFn), so any seed relay can pair us. Insisting on the
+    // advertised entry forever turns one bad path into a miner that idles
+    // indefinitely while a working path exists (issue #17); after a few
+    // consecutive tunnel failures, rotate the seed relays into the attempts
+    // too. Only ONE participant session runs (StartMinerThreads), so these
+    // statics are single-threaded.
+    static const int TUNNEL_FAILOVER_AFTER = 3;
+    static int nTunnelFails = 0;      // consecutive tunnel failures, this pool
+    static size_t iFailoverRelay = 0; // rotation cursor over vBtfMeetingRelays
+    static std::string strFailPool;   // pool the counters belong to
+    if (strFailPool != strParticipantPool) {
+        strFailPool = strParticipantPool;
+        nTunnelFails = 0;
+        iFailoverRelay = 0;
+    }
+    if (nTunnelFails >= TUNNEL_FAILOVER_AFTER && !vBtfMeetingRelays.empty()) {
+        std::string alt = vBtfMeetingRelays[iFailoverRelay++ % vBtfMeetingRelays.size()];
+        if (alt != meetingHostPort) {
+            LogPrint("worker", "[worker] advertised meeting node %s failed %d"
+                     " times in a row -- trying seed relay %s instead\n",
+                     meetingHostPort.c_str(), nTunnelFails, alt.c_str());
+            meetingHostPort = alt;
+        }
+    }
+
     size_t colon = meetingHostPort.rfind(':');
     if (colon == std::string::npos) {
         LogPrint("worker", "[worker] bad meeting node format '%s'\n", meetingHostPort.c_str());
@@ -3621,25 +4179,65 @@ static bool PoolParticipantMiner()
     }
 
     // ------------------------------------------------------------------
-    // Step 2: open encrypted tunnel to pool
+    // Step 2b: open encrypted tunnel to pool
     // ------------------------------------------------------------------
     SetParticipantMiningStatus("opening tunnel");
-    btf_socket_t s = btf::BtfClientTunnel(host.c_str(), (unsigned short)port,
-                                           target_pubkey, service_enc_pub);
+    btf::TunnelFail tunnelFail = btf::TUNNEL_FAIL_NONE;
+    s = btf::BtfClientTunnel(host.c_str(), (unsigned short)port,
+                             target_pubkey, service_enc_pub, &tunnelFail);
     if (s == INVALID_SOCKET) {
-        LogPrint("worker", "[worker] tunnel connect FAILED via %s"
-                 " (relay unreachable or pool not listening)\n",
-                 meetingHostPort.c_str());
-        SetParticipantMiningStatus("tunnel connect failed");
+        nTunnelFails++;
+        LogPrint("worker", "[worker] tunnel connect FAILED via %s: %s\n",
+                 meetingHostPort.c_str(), btf::TunnelFailText(tunnelFail));
+        SetParticipantMiningStatus(std::string("tunnel connect failed: ")
+                                   + btf::TunnelFailText(tunnelFail));
         return false;
     }
+    nTunnelFails = 0;
     LogPrint("worker", "[worker] tunnel open via %s\n", meetingHostPort.c_str());
     SetParticipantMiningStatus("tunnel open");
+    }
+
+connected:
 
     // ------------------------------------------------------------------
-    // Step 3: determine our payout address (mining username)
+    // Step 3: determine our payout address (mining username). /payoutaddr
+    // wins -- it lets a machine mine to an address whose keys live
+    // elsewhere, so no wallet file is needed on the mining machine.
+    // /payoutfile rotates through a list of such addresses: one is picked
+    // per (re)connection, and the session self-limits (see rotation break
+    // in the main loop) so consecutive rounds land on fresh addresses.
     // ------------------------------------------------------------------
-    std::string username;
+    static std::vector<std::string> vPayoutAddrs;
+    static size_t nPayoutRot = 0;
+    if (!strPayoutFile.empty() && vPayoutAddrs.empty())
+    {
+        FILE* f = fopen(strPayoutFile.c_str(), "r");
+        if (f)
+        {
+            char line[256];
+            while (fgets(line, sizeof(line), f))
+            {
+                std::string a = line;
+                while (!a.empty() && (a.back() == '\n' || a.back() == '\r' ||
+                                      a.back() == ' '  || a.back() == '\t'))
+                    a.pop_back();
+                if (!a.empty())
+                    vPayoutAddrs.push_back(a);
+            }
+            fclose(f);
+            LogPrint("worker", "[worker] loaded %zu payout addresses from %s\n",
+                     vPayoutAddrs.size(), strPayoutFile.c_str());
+        }
+        else
+            LogPrint("worker", "[worker] cannot open payout file %s\n",
+                     strPayoutFile.c_str());
+    }
+
+    std::string username = strPayoutAddress;
+    if (username.empty() && !vPayoutAddrs.empty())
+        username = vPayoutAddrs[nPayoutRot++ % vPayoutAddrs.size()];
+    if (username.empty())
     {
         std::vector<unsigned char> vchPubKey;
         if (CWalletDB("r").ReadDefaultKey(vchPubKey))
@@ -3677,16 +4275,14 @@ static bool PoolParticipantMiner()
     // ------------------------------------------------------------------
     if (!RandomXFastReady()) {
         SetParticipantMiningStatus("building RandomX dataset (~2GB, one-time)");
-        unsigned int nThreads = std::thread::hardware_concurrency();
+        // Fill with the cores we are permitted to use, not the ones the host
+        // happens to have. More threads than the cpuset allows does not build
+        // the dataset any faster -- the CPU budget is the same either way --
+        // it just oversubscribes, and this runs alongside the pool node.
+        unsigned int nThreads = AvailableCoreCount();
         RandomXInitDataset(nThreads > 0 ? (int)nThreads : 1);
     }
-    void* rxvm = RandomXCreateMinerVM();
-    if (!rxvm) {
-        LogPrint("worker", "[worker] failed to create RandomX VM\n");
-        SetParticipantMiningStatus("RandomX init failed");
-        closesocket(s); return false;
-    }
-    LogPrint("worker", "[worker] RandomX VM ready (%s)\n",
+    LogPrint("worker", "[worker] RandomX dataset ready (%s)\n",
              RandomXFastReady() ? "fast 2GB" : "light 256MB");
 
     // ------------------------------------------------------------------
@@ -3704,7 +4300,6 @@ static bool PoolParticipantMiner()
                                  {"params",json::array()}})) {
         LogPrint("worker", "[worker] subscribe send FAILED -- pool dropped connection\n");
         SetParticipantMiningStatus("subscribe send failed");
-        RandomXDestroyMinerVM(rxvm);
         closesocket(s); return false;
     }
 
@@ -3714,18 +4309,70 @@ static bool PoolParticipantMiner()
                                  {"params",json::array({username,"x"})}})) {
         LogPrint("worker", "[worker] authorize send FAILED -- pool dropped connection\n");
         SetParticipantMiningStatus("authorize send failed");
-        RandomXDestroyMinerVM(rxvm);
         closesocket(s); return false;
     }
 
     // ------------------------------------------------------------------
+    // Step 6: spawn hash threads (each with its own RandomX VM on the
+    // shared dataset), then run the I/O loop below: receive pool messages,
+    // publish jobs to the threads, submit the shares they find.
+    // ------------------------------------------------------------------
+    // One count, decided in one place (main.cpp:MinerThreadCount's neighbour),
+    // so that what StartMinerThreads() reports at startup and what actually
+    // hashes here can never drift apart. Explicit /hashthreads=N is honored
+    // exactly, including 1; automatic leaves one core for node + I/O threads.
+    int nWorkers = ParticipantHashThreadCount();
+    ParticipantJobShared jobShared;
+    std::vector<ParticipantShareHit> shareHits;
+    std::mutex shareHitsMtx;
+    std::vector<std::thread> hashThreads;
+    try
+    {
+        for (int i = 0; i < nWorkers; i++)
+            hashThreads.emplace_back(ParticipantHashWorker, &jobShared, i, nWorkers,
+                                     &shareHits, &shareHitsMtx);
+    }
+    catch (const std::system_error& e)
+    {
+        // A refused pthread_create used to reach std::terminate here and
+        // kill the worker mid-session -- observed twice on an otherwise
+        // healthy participant. Stop the workers that did start the same way
+        // the disconnect path below does, drop this pool connection, and let
+        // the caller's reconnect loop try again once the pressure clears.
+        LogPrint("worker", "[worker] cannot spawn hash threads (%s)"
+                 " -- dropping pool connection\n", e.what());
+        SetParticipantMiningStatus("hash thread spawn failed");
+        {
+            std::lock_guard<std::mutex> lk(jobShared.mtx);
+            jobShared.stop = true;
+            jobShared.haveJob = false;
+        }
+        for (std::thread& t : hashThreads)
+            t.join();
+        closesocket(s);
+        return false;
+    }
+    LogPrint("worker", "[worker] spawned %d hash threads on shared RandomX dataset\n",
+             nWorkers);
+    const uint64 sessionStartHashes = gParticipantHashes.load();
+
+    // ------------------------------------------------------------------
     // Step 6: main loop -- receive messages, hash, submit shares
     // ------------------------------------------------------------------
     std::string jobId;
     unsigned char header[80] = {};
     uint256 target;
+    // Cached answer to "which block is this job built on", for the
+    // mining.notify handler below -- see the comment there. Session-local, so
+    // a reconnect re-resolves rather than trusting an answer obtained before
+    // a possible change of pool.
+    uint256 hashPrevResolved;           // prevhash the cached answer describes
+    bool fPrevResolved       = false;   // whether that answer exists yet
+    int  nPrevHeight         = -1;      // its height, or -1 == unknown to us
+    int  nBestHeightResolved = -1;      // nBestHeight when we last resolved
     double currentDifficulty = 1.0; // updated by mining.set_difficulty from pool
     bool haveJob         = false;
+    bool gotAnyJob       = false; // any job at all this session -- the return value
     bool gotSubscribeAck = false;
     bool gotAuthorizeAck = false;
     int64 authWaitStart  = 0;
@@ -3735,6 +4382,8 @@ static bool PoolParticipantMiner()
     uint64 sessionSharesSent  = 0; // this connection only
     uint64 sessionSharesAccepted = 0;
     int64  sampleStart       = GetTime();
+    int64  connStart         = GetTime();
+    const int64 PAYOUT_ROTATE_SECS = 300; // reconnect with next /payoutfile address
 
     SetParticipantMiningStatus("waiting for pool response");
 
@@ -3840,10 +4489,75 @@ static bool PoolParticipantMiner()
                                     jobId = newJobId;
                                     memcpy(header, hdrBytes.data(), 80);
                                     memcpy(&target, tgtBytes.data(), 32);
-                                    haveJob = true;
-                                    nNonce  = 1;
-                                    LogPrint("worker", "[pool->worker] new job %s received\n",
-                                             jobId.c_str());
+                                    haveJob   = true;
+                                    gotAnyJob = true;
+                                    nNonce    = 1;
+                                    {
+                                        std::lock_guard<std::mutex> lk(jobShared.mtx);
+                                        memcpy(jobShared.header, header, 80);
+                                        jobShared.target = target;
+                                        jobShared.jobId  = jobId;
+                                        jobShared.jobSeq++;
+                                        jobShared.haveJob = true;
+                                    }
+                                    // Log the chain position the pool is
+                                    // building on, so a stale or private
+                                    // fork is auditable from worker logs.
+                                    // The prevhash comes from the header we
+                                    // actually hash (== p[2] of the notify);
+                                    // a brief cs_main lookup is safe here --
+                                    // this thread holds no other lock.
+                                    //
+                                    // Resolving it is the expensive half, and
+                                    // this is the socket-reading thread: block
+                                    // validation can hold cs_main for a long
+                                    // time, and every moment spent waiting on
+                                    // it here is a moment set_difficulty and
+                                    // share responses are not being handled.
+                                    // Most notifies in a round are a new job
+                                    // on the SAME tip, so the answer is cached
+                                    // and re-resolved only when it could come
+                                    // out differently: a prevhash we have not
+                                    // resolved, or one we could NOT resolve
+                                    // last time while the chain has since
+                                    // moved (unknown -> known). A block's
+                                    // height is fixed once mapBlockIndex knows
+                                    // it, so a cached "known" never goes
+                                    // stale. nBestHeight is read unlocked on
+                                    // purpose -- it only decides whether to
+                                    // repeat a lookup, never what gets
+                                    // printed, so a stale read costs at most
+                                    // one deferred or one extra lookup.
+                                    // The line still prints in full for every
+                                    // job, cached or not.
+                                    uint256 hashPrev;
+                                    memcpy(&hashPrev, header + 4, 32);
+                                    if (LogAcceptsCategory("worker"))
+                                    {
+                                        int nBestHeightNow = nBestHeight;
+                                        if (!fPrevResolved
+                                            || hashPrev != hashPrevResolved
+                                            || (nPrevHeight < 0 && nBestHeightNow != nBestHeightResolved))
+                                        {
+                                            nPrevHeight = -1;
+                                            CRITICAL_BLOCK(cs_main)
+                                            {
+                                                map<uint256, CBlockIndex*>::iterator mi = mapBlockIndex.find(hashPrev);
+                                                if (mi != mapBlockIndex.end())
+                                                    nPrevHeight = (*mi).second->nHeight;
+                                            }
+                                            hashPrevResolved    = hashPrev;
+                                            nBestHeightResolved = nBestHeightNow;
+                                            fPrevResolved       = true;
+                                        }
+                                        if (nPrevHeight >= 0)
+                                            LogPrint("worker", "[pool->worker] new job %s received, prevhash %s (known, job height %d)\n",
+                                                     jobId.c_str(), hashPrev.GetHex().c_str(),
+                                                     nPrevHeight + 1);
+                                        else
+                                            LogPrint("worker", "[pool->worker] new job %s received, prevhash %s (unknown to our chain)\n",
+                                                     jobId.c_str(), hashPrev.GetHex().c_str());
+                                    }
                                     SetParticipantMiningStatus("hashing job " + jobId);
                                 }
                             }
@@ -3897,46 +4611,71 @@ static bool PoolParticipantMiner()
             }
         }
 
+        // -- Payout address rotation: end this session cleanly so the outer
+        // loop reconnects and authorizes the next /payoutfile address --
+        if (!vPayoutAddrs.empty() && GetTime() - connStart > PAYOUT_ROTATE_SECS)
+        {
+            LogPrint("worker", "[worker] payout rotation interval reached"
+                     " -- reconnecting with next address\n");
+            break;
+        }
+
         if (!haveJob) { Sleep(100); continue; }
 
-        // -- Hash one nonce --
-        memcpy(header+76, &nNonce, 4);
-        uint256 hash = RandomXHashWithVM(rxvm, header, 80);
-        hashesSinceSample++;
-        gParticipantHashes.fetch_add(1);
-        if ((hashesSinceSample & 0x3ff) == 0)
-            UpdateParticipantHashRate(hashesSinceSample, sampleStart);
-
-        if (hash <= target) {
-            LogPrint("worker", "[worker] share found! nonce=%u job=%s difficulty=%.4f\n",
-                     nNonce, jobId.c_str(), currentDifficulty);
-            SetParticipantMiningStatus("share found; submitting");
-            int submitId = msgId++;
-            pendingSubmitIds.insert(submitId);
-            gParticipantSharesSent.fetch_add(1);
-            sessionSharesSent++;
-            json submit = {{"id",submitId},{"method","mining.submit"},
-                           {"params",json::array({username, jobId, ToHexStr(&nNonce,4)})}};
-            if (!StratumSendLine(s, submit)) {
-                LogPrint("worker", "[worker] share submit send FAILED"
-                         " -- pool connection lost\n");
-                break;
-            }
-        }
+        // -- Hash rate accounting (hashing happens on the worker threads) --
+        hashesSinceSample = gParticipantHashes.load() - sessionStartHashes;
+        UpdateParticipantHashRate(hashesSinceSample, sampleStart);
 
-        nNonce++;
-        if (nNonce == 0) {
-            LogPrint("worker", "[worker] nonce space exhausted for job %s"
-                     " -- waiting for new job\n", jobId.c_str());
-            haveJob = false;
+        // -- Submit any shares the hash threads found --
+        bool submitFailed = false;
+        {
+            std::vector<ParticipantShareHit> pending;
+            {
+                std::lock_guard<std::mutex> lk(shareHitsMtx);
+                pending.swap(shareHits);
+            }
+            for (ParticipantShareHit& hit : pending)
+            {
+                if (hit.jobId != jobId)
+                {
+                    LogPrint("worker", "[worker] dropping stale share for old job %s\n",
+                             hit.jobId.c_str());
+                    continue;
+                }
+                LogPrint("worker", "[worker] share found! nonce=%u job=%s difficulty=%.4f\n",
+                         hit.nonce, hit.jobId.c_str(), currentDifficulty);
+                SetParticipantMiningStatus("share found; submitting");
+                int submitId = msgId++;
+                pendingSubmitIds.insert(submitId);
+                gParticipantSharesSent.fetch_add(1);
+                sessionSharesSent++;
+                json submit = {{"id",submitId},{"method","mining.submit"},
+                               {"params",json::array({username, hit.jobId,
+                                                      ToHexStr(&hit.nonce,4)})}};
+                if (!StratumSendLine(s, submit)) {
+                    LogPrint("worker", "[worker] share submit send FAILED"
+                             " -- pool connection lost\n");
+                    submitFailed = true;
+                    break;
+                }
+            }
         }
+        if (submitFailed)
+            break;
     }
 
     // ------------------------------------------------------------------
-    // Cleanup
+    // Cleanup: stop the hash threads, then drop the pool connection
     // ------------------------------------------------------------------
-    RandomXDestroyMinerVM(rxvm);
+    {
+        std::lock_guard<std::mutex> lk(jobShared.mtx);
+        jobShared.stop = true;
+        jobShared.haveJob = false;
+    }
+    for (std::thread& t : hashThreads)
+        t.join();
     closesocket(s);
+    hashesSinceSample = gParticipantHashes.load() - sessionStartHashes;
     UpdateParticipantHashRate(hashesSinceSample, sampleStart);
     SetParticipantMiningStatus("disconnected");
     LogPrint("worker", "[worker] disconnected from pool"
@@ -3944,7 +4683,11 @@ static bool PoolParticipantMiner()
              (unsigned long long)hashesSinceSample,
              (unsigned long long)sessionSharesSent,
              (unsigned long long)sessionSharesAccepted);
-    return true;
+    // Not "we got here", which is true of a tunnel the pool accepted and then
+    // dropped without ever sending a job -- exactly the case the caller's
+    // backoff exists for. Reaching the end of the session is not evidence the
+    // session was worth anything; a job is.
+    return gotAnyJob;
 }
 
 // ---------------------------------------------------------------------------
@@ -4141,11 +4884,51 @@ bool BitcoinMiner(int nThreadId)
     // Participant mode: connect to external pool instead of mining solo/operator
     if (nMineMode == MINE_PARTICIPANT)
     {
+        // An attempt that never got work backs off (10s doubling to 120s)
+        // instead of hammering the same path every flat 10s, and a streak
+        // lasting minutes is said at printf level: the identical once-per-10s
+        // LogPrint line is how a worker idled all night unnoticed (issue #17).
+        //
+        // Only a session the pool actually sent a job to resets either. The
+        // weaker test -- "the session returned" -- was gameable: a pool that
+        // completes the tunnel and drops without ever sending work leaves by
+        // the same tidy cleanup path a healthy one does, which would pin the
+        // retry at 10s forever and defeat the backoff in exactly the scenario
+        // it exists for.
+        int   nRetrySecs    = 10;
+        int64 nFailingSince = 0;
         while (fGenerateBitcoins && nMineMode == MINE_PARTICIPANT && !fShutdown) {
-            PoolParticipantMiner();
+            bool fGotWork = PoolParticipantMiner();
             if (fGenerateBitcoins && nMineMode == MINE_PARTICIPANT && !fShutdown) {
-                LogPrint("worker", "PoolParticipantMiner: reconnecting in 10s\n");
-                for (int i = 0; i < 10 && !fShutdown; i++) Sleep(1000);
+                if (fGotWork) {
+                    nRetrySecs    = 10;
+                    nFailingSince = 0;
+                } else {
+                    if (nFailingSince == 0)
+                        nFailingSince = GetTime();
+                    int64 nMins = (GetTime() - nFailingSince) / 60;
+                    if (nMins >= 1)
+                        printf("[worker] connection to pool %s has been failing"
+                               " for %lld minutes\n",
+                               strParticipantPool.c_str(), (long long)nMins);
+                }
+                LogPrint("worker", "PoolParticipantMiner: reconnecting in %ds\n",
+                         nRetrySecs);
+                // Poll everything the enclosing while polls, not just
+                // fShutdown. Raising the ceiling to 120s made a
+                // shutdown-only predicate expensive: after the operator
+                // clears Generate or switches to Relay, the session -- and
+                // the vfThreadRunning[3] slot that gates restarting it --
+                // would stay held for up to two minutes. Measured 119s
+                // before, 1s after.
+                for (int i = 0; i < nRetrySecs && !fShutdown && fGenerateBitcoins
+                                && nMineMode == MINE_PARTICIPANT; i++)
+                    Sleep(1000);
+                if (!fGotWork && nRetrySecs < 120) {
+                    nRetrySecs *= 2;
+                    if (nRetrySecs > 120)
+                        nRetrySecs = 120;
+                }
             }
         }
         return true;
@@ -4161,7 +4944,7 @@ bool BitcoinMiner(int nThreadId)
     // Build the fast (~2 GB dataset) RandomX mode once, up front, so we're
     // not stuck mining in the much slower light/cache-only mode forever.
     if (!RandomXFastReady()) {
-        unsigned int nThreads = std::thread::hardware_concurrency();
+        unsigned int nThreads = AvailableCoreCount();
         RandomXInitDataset(nThreads > 0 ? (int)nThreads : 1);
     }
 
@@ -4247,8 +5030,40 @@ bool BitcoinMiner(int nThreadId)
             map<uint256, CTxIndex> mapTestPool;
             vector<char> vfAlreadyAdded(mapTransactions.size());
             bool fFoundSomething = true;
-            unsigned int nBlockSize = 0;
-            while (fFoundSomething && nBlockSize < MAX_SIZE/2)
+            // Assembly must stop below the consensus cap that CheckBlock()
+            // enforces, or we mine a block our own node then rejects.
+            //
+            // This used to read MAX_SIZE/2 (16 MB), which was consistent while
+            // CheckBlock() also tested against MAX_SIZE (32 MB). Adding
+            // MAX_BLOCK_SIZE inverted it: assembly could fill 16 MB and
+            // validation would refuse anything over 1 MB, so a full mempool
+            // meant solving a block and throwing it away -- with this pool at
+            // ~90% of hashrate, that is the network stalling, not just us.
+            //
+            // The budget test then sat only on this outer while, and the
+            // comment claimed that bounded the overshoot to a single
+            // transaction. It did not. The inner for walks all of
+            // mapTransactions with no test of its own, so one pass could append
+            // the entire mempool: the overshoot was bounded by mempool size,
+            // which is to say not bounded at all. Ask per transaction, before
+            // appending, and the overshoot is zero rather than small.
+            //
+            // Seeded with what the block already weighs -- header, tx count,
+            // coinbase -- because CheckBlock() weighs the whole serialized
+            // block and not just the transactions we chose to add to it.
+            unsigned int nBlockSize = ::GetSerializeSize(*pblock, SER_DISK);
+            // Sigops are a budget too, and CheckBlock() enforces one that no
+            // assembler here counted against. Bytes do not bound validation
+            // cost: every OP_CHECKSIG is an elliptic-curve verification, so a
+            // template well inside the size limit can still be refused for
+            // demanding more work than a block is allowed to. Counted with
+            // CTransaction::GetSigOpCount, the function CheckBlock() itself
+            // sums, so the two cannot disagree about what a transaction costs.
+            //
+            // Seeded from the coinbase because CheckBlock() sums over all of
+            // vtx, coinbase included.
+            unsigned int nBlockSigOps = pblock->vtx[0].GetSigOpCount();
+            while (fFoundSomething && nBlockSize < MAX_BLOCK_SIZE_GEN)
             {
                 fFoundSomething = false;
                 unsigned int n = 0;
@@ -4260,6 +5075,29 @@ bool BitcoinMiner(int nThreadId)
                     if (tx.IsCoinBase() || !tx.IsFinal())
                         continue;
 
+                    // Skip, not break: a transaction too big for the room left
+                    // says nothing about the next one, which may still fit.
+                    //
+                    // This is also the only ceiling on a single transaction's
+                    // size anywhere on the path into a block. CheckTransaction
+                    // does not cap it and neither does AcceptTransaction, so
+                    // the mempool will hold one of any size the wire allows;
+                    // without this test a lone 1.5 MB transaction offering a
+                    // fat fee is selected, and every template built from that
+                    // mempool is one CheckBlock() throws away. The fee is never
+                    // paid, because the block never confirms.
+                    //
+                    // Deliberately before ConnectInputs and not after:
+                    // ConnectInputs adds this transaction's fee to nFees by
+                    // reference on success. Passing it and then declining the
+                    // transaction would credit the coinbase for a fee no
+                    // transaction in the block pays, and the block would be
+                    // rejected for a wholly different reason.
+                    unsigned int nTxSize   = ::GetSerializeSize(tx, SER_NETWORK);
+                    unsigned int nTxSigOps = tx.GetSigOpCount();
+                    if (!BlockTemplateFits(nBlockSize, nBlockSigOps, nTxSize, nTxSigOps))
+                        continue;
+
                     // Transaction fee requirements, mainly only needed for flood control
                     // Under 10K (about 80 inputs) is free for first 100 transactions
                     // Base rate is 0.01 per KB
@@ -4271,7 +5109,8 @@ bool BitcoinMiner(int nThreadId)
                     swap(mapTestPool, mapTestPoolTmp);
 
                     pblock->vtx.push_back(tx);
-                    nBlockSize += ::GetSerializeSize(tx, SER_NETWORK);
+                    nBlockSize   += nTxSize;
+                    nBlockSigOps += nTxSigOps;
                     vfAlreadyAdded[n] = true;
                     fFoundSomething = true;
                 }
@@ -4320,7 +5159,7 @@ bool BitcoinMiner(int nThreadId)
                     //// debug print
                     if (LogAcceptsCategory("net")) printf("BitcoinMiner:\n");
                     if (LogAcceptsCategory("net")) printf("RandomX proof-of-work found  \n  powhash: %s  \ntarget: %s\n", hash.GetHex().c_str(), hashTarget.GetHex().c_str());
-                    if (LogAcceptsCategory("net")) pblock->print();
+                    if (LogAcceptsCategory("relay")) pblock->print();
 
                 SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_NORMAL);
                 CRITICAL_BLOCK(cs_main)
@@ -4675,9 +5514,17 @@ bool SelectCoins(int64 nTargetValue, set<CWalletTx*>& setCoinsRet)
 
 
 
-bool CreateTransaction(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew, int64& nFeeRequiredRet)
+// presultRet, when given, says WHY this returned false: the caller cannot work
+// it out afterwards. "Coin selection came up short" and "the wallet could not
+// build the transaction" are indistinguishable from the outside -- both are
+// just `false` -- and the difference decides whether a pool defers a payment
+// or counts it against the payment's retry budget. See WalletSendResult.
+bool CreateTransaction(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew, int64& nFeeRequiredRet,
+                       WalletSendResult* presultRet)
 {
     nFeeRequiredRet = 0;
+    if (presultRet)
+        *presultRet = WALLET_SEND_FAILED;
     CRITICAL_BLOCK(cs_main)
     {
         // txdb must be opened before the mapWallet lock
@@ -4708,10 +5555,21 @@ bool CreateTransaction(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew, in
                 // fixed this in 107d9e288.
                 int64 nTotalValue = nValue + nFee;
 
-                // Choose coins to use
+                // Choose coins to use.
+                //
+                // Failing here is a funding shortfall and nothing else: there
+                // is not enough spendable coin for nValue plus the fee this
+                // pass is working with. On the second and later passes that
+                // fee is GetMinFee() of the transaction the first pass built,
+                // so this is also how a wallet that can afford the amount but
+                // not the 11 * CENT charged at 10,000 bytes reports itself.
                 set<CWalletTx*> setCoins;
                 if (!SelectCoins(nTotalValue, setCoins))
+                {
+                    if (presultRet)
+                        *presultRet = WALLET_SEND_INSUFFICIENT_FUNDS;
                     return false;
+                }
                 int64 nValueIn = 0;
                 foreach(CWalletTx* pcoin, setCoins)
                     nValueIn += pcoin->GetCredit();
@@ -4781,6 +5639,8 @@ bool CreateTransaction(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew, in
             }
         }
     }
+    if (presultRet)
+        *presultRet = WALLET_SEND_OK;
     return true;
 }
 
@@ -4843,16 +5703,38 @@ bool CommitTransactionSpent(const CWalletTx& wtxNew)
 
 
 
-bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew)
+// outcomeRet reports what happened rather than only whether it worked. A
+// caller that has to decide what a failure MEANS -- the pool payout thread --
+// cannot reconstruct it from a balance reading afterwards, because the fee
+// that was actually required depends on the size of a transaction that was
+// never built. See WalletSendResult.
+bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew,
+               SendMoneyOutcome& outcomeRet)
 {
+    outcomeRet.result       = WALLET_SEND_FAILED;
+    outcomeRet.nFeeRequired = 0;
     CRITICAL_BLOCK(cs_main)
     {
         int64 nFeeRequired;
-        if (!CreateTransaction(scriptPubKey, nValue, wtxNew, nFeeRequired))
+        WalletSendResult createResult = WALLET_SEND_FAILED;
+        if (!CreateTransaction(scriptPubKey, nValue, wtxNew, nFeeRequired, &createResult))
         {
+            outcomeRet.result       = createResult;
+            outcomeRet.nFeeRequired = nFeeRequired;
             string strError;
             if (nValue + nFeeRequired > GetBalance())
-                strError = strprintf("Error: This is an oversized transaction that requires a transaction fee of %s ", FormatMoney(nFeeRequired).c_str());
+                // Not an oversized transaction -- this branch is simply "the
+                // spendable balance is too small". Saying otherwise (with a fee
+                // of 0.00, because CreateTransaction failed before setting one)
+                // sends anyone reading the log after a failed payout hunting a
+                // transaction-size problem that does not exist.
+                strError = strprintf("Error: insufficient spendable balance:"
+                                     " need %s (plus fee %s) but only %s is spendable"
+                                     " -- mined coin counts as zero until it is %d deep",
+                                     FormatMoney(nValue).c_str(),
+                                     FormatMoney(nFeeRequired).c_str(),
+                                     FormatMoney(GetBalance()).c_str(),
+                                     COINBASE_SPENDABLE_DEPTH);
             else
                 strError = "Error: Transaction creation failed ";
             return error("SendMoney() : %s\n", strError.c_str());
@@ -4876,6 +5758,13 @@ bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew)
         }
         wtxNew.RelayWalletTransaction();
     }
+    outcomeRet.result = WALLET_SEND_OK;
     MainFrameRepaint();
     return true;
 }
+
+bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew)
+{
+    SendMoneyOutcome ignored;
+    return SendMoney(scriptPubKey, nValue, wtxNew, ignored);
+}