1 files changed, 936 insertions, 64 deletions

diff --git a/src/main.cpp b/src/main.cpp
index 77aba89..0fa6b89 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -14,6 +14,7 @@
 #include <atomic>
 #include <mutex>
 #include <thread>
+#include <system_error>
 #include "bip32.h"
 #include "btfaddr.h"
 #include "btftunnel.h"
@@ -41,12 +42,30 @@ unsigned int nTransactionsUpdated = 0;
 map<COutPoint, CInPoint> mapNextTx;
 
 map<uint256, CBlockIndex*> mapBlockIndex;
-// Bitflash genesis -- mined under RandomX PoW on 2026-07-22
-// (nTime 1753142400, nBits 0x1f0fffff, RandomX key "Bitflash/RandomX/v1/...")
-// Bitflash 2026 stable relaunch genesis (2-min blocks, RandomX). Mined values.
-unsigned int GENESIS_NONCE = 3141;
-uint256 hashGenesisBlock("0x5bd7cb255d814e48cebcdfb72da4dc87b34bd774227f8ceb546c5640f4bdc169");
-uint256 hashGenesisMerkleRoot("0x1a45b4482532abb29b10e234d3f13132230525a339ecea91658ffa675a5b1325");
+// Bitflash mainnet genesis -- mined under RandomX PoW for the 2026 stable
+// relaunch. Testnet gets its own resettable genesis below so block indexes,
+// headers, and wallet scans cannot be accidentally mixed across networks.
+static const unsigned int MAINNET_GENESIS_TIME  = 1753315200; // 2026-07-24 00:00:00 UTC
+static const unsigned int MAINNET_GENESIS_NONCE = 3141;
+static const char* MAINNET_GENESIS_TIMESTAMP =
+    "Bitflash 24/Jul/2026 Fair launch: one CPU one vote, no premine";
+static const char* MAINNET_GENESIS_HASH =
+    "0x5bd7cb255d814e48cebcdfb72da4dc87b34bd774227f8ceb546c5640f4bdc169";
+static const char* MAINNET_GENESIS_MERKLE =
+    "0x1a45b4482532abb29b10e234d3f13132230525a339ecea91658ffa675a5b1325";
+
+static const unsigned int TESTNET_GENESIS_TIME  = 1787184000; // 2026-08-20 00:00:00 UTC
+static const unsigned int TESTNET_GENESIS_NONCE = 3199;
+static const char* TESTNET_GENESIS_TIMESTAMP =
+    "Bitflash testnet 20/Aug/2026: resettable public test chain";
+static const char* TESTNET_GENESIS_HASH =
+    "0xa9d11c6d697bcb7aea0653bc088b12dcf9f44e732df205162cf085fd9d9963eb";
+static const char* TESTNET_GENESIS_MERKLE =
+    "0x510b293105e3ff85b8d4c3920e357f85d1a86bf199eb4e7d11f04f380030ec5c";
+
+unsigned int GENESIS_NONCE = MAINNET_GENESIS_NONCE;
+uint256 hashGenesisBlock(MAINNET_GENESIS_HASH);
+uint256 hashGenesisMerkleRoot(MAINNET_GENESIS_MERKLE);
 CBlockIndex* pindexGenesisBlock = NULL;
 int nBestHeight = -1;
 uint256 hashBestChain = 0;
@@ -64,6 +83,137 @@ CBlockIndex* pindexBest = NULL;
 map<uint256, CBlock*> mapOrphanBlocks;
 multimap<uint256, CBlock*> mapOrphanBlocksByPrev;
 
+// Block bodies we have sent a getdata for and not yet received, so the
+// failover pass in SendMessages can tell "requested and being served" from
+// "requested and gone quiet" and re-issue the request to a different peer
+// (#33). Keyed by block hash; setAsked is the peers already tried since the
+// round last restarted, so the retry rotates instead of hammering the
+// announcer that is not serving. Guarded by cs_main, which both the message
+// handlers and SendMessages already hold.
+//
+// Capped small on purpose. At the tip there is one block in flight; during
+// initial download there are legitimately hundreds outstanding to one peer,
+// and rotating those would duplicate the whole download to every other peer.
+//
+// The cap is a shared resource and nothing on the path from inv to insertion
+// can tell a real block hash from 32 random bytes -- AlreadyHave only asks
+// whether we already hold the block, and there is no header to check work
+// against. So the table does not refuse a new hash when it is full; it makes
+// room. See MakeRoomInBlockFetch for the rule, which is what stops one peer
+// filling all eight slots and switching failover off for everybody.
+//
+// The initialisers matter: the insertion path uses operator[] and then tests
+// nTimeFirstAsked == 0 to detect a fresh entry. That worked on
+// value-initialisation alone, but only for as long as nobody gave this struct
+// a constructor.
+struct CBlockFetch
+{
+    int64 nTimeFirstAsked = 0;  // when the first getdata for this block went out
+    int64 nTimeAsked      = 0;  // when the latest getdata went out
+    CAddress addrAnnounced;     // peer whose announcement put this hash here
+    set<CAddress> setAsked;     // peers tried since the round last restarted
+};
+map<uint256, CBlockFetch> mapBlockFetch;
+static const int BLOCK_FETCH_TRACK_MAX = 8;
+// A block nobody has served for this long is not a fetch problem: the hash may
+// have been announced and never existed. Drop the entry rather than getdata
+// forever; a re-announcement recreates it.
+static const int BLOCK_FETCH_GIVEUP_SECS = 10 * 60;
+
+// Failover firing at all is worth saying out loud: it means peers are
+// announcing blocks they then do not serve, which is the pathology of #33 and
+// the thing nobody could otherwise see. Naming the peer on every re-request is
+// a different matter. A peer can drive that line as often as it likes by
+// announcing hashes it will not serve, and what it prints is a peer address,
+// which is the one thing the .btf transport otherwise takes trouble not to
+// spread around. So the per-peer detail sits behind the net category and the
+// unconditional line is a count over a window no peer can shorten: the first
+// failover after a quiet spell prints at once, because the change from "blocks
+// arrive" to "blocks are announced and not served" is the event worth seeing,
+// and everything after it is summarised once a minute.
+static const int BLOCK_FETCH_REPORT_SECS = 60;
+static int64 nBlockFetchWindowStart = 0;
+static int   nBlockFetchFailovers   = 0;
+
+// How stale our own best block may be before we stop calling this the tip.
+// Blocks target two minutes, so this is thirty intervals: far longer than any
+// stall worth failing over from -- the one in #33 ran sixteen minutes -- and
+// far shorter than catching up, which starts hours or days back.
+static const int BLOCK_FETCH_TIP_AGE_SECS = 60 * 60;
+
+// Whether this node is tracking the tip rather than still catching up.
+//
+// Measured off the age of our own best block, not off any height a peer told
+// us. nStartingHeight is optional in the version message and every node
+// released so far sends the short form, so it is -1 for essentially every
+// peer; and where it is filled in later it is filled in from the height of a
+// block that peer served us, which during catch-up tracks our own height and
+// would report "at the tip" for the whole download. Block timestamps are the
+// one clock here that peers cannot move: CheckBlock refuses anything more than
+// two hours ahead and AcceptBlock refuses anything at or before the previous
+// median, so the only way to make this read "at the tip" falsely is to mine,
+// and all that buys is the 15s spacing this code had unconditionally anyway.
+bool IsBlockFetchNearTip()
+{
+    return pindexBest && (int64)pindexBest->nTime > GetTime() - BLOCK_FETCH_TIP_AGE_SECS;
+}
+
+// Drop one entry so a hash announced by addrNew can be tracked.
+//
+// Refusing the insertion instead was a remote off-switch for the whole
+// feature. An inv carrying eight hashes that never existed filled every slot
+// -- nothing between inv and here can tell those from real blocks -- and no
+// genuinely new block was tracked again until the give-up timer expired ten
+// minutes later, re-armable for one message per ten minutes from a single
+// connection.
+//
+// So evict instead, by occupancy: a peer may only take a slot from a peer
+// holding strictly more slots than itself, and otherwise recycles one of its
+// own. That is what keeps eviction from becoming the same attack in a new
+// shape. A peer that has filled the table is by definition the heaviest
+// holder, so its own entries are the only ones it can displace, while a peer
+// announcing its first block holds nothing and therefore always evicts from
+// the heaviest -- a genuine announcement is never refused a slot, whatever the
+// attacker holds or however many connections it holds it from. The one case
+// that costs a real fetch is eight distinct peers holding one entry each,
+// where a ninth takes the oldest; that is a busy healthy node, not an attack,
+// and losing the oldest of eight beats refusing the ninth.
+static void MakeRoomInBlockFetch(const CAddress& addrNew)
+{
+    if (mapBlockFetch.empty())
+        return;
+
+    map<CAddress, int> mapHeld;
+    for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end(); ++mi)
+        mapHeld[(*mi).second.addrAnnounced]++;
+
+    int nMine = mapHeld.count(addrNew) ? mapHeld[addrNew] : 0;
+
+    int nMax = 0;
+    CAddress addrVictim;
+    for (map<CAddress, int>::iterator mi = mapHeld.begin(); mi != mapHeld.end(); ++mi)
+        if ((*mi).second > nMax)
+        {
+            nMax = (*mi).second;
+            addrVictim = (*mi).first;
+        }
+
+    // Nobody is holding more than this peer, so it recycles its own oldest
+    // rather than taking a slot off an equal.
+    if (nMax <= nMine)
+        addrVictim = addrNew;
+
+    map<uint256, CBlockFetch>::iterator miVictim = mapBlockFetch.end();
+    for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end(); ++mi)
+        if ((*mi).second.addrAnnounced == addrVictim &&
+            (miVictim == mapBlockFetch.end() ||
+             (*mi).second.nTimeFirstAsked < (*miVictim).second.nTimeFirstAsked))
+            miVictim = mi;
+
+    if (miVictim != mapBlockFetch.end())
+        mapBlockFetch.erase(miVictim);
+}
+
 map<uint256, CDataStream*> mapOrphanTransactions;
 multimap<uint256, CDataStream*> mapOrphanTransactionsByPrev;
 
@@ -109,7 +259,11 @@ string strPayoutFile;                // participant: /payoutfile with one addres
 int    nHashThreads      = 0;        // participant: /hashthreads override (0 = cores-1)
 string strPoolName       = "Bitflash Pool";
 string strPoolDashboardUrl;
+string strPoolStatusFile;
+string strPoolRoundsFile;
 double dPoolFeePercent   = 0.0;
+bool   fStratumBridge    = false;
+int    nStratumBridgePort = 3333;
 
 static std::atomic<uint64> gParticipantSharesSent{0};
 static std::atomic<uint64> gParticipantSharesAccepted{0};
@@ -118,6 +272,63 @@ static std::atomic<uint64> gParticipantHashRateX1000{0};
 static std::mutex gParticipantStatusMutex;
 static std::string gParticipantStatus;
 
+void SelectGenesisParams(bool fTestNetIn)
+{
+    static bool fGenesisParamsSelected = false;
+    static bool fGenesisParamsTestNet = false;
+    if (fGenesisParamsSelected && fGenesisParamsTestNet == fTestNetIn)
+        return;
+
+    fGenesisParamsSelected = true;
+    fGenesisParamsTestNet = fTestNetIn;
+
+    if (fTestNetIn)
+    {
+        GENESIS_NONCE = TESTNET_GENESIS_NONCE;
+        hashGenesisBlock = uint256(TESTNET_GENESIS_HASH);
+        hashGenesisMerkleRoot = uint256(TESTNET_GENESIS_MERKLE);
+    }
+    else
+    {
+        GENESIS_NONCE = MAINNET_GENESIS_NONCE;
+        hashGenesisBlock = uint256(MAINNET_GENESIS_HASH);
+        hashGenesisMerkleRoot = uint256(MAINNET_GENESIS_MERKLE);
+    }
+}
+
+void SelectChainParams(bool fTestNetIn)
+{
+    SelectNetworkParams(fTestNetIn);
+    SelectGenesisParams(fTestNetIn);
+}
+
+static CBlock BuildGenesisBlock()
+{
+    const char* pszTimestamp = IsTestNet() ?
+        TESTNET_GENESIS_TIMESTAMP : MAINNET_GENESIS_TIMESTAMP;
+
+    CTransaction txNew;
+    txNew.vin.resize(1);
+    txNew.vout.resize(1);
+    txNew.vin[0].scriptSig = CScript() << 486604799 << CBigNum(4) <<
+        vector<unsigned char>((unsigned char*)pszTimestamp,
+                              (unsigned char*)pszTimestamp + strlen(pszTimestamp));
+    txNew.vout[0].nValue = 50 * COIN;
+    txNew.vout[0].scriptPubKey = CScript() <<
+        CBigNum("0x5F1DF16B2B704C8A578D0BBAF74D385CDE12C11EE50455F3C438EF4C3FBCF649B6DE611FEAE06279A60939E028A8D65C10B73071A6F16719274855FEB0FD8A6704") <<
+        OP_CHECKSIG;
+
+    CBlock block;
+    block.vtx.push_back(txNew);
+    block.hashPrevBlock = 0;
+    block.hashMerkleRoot = block.BuildMerkleTree();
+    block.nVersion = 1;
+    block.nTime = IsTestNet() ? TESTNET_GENESIS_TIME : MAINNET_GENESIS_TIME;
+    block.nBits = 0x1f0fffff; // = bnProofOfWorkLimit (Bitflash RandomX floor)
+    block.nNonce = GENESIS_NONCE;
+    return block;
+}
+
 void SetParticipantMiningStatus(const std::string& status)
 {
     // Updates the GUI status string only. Logging is done at each call site
@@ -190,6 +401,9 @@ int ParticipantHashThreadCount()
     return nWorkers - 1;
 }
 
+static void SecureClearBytes(vector<unsigned char>& vch);
+static void SecureClearKeyingMaterial(CKeyingMaterial& vch);
+
 bool AddKey(const CKey& key)
 {
     if (IsWalletEncrypted())
@@ -199,9 +413,13 @@ bool AddKey(const CKey& key)
         vector<unsigned char> vchCryptedSecret;
         if (IsWalletLocked())
             return error("AddKey() : wallet is locked\n");
-        if (!EncryptSecret(vWalletMasterKey, vector<unsigned char>(vchPrivKey.begin(), vchPrivKey.end()),
-                           WalletKeyIV(key.GetPubKey()), vchCryptedSecret))
+        vector<unsigned char> vchPlainSecret(vchPrivKey.begin(), vchPrivKey.end());
+        if (!EncryptSecret(vWalletMasterKey, vchPlainSecret, WalletKeyIV(key.GetPubKey()), vchCryptedSecret))
+        {
+            SecureClearBytes(vchPlainSecret);
             return error("AddKey() : encrypting key failed\n");
+        }
+        SecureClearBytes(vchPlainSecret);
         if (!AddCryptedKey(key.GetPubKey(), vchCryptedSecret))
             return false;
         return CWalletDB().WriteCryptedKey(key.GetPubKey(), vchCryptedSecret);
@@ -225,17 +443,31 @@ bool IsWalletLocked()
     return fWalletEncrypted && fWalletLocked;
 }
 
+static void SecureClearBytes(vector<unsigned char>& vch)
+{
+    if (!vch.empty())
+        OPENSSL_cleanse(&vch[0], vch.size());
+    vch.clear();
+}
+
+static void SecureClearKeyingMaterial(CKeyingMaterial& vch)
+{
+    if (!vch.empty())
+        OPENSSL_cleanse(&vch[0], vch.size());
+    vch.clear();
+}
+
 void LockWallet()
 {
     if (!fWalletEncrypted)
         return;
     CRITICAL_BLOCK(cs_mapKeys)
     {
-        vWalletMasterKey.clear();
+        SecureClearKeyingMaterial(vWalletMasterKey);
         if (!vchCryptedHDMaster.empty())
-            vchHDMaster.clear();
+            SecureClearBytes(vchHDMaster);
         if (!vchCryptedHDChainCode.empty())
-            vchHDChainCode.clear();
+            SecureClearBytes(vchHDChainCode);
         fWalletLocked = true;
     }
 }
@@ -260,14 +492,14 @@ bool DeriveWalletPassphraseKey(const string& strPassphrase,
                            chKey, chIV);
     if (n != 32)
     {
-        memset(chKey, 0, sizeof(chKey));
-        memset(chIV, 0, sizeof(chIV));
+        OPENSSL_cleanse(chKey, sizeof(chKey));
+        OPENSSL_cleanse(chIV, sizeof(chIV));
         return false;
     }
     vchKeyRet.assign(chKey, chKey + sizeof(chKey));
     vchIVRet.assign(chIV, chIV + sizeof(chIV));
-    memset(chKey, 0, sizeof(chKey));
-    memset(chIV, 0, sizeof(chIV));
+    OPENSSL_cleanse(chKey, sizeof(chKey));
+    OPENSSL_cleanse(chIV, sizeof(chIV));
     return true;
 }
 
@@ -328,6 +560,8 @@ bool DecryptSecret(const CKeyingMaterial& vchKey,
         vchPlaintextRet.swap(vchOut);
         fOk = true;
     }
+    if (!fOk)
+        SecureClearBytes(vchOut);
     EVP_CIPHER_CTX_free(ctx);
     return fOk;
 }
@@ -403,6 +637,7 @@ bool GetWalletPrivKey(const vector<unsigned char>& vchPubKey,
         }
 
         CPrivKey vchPrivKey(vchPlaintext.begin(), vchPlaintext.end());
+        SecureClearBytes(vchPlaintext);
         CKey key;
         if (!key.SetPrivKey(vchPrivKey) || key.GetPubKey() != vchPubKey)
         {
@@ -437,11 +672,20 @@ bool UnlockWallet(const string& strPassphrase, string& strErrorRet)
             vector<unsigned char> vchMasterPlain;
             if (!DecryptSecret(vchPassKey, kMasterKey.vchCryptedKey,
                                vchPassIV, vchMasterPlain))
+            {
+                SecureClearBytes(vchPassIV);
                 continue;
+            }
             if (vchMasterPlain.size() != 32)
+            {
+                SecureClearBytes(vchMasterPlain);
+                SecureClearBytes(vchPassIV);
                 continue;
+            }
 
             CKeyingMaterial vchCandidate(vchMasterPlain.begin(), vchMasterPlain.end());
+            SecureClearBytes(vchMasterPlain);
+            SecureClearBytes(vchPassIV);
             bool fValid = mapCryptedKeys.empty();
             for (map<vector<unsigned char>, vector<unsigned char> >::iterator mci = mapCryptedKeys.begin();
                  mci != mapCryptedKeys.end(); ++mci)
@@ -450,6 +694,7 @@ bool UnlockWallet(const string& strPassphrase, string& strErrorRet)
                 if (!DecryptSecret(vchCandidate, (*mci).second, WalletKeyIV((*mci).first), vchPlaintext))
                     break;
                 CPrivKey vchPrivKey(vchPlaintext.begin(), vchPlaintext.end());
+                SecureClearBytes(vchPlaintext);
                 CKey key;
                 if (key.SetPrivKey(vchPrivKey) && key.GetPubKey() == (*mci).first)
                     fValid = true;
@@ -465,10 +710,12 @@ bool UnlockWallet(const string& strPassphrase, string& strErrorRet)
                                        WalletSecretIV("hdmaster"), vchPlainHDMaster) ||
                         vchPlainHDMaster.size() != 32)
                     {
+                        SecureClearBytes(vchPlainHDMaster);
                         strErrorRet = "could not decrypt HD master key";
                         return false;
                     }
                     vchHDMaster = vchPlainHDMaster;
+                    SecureClearBytes(vchPlainHDMaster);
                 }
                 if (!vchCryptedHDChainCode.empty())
                 {
@@ -477,10 +724,12 @@ bool UnlockWallet(const string& strPassphrase, string& strErrorRet)
                                        WalletSecretIV("hdchaincode"), vchPlainHDChainCode) ||
                         vchPlainHDChainCode.size() != 32)
                     {
+                        SecureClearBytes(vchPlainHDChainCode);
                         strErrorRet = "could not decrypt HD chain code";
                         return false;
                     }
                     vchHDChainCode = vchPlainHDChainCode;
+                    SecureClearBytes(vchPlainHDChainCode);
                 }
                 fWalletLocked = false;
                 return true;
@@ -625,7 +874,7 @@ unsigned int nHDNext = 0;
 int nHDKeySchema = HD_SCHEMA_NONE;
 unsigned int nHDReceiveNext = 0;
 unsigned int nHDChangeNext = 0;
-unsigned int nHDCoinType = HD_BIP44_COIN_TYPE_BITFLASH_PROVISIONAL;
+unsigned int nHDCoinType = HD_BIP44_COIN_TYPE_BITFLASH;
 
 string HDKeySchemaName(int nSchema)
 {
@@ -781,7 +1030,7 @@ bool SetHDSeedFromMnemonic(const string& strMnemonic, string& strErrorRet)
 
         if (!CWalletDB().WriteHDMaster(master.privateKey, master.chainCode) ||
             !CWalletDB().WriteHDSchema(HD_SCHEMA_BIP44) ||
-            !CWalletDB().WriteHDCoinType(HD_BIP44_COIN_TYPE_BITFLASH_PROVISIONAL) ||
+            !CWalletDB().WriteHDCoinType(HD_BIP44_COIN_TYPE_BITFLASH) ||
             !CWalletDB().WriteHDNext(0) ||
             !CWalletDB().WriteHDReceiveNext(1) ||
             !CWalletDB().WriteHDChangeNext(0))
@@ -794,7 +1043,7 @@ bool SetHDSeedFromMnemonic(const string& strMnemonic, string& strErrorRet)
         nHDKeySchema   = HD_SCHEMA_BIP44;
         nHDReceiveNext = 1;
         nHDChangeNext  = 0;
-        nHDCoinType    = HD_BIP44_COIN_TYPE_BITFLASH_PROVISIONAL;
+        nHDCoinType    = HD_BIP44_COIN_TYPE_BITFLASH;
 
         // Index 0 is spoken for before it is derived, so a failure below cannot
         // leave the pool free to hand it out as an ordinary key. The cost of
@@ -1670,7 +1919,7 @@ void CWalletTx::RelayWalletTransaction(CTxDB& txdb)
         uint256 hash = GetHash();
         if (!txdb.ContainsTx(hash))
         {
-            if (LogAcceptsCategory("net")) printf("Relaying wtx %s\n", hash.ToString().substr(0,6).c_str());
+            if (LogAcceptsCategory("relay")) printf("Relaying wtx %s\n", hash.ToString().substr(0,6).c_str());
             RelayMessage(CInv(MSG_TX, hash), (CTransaction)*this);
         }
     }
@@ -2480,11 +2729,21 @@ string GetAppDir()
     {
         return ".";
     }
-    static bool fMkdirDone;
-    if (!fMkdirDone)
+    static string strCreatedBaseDir;
+    if (strCreatedBaseDir != strDir)
     {
-        fMkdirDone = true;
         _mkdir(strDir.c_str());
+        strCreatedBaseDir = strDir;
+    }
+    if (IsTestNet())
+    {
+        strDir += "/testnet";
+        static string strCreatedTestnetDir;
+        if (strCreatedTestnetDir != strDir)
+        {
+            _mkdir(strDir.c_str());
+            strCreatedTestnetDir = strDir;
+        }
     }
     return strDir;
 }
@@ -2636,22 +2895,36 @@ bool LoadBlockIndex(bool fAllowNew)
         //     CTxOut(nValue=50.00000000, scriptPubKey=0x5F1DF16B2B704C8A578D0B)
         //   vMerkleTree: 4a5e1e
 
-        // Bitflash genesis block -- own header (fair launch, 2026 stable relaunch)
-        char* pszTimestamp = "Bitflash 24/Jul/2026 Fair launch: one CPU one vote, no premine";
-        CTransaction txNew;
-        txNew.vin.resize(1);
-        txNew.vout.resize(1);
-        txNew.vin[0].scriptSig     = CScript() << 486604799 << CBigNum(4) << vector<unsigned char>((unsigned char*)pszTimestamp, (unsigned char*)pszTimestamp + strlen(pszTimestamp));
-        txNew.vout[0].nValue       = 50 * COIN;
-        txNew.vout[0].scriptPubKey = CScript() << CBigNum("0x5F1DF16B2B704C8A578D0BBAF74D385CDE12C11EE50455F3C438EF4C3FBCF649B6DE611FEAE06279A60939E028A8D65C10B73071A6F16719274855FEB0FD8A6704") << OP_CHECKSIG;
-        CBlock block;
-        block.vtx.push_back(txNew);
-        block.hashPrevBlock = 0;
-        block.hashMerkleRoot = block.BuildMerkleTree();
-        block.nVersion = 1;
-        block.nTime    = 1753315200; // 2026-07-24 00:00:00 UTC (stable relaunch)
-        block.nBits    = 0x1f0fffff; // = bnProofOfWorkLimit (Bitflash RandomX floor)
-        block.nNonce   = GENESIS_NONCE;
+        // Bitflash genesis block -- own header (fair launch)
+        //
+        // Upstream moved the construction into BuildGenesisBlock() so mainnet
+        // and the isolated testnet can share it. The mainnet inputs it uses are
+        // byte-identical to what this block built inline before the merge --
+        // timestamp string, nTime, nNonce, scriptPubKey, nBits and nVersion all
+        // verified equal against MAINNET_GENESIS_* -- so the mainnet genesis
+        // hash is unchanged. The warning below is why that was checked rather
+        // than assumed, and it still applies to those constants:
+        //
+        // Do not change MAINNET_GENESIS_TIMESTAMP, the scriptPubKey,
+        // MAINNET_GENESIS_TIME or MAINNET_GENESIS_NONCE. They are the inputs to
+        // the genesis hash, and the genesis hash is consensus. Changing one on
+        // its own trips the assert below, which is loud and reverts cleanly;
+        // changing one and regenerating GENESIS_NONCE and hashGenesisBlock to
+        // match -- which is exactly what the re-mining branch below prints out
+        // and invites -- gives a node that starts without complaint, builds its
+        // own chain from height 0, and rejects every real peer as being on a
+        // different chain. That one fails silently, and the damage scales with
+        // how many people run the "fixed" build.
+        //
+        // MAINNET_GENESIS_TIME is 1753315200, which is 2025-07-24T00:00:00Z,
+        // while the headline in MAINNET_GENESIS_TIMESTAMP reads 2026 -- as does
+        // the comment upstream put on that constant, which is wrong about the
+        // year. This is a known discrepancy and not a typo in the value: it is
+        // only consensus-critical as an input to the genesis hash, the block
+        // hashes to hashGenesisBlock with it, and every node on the network
+        // agrees. The mismatch is in the launched chain and cannot be corrected
+        // -- see the warning above before deciding otherwise.
+        CBlock block = BuildGenesisBlock();
 
         // If the nonce has not been found yet, mine the genesis once (RandomX)
         // and print the values to be hardcoded in the constants above.
@@ -2676,6 +2949,11 @@ bool LoadBlockIndex(bool fAllowNew)
             printf("powhash = %s\n", block.GetPoWHash().ToString().c_str());
             printf("hash    = %s\n", block.GetHash().ToString().c_str());
             printf("merkle  = %s\n", block.hashMerkleRoot.ToString().c_str());
+            printf("----------------------------------------\n");
+            printf("These constants bring up a NEW chain. Do not paste them\n");
+            printf("into a build for this network to make an edited nTime or\n");
+            printf("pszTimestamp fit -- a node whose genesis differs starts\n");
+            printf("cleanly on a chain of its own and rejects every real peer.\n");
             printf("========================================\n");
         }
 
@@ -3221,15 +3499,61 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
         vRecv >> *pblock;
 
         //// debug print
-        if (LogAcceptsCategory("net")) { printf("received block:\n"); pblock->print(); }
+        if (LogAcceptsCategory("relay")) { printf("received block:\n"); pblock->print(); }
 
         CInv inv(MSG_BLOCK, pblock->GetHash());
         pfrom->AddInventoryKnown(inv);
 
+        // GetHash() covers the 80-byte header and nothing else, so the hash
+        // coming out right does not make this the block we asked for. Every
+        // peer that saw X announced holds X's header, and can answer our
+        // getdata with that header bolted onto a transaction list of its own
+        // invention -- the reply still hashes to X. hashMerkleRoot is the only
+        // thing binding the header to the body, so check it here, before the
+        // mapBlockFetch entry is touched and before CheckBlock spends a
+        // RandomX hash on a body already known to be forged.
+        //
+        // There is no honest way to arrive here. Peer traffic rides the .btf
+        // channel, which is XChaCha20-Poly1305, so a body that arrives at all
+        // arrived intact: a mismatch is the peer's own construction, not line
+        // noise. Drop the peer and leave the fetch outstanding so the failover
+        // sweep asks somebody else for the real X, rather than recording X as
+        // delivered on the strength of a header anyone could copy.
+        if (pblock->hashMerkleRoot != pblock->BuildMerkleTree())
+        {
+            if (LogAcceptsCategory("net"))
+                printf("peer %s served a forged body for %s\n",
+                       pfrom->addr.ToString().c_str(), inv.ToString().c_str());
+            // One line per connection: ProcessMessages keeps draining the
+            // receive buffer after fDisconnect is set, so a peer that packs
+            // many forged bodies into one buffer must not get one log line
+            // for each of them.
+            if (!pfrom->fDisconnect)
+                printf("block fetch: a peer answered the request for %s with a body that is not "
+                       "that block -- dropping it\n", inv.hash.ToString().substr(0,14).c_str());
+            pfrom->fDisconnect = true;
+            return error("ProcessMessage() : forged block body for %s",
+                         inv.hash.ToString().substr(0,14).c_str());
+        }
+
         if (ProcessBlock(pfrom, pblock.release()))
         {
             mapAlreadyAskedFor.erase(inv);
 
+            // The body arrived and validated, so the fetch really is over:
+            // the block is now in mapBlockIndex, or parked in mapOrphanBlocks,
+            // and either way AlreadyHave answers for it from here on.
+            //
+            // This has to stay inside the success branch, next to the erase
+            // above. When validation rejects a body nothing is stored,
+            // AlreadyHave stays false, and the mapAskFor entry was already
+            // consumed when the getdata went out -- so erasing the tracking
+            // here would leave the block requested from nobody at all until
+            // some peer happened to re-announce it. That is exactly the stall
+            // of #33, and erasing before ProcessBlock made it reachable on
+            // demand.
+            mapBlockFetch.erase(inv.hash);
+
             // A peer that just handed us a block is demonstrably at least at
             // that block's height. Without this, nStartingHeight is a snapshot
             // taken once during the version handshake and never touched again,
@@ -3354,12 +3678,119 @@ bool SendMessages(CNode* pto)
             const CInv& inv = (*pto->mapAskFor.begin()).second;
             if (LogAcceptsCategory("net")) printf("sending getdata: %s\n", inv.ToString().c_str());
             if (!AlreadyHave(txdb, inv))
+            {
                 vAskFor.push_back(inv);
+                // Blocks get their delivery tracked so the failover pass
+                // below can chase the ones that go quiet.
+                if (inv.type == MSG_BLOCK)
+                {
+                    // Full, and this is a hash we are not already tracking:
+                    // make room rather than drop it on the floor, or one peer
+                    // announcing eight hashes turns failover off for everyone.
+                    if (!mapBlockFetch.count(inv.hash) &&
+                        mapBlockFetch.size() >= BLOCK_FETCH_TRACK_MAX)
+                        MakeRoomInBlockFetch(pto->addr);
+
+                    if (mapBlockFetch.count(inv.hash) ||
+                        mapBlockFetch.size() < BLOCK_FETCH_TRACK_MAX)
+                    {
+                        CBlockFetch& fetch = mapBlockFetch[inv.hash];
+                        if (fetch.nTimeFirstAsked == 0)
+                        {
+                            fetch.nTimeFirstAsked = GetTime();
+                            // Who is answerable for this hash existing. Set
+                            // once, on creation: the failover sweep asks other
+                            // peers later, and none of them chose to announce
+                            // it, so none of them should be charged for it.
+                            fetch.addrAnnounced = pto->addr;
+                        }
+                        fetch.nTimeAsked = GetTime();
+                        fetch.setAsked.insert(pto->addr);
+                    }
+                }
+            }
             pto->mapAskFor.erase(pto->mapAskFor.begin());
         }
         if (!vAskFor.empty())
             pto->PushMessage("getdata", vAskFor);
 
+
+        //
+        // Message: getdata (block fetch failover)
+        //
+        // A requested block that has not arrived in BLOCK_FETCH_RETRY_SECS is
+        // not still in transit -- a body is at most 1 MB and somebody
+        // demonstrably has it -- so ask somebody else instead of waiting on
+        // whoever was asked first (#33). Each peer the message handler visits
+        // takes at most one turn per block per round; once every connected
+        // peer has had its turn and a further interval passes with nobody
+        // new to ask, the round restarts. A peer that declared itself a
+        // client cannot serve block bodies and is no use as a target.
+        if (!pto->fClient)
+        {
+            vector<CInv> vFailover;
+            int64 nNowSecs = GetTime();
+            for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end();)
+            {
+                CBlockFetch& fetch = (*mi).second;
+                CInv inv(MSG_BLOCK, (*mi).first);
+                if (AlreadyHave(txdb, inv))
+                {
+                    // Arrived by some other road -- our own miner, an orphan
+                    // parked in mapOrphanBlocks. Nothing left to chase.
+                    mapBlockFetch.erase(mi++);
+                    continue;
+                }
+                if (nNowSecs - fetch.nTimeFirstAsked > BLOCK_FETCH_GIVEUP_SECS)
+                {
+                    printf("block fetch: giving up on %s -- no peer served it in %d s\n",
+                           inv.ToString().c_str(), (int)(nNowSecs - fetch.nTimeFirstAsked));
+                    mapBlockFetch.erase(mi++);
+                    continue;
+                }
+                if (nNowSecs - fetch.nTimeAsked >= BLOCK_FETCH_RETRY_SECS)
+                {
+                    // The handler loop visits every peer within ~100ms, so a
+                    // request stale by two full intervals means nobody outside
+                    // setAsked was there to ask. Start the round over.
+                    if (nNowSecs - fetch.nTimeAsked >= 2 * BLOCK_FETCH_RETRY_SECS)
+                        fetch.setAsked.clear();
+                    if (!fetch.setAsked.count(pto->addr))
+                    {
+                        // Which block, how long, and which peer we are trying
+                        // next. Behind the category because it names a peer
+                        // and a peer decides how often it is written.
+                        if (LogAcceptsCategory("net"))
+                            printf("block fetch failover: %s unanswered for %d s, re-requesting from %s\n",
+                                   inv.ToString().c_str(), (int)(nNowSecs - fetch.nTimeAsked),
+                                   pto->addr.ToString().c_str());
+
+                        // The unconditional half: no addresses, and at most
+                        // one line per BLOCK_FETCH_REPORT_SECS however hard a
+                        // peer tries. See the counters for the reasoning.
+                        nBlockFetchFailovers++;
+                        if (nNowSecs - nBlockFetchWindowStart >= BLOCK_FETCH_REPORT_SECS)
+                        {
+                            printf("block fetch: %d block request%s went unanswered and %s been "
+                                   "re-asked of other peers (%d tracked)\n",
+                                   nBlockFetchFailovers, nBlockFetchFailovers == 1 ? "" : "s",
+                                   nBlockFetchFailovers == 1 ? "has" : "have",
+                                   (int)mapBlockFetch.size());
+                            nBlockFetchWindowStart = nNowSecs;
+                            nBlockFetchFailovers   = 0;
+                        }
+
+                        vFailover.push_back(inv);
+                        fetch.nTimeAsked = nNowSecs;
+                        fetch.setAsked.insert(pto->addr);
+                    }
+                }
+                ++mi;
+            }
+            if (!vFailover.empty())
+                pto->PushMessage("getdata", vFailover);
+        }
+
     }
     return true;
 }
@@ -3620,6 +4051,14 @@ static void ParticipantHashWorker(ParticipantJobShared* sh, int idx, int nWorker
     RandomXDestroyMinerVM(vm);
 }
 
+// Run one participant session: resolve the pool, open the tunnel, subscribe,
+// hash, submit shares. Returns true only if the pool actually handed out work
+// -- at least one well-formed mining.notify arrived. Everything else is false,
+// including a tunnel that opened and was dropped before any job.
+//
+// The caller's reconnect backoff keys off this return value, so any path added
+// here that leaves the session without work MUST return false. "The session
+// ended tidily" is not the question being asked.
 static bool PoolParticipantMiner()
 {
     // ------------------------------------------------------------------
@@ -3697,6 +4136,33 @@ static bool PoolParticipantMiner()
     }
     LogPrint("worker", "[worker] pool resolved to meeting node %s\n", meetingHostPort.c_str());
 
+    // The descriptor names ONE meeting node, but the pool parks a
+    // registration at every relay it knows (one accept thread per relay,
+    // rpc.cpp:AcceptOneFn), so any seed relay can pair us. Insisting on the
+    // advertised entry forever turns one bad path into a miner that idles
+    // indefinitely while a working path exists (issue #17); after a few
+    // consecutive tunnel failures, rotate the seed relays into the attempts
+    // too. Only ONE participant session runs (StartMinerThreads), so these
+    // statics are single-threaded.
+    static const int TUNNEL_FAILOVER_AFTER = 3;
+    static int nTunnelFails = 0;      // consecutive tunnel failures, this pool
+    static size_t iFailoverRelay = 0; // rotation cursor over vBtfMeetingRelays
+    static std::string strFailPool;   // pool the counters belong to
+    if (strFailPool != strParticipantPool) {
+        strFailPool = strParticipantPool;
+        nTunnelFails = 0;
+        iFailoverRelay = 0;
+    }
+    if (nTunnelFails >= TUNNEL_FAILOVER_AFTER && !vBtfMeetingRelays.empty()) {
+        std::string alt = vBtfMeetingRelays[iFailoverRelay++ % vBtfMeetingRelays.size()];
+        if (alt != meetingHostPort) {
+            LogPrint("worker", "[worker] advertised meeting node %s failed %d"
+                     " times in a row -- trying seed relay %s instead\n",
+                     meetingHostPort.c_str(), nTunnelFails, alt.c_str());
+            meetingHostPort = alt;
+        }
+    }
+
     size_t colon = meetingHostPort.rfind(':');
     if (colon == std::string::npos) {
         LogPrint("worker", "[worker] bad meeting node format '%s'\n", meetingHostPort.c_str());
@@ -3716,15 +4182,18 @@ static bool PoolParticipantMiner()
     // Step 2b: open encrypted tunnel to pool
     // ------------------------------------------------------------------
     SetParticipantMiningStatus("opening tunnel");
+    btf::TunnelFail tunnelFail = btf::TUNNEL_FAIL_NONE;
     s = btf::BtfClientTunnel(host.c_str(), (unsigned short)port,
-                             target_pubkey, service_enc_pub);
+                             target_pubkey, service_enc_pub, &tunnelFail);
     if (s == INVALID_SOCKET) {
-        LogPrint("worker", "[worker] tunnel connect FAILED via %s"
-                 " (relay unreachable or pool not listening)\n",
-                 meetingHostPort.c_str());
-        SetParticipantMiningStatus("tunnel connect failed");
+        nTunnelFails++;
+        LogPrint("worker", "[worker] tunnel connect FAILED via %s: %s\n",
+                 meetingHostPort.c_str(), btf::TunnelFailText(tunnelFail));
+        SetParticipantMiningStatus(std::string("tunnel connect failed: ")
+                                   + btf::TunnelFailText(tunnelFail));
         return false;
     }
+    nTunnelFails = 0;
     LogPrint("worker", "[worker] tunnel open via %s\n", meetingHostPort.c_str());
     SetParticipantMiningStatus("tunnel open");
     }
@@ -3857,9 +4326,32 @@ connected:
     std::vector<ParticipantShareHit> shareHits;
     std::mutex shareHitsMtx;
     std::vector<std::thread> hashThreads;
-    for (int i = 0; i < nWorkers; i++)
-        hashThreads.emplace_back(ParticipantHashWorker, &jobShared, i, nWorkers,
-                                 &shareHits, &shareHitsMtx);
+    try
+    {
+        for (int i = 0; i < nWorkers; i++)
+            hashThreads.emplace_back(ParticipantHashWorker, &jobShared, i, nWorkers,
+                                     &shareHits, &shareHitsMtx);
+    }
+    catch (const std::system_error& e)
+    {
+        // A refused pthread_create used to reach std::terminate here and
+        // kill the worker mid-session -- observed twice on an otherwise
+        // healthy participant. Stop the workers that did start the same way
+        // the disconnect path below does, drop this pool connection, and let
+        // the caller's reconnect loop try again once the pressure clears.
+        LogPrint("worker", "[worker] cannot spawn hash threads (%s)"
+                 " -- dropping pool connection\n", e.what());
+        SetParticipantMiningStatus("hash thread spawn failed");
+        {
+            std::lock_guard<std::mutex> lk(jobShared.mtx);
+            jobShared.stop = true;
+            jobShared.haveJob = false;
+        }
+        for (std::thread& t : hashThreads)
+            t.join();
+        closesocket(s);
+        return false;
+    }
     LogPrint("worker", "[worker] spawned %d hash threads on shared RandomX dataset\n",
              nWorkers);
     const uint64 sessionStartHashes = gParticipantHashes.load();
@@ -3870,8 +4362,17 @@ connected:
     std::string jobId;
     unsigned char header[80] = {};
     uint256 target;
+    // Cached answer to "which block is this job built on", for the
+    // mining.notify handler below -- see the comment there. Session-local, so
+    // a reconnect re-resolves rather than trusting an answer obtained before
+    // a possible change of pool.
+    uint256 hashPrevResolved;           // prevhash the cached answer describes
+    bool fPrevResolved       = false;   // whether that answer exists yet
+    int  nPrevHeight         = -1;      // its height, or -1 == unknown to us
+    int  nBestHeightResolved = -1;      // nBestHeight when we last resolved
     double currentDifficulty = 1.0; // updated by mining.set_difficulty from pool
     bool haveJob         = false;
+    bool gotAnyJob       = false; // any job at all this session -- the return value
     bool gotSubscribeAck = false;
     bool gotAuthorizeAck = false;
     int64 authWaitStart  = 0;
@@ -3988,8 +4489,9 @@ connected:
                                     jobId = newJobId;
                                     memcpy(header, hdrBytes.data(), 80);
                                     memcpy(&target, tgtBytes.data(), 32);
-                                    haveJob = true;
-                                    nNonce  = 1;
+                                    haveJob   = true;
+                                    gotAnyJob = true;
+                                    nNonce    = 1;
                                     {
                                         std::lock_guard<std::mutex> lk(jobShared.mtx);
                                         memcpy(jobShared.header, header, 80);
@@ -3998,8 +4500,64 @@ connected:
                                         jobShared.jobSeq++;
                                         jobShared.haveJob = true;
                                     }
-                                    LogPrint("worker", "[pool->worker] new job %s received\n",
-                                             jobId.c_str());
+                                    // Log the chain position the pool is
+                                    // building on, so a stale or private
+                                    // fork is auditable from worker logs.
+                                    // The prevhash comes from the header we
+                                    // actually hash (== p[2] of the notify);
+                                    // a brief cs_main lookup is safe here --
+                                    // this thread holds no other lock.
+                                    //
+                                    // Resolving it is the expensive half, and
+                                    // this is the socket-reading thread: block
+                                    // validation can hold cs_main for a long
+                                    // time, and every moment spent waiting on
+                                    // it here is a moment set_difficulty and
+                                    // share responses are not being handled.
+                                    // Most notifies in a round are a new job
+                                    // on the SAME tip, so the answer is cached
+                                    // and re-resolved only when it could come
+                                    // out differently: a prevhash we have not
+                                    // resolved, or one we could NOT resolve
+                                    // last time while the chain has since
+                                    // moved (unknown -> known). A block's
+                                    // height is fixed once mapBlockIndex knows
+                                    // it, so a cached "known" never goes
+                                    // stale. nBestHeight is read unlocked on
+                                    // purpose -- it only decides whether to
+                                    // repeat a lookup, never what gets
+                                    // printed, so a stale read costs at most
+                                    // one deferred or one extra lookup.
+                                    // The line still prints in full for every
+                                    // job, cached or not.
+                                    uint256 hashPrev;
+                                    memcpy(&hashPrev, header + 4, 32);
+                                    if (LogAcceptsCategory("worker"))
+                                    {
+                                        int nBestHeightNow = nBestHeight;
+                                        if (!fPrevResolved
+                                            || hashPrev != hashPrevResolved
+                                            || (nPrevHeight < 0 && nBestHeightNow != nBestHeightResolved))
+                                        {
+                                            nPrevHeight = -1;
+                                            CRITICAL_BLOCK(cs_main)
+                                            {
+                                                map<uint256, CBlockIndex*>::iterator mi = mapBlockIndex.find(hashPrev);
+                                                if (mi != mapBlockIndex.end())
+                                                    nPrevHeight = (*mi).second->nHeight;
+                                            }
+                                            hashPrevResolved    = hashPrev;
+                                            nBestHeightResolved = nBestHeightNow;
+                                            fPrevResolved       = true;
+                                        }
+                                        if (nPrevHeight >= 0)
+                                            LogPrint("worker", "[pool->worker] new job %s received, prevhash %s (known, job height %d)\n",
+                                                     jobId.c_str(), hashPrev.GetHex().c_str(),
+                                                     nPrevHeight + 1);
+                                        else
+                                            LogPrint("worker", "[pool->worker] new job %s received, prevhash %s (unknown to our chain)\n",
+                                                     jobId.c_str(), hashPrev.GetHex().c_str());
+                                    }
                                     SetParticipantMiningStatus("hashing job " + jobId);
                                 }
                             }
@@ -4125,9 +4683,197 @@ connected:
              (unsigned long long)hashesSinceSample,
              (unsigned long long)sessionSharesSent,
              (unsigned long long)sessionSharesAccepted);
+    // Not "we got here", which is true of a tunnel the pool accepted and then
+    // dropped without ever sending a job -- exactly the case the caller's
+    // backoff exists for. Reaching the end of the session is not evidence the
+    // session was worth anything; a job is.
+    return gotAnyJob;
+}
+
+// ---------------------------------------------------------------------------
+// Local Stratum bridge -- lets external miners speak plain Stratum to
+// 127.0.0.1 while Bitflash opens the .btf tunnel to the selected pool.
+// ---------------------------------------------------------------------------
+
+struct StratumBridgeClientCtx
+{
+    SOCKET miner;
+    std::string pool;
+};
+
+static bool BridgeSendAll(SOCKET s, const char* p, int n)
+{
+    int off = 0;
+    while (off < n)
+    {
+        int r = send(s, p + off, n - off, 0);
+        if (r <= 0)
+            return false;
+        off += r;
+    }
     return true;
 }
 
+static void BridgePump(SOCKET a, SOCKET b)
+{
+    char buf[8192];
+    while (!fShutdown)
+    {
+        fd_set rd;
+        FD_ZERO(&rd);
+        FD_SET(a, &rd);
+        FD_SET(b, &rd);
+        SOCKET maxfd = a > b ? a : b;
+        struct timeval tv = {1, 0};
+        int r = select((int)maxfd + 1, &rd, NULL, NULL, &tv);
+        if (r <= 0)
+            continue;
+
+        if (FD_ISSET(a, &rd))
+        {
+            int n = recv(a, buf, sizeof(buf), 0);
+            if (n <= 0 || !BridgeSendAll(b, buf, n))
+                break;
+        }
+        if (FD_ISSET(b, &rd))
+        {
+            int n = recv(b, buf, sizeof(buf), 0);
+            if (n <= 0 || !BridgeSendAll(a, buf, n))
+                break;
+        }
+    }
+}
+
+static void ThreadStratumBridgeClient(void* arg)
+{
+    StratumBridgeClientCtx* ctx = (StratumBridgeClientCtx*)arg;
+    SOCKET miner = ctx->miner;
+    std::string pool = ctx->pool;
+    delete ctx;
+
+    unsigned char target_pubkey[32];
+    if (!btf::ParseAddress(pool, target_pubkey))
+    {
+        LogPrint("worker", "[bridge] invalid pool .btf address: %s\n", pool.c_str());
+        BtfCloseSocket(miner);
+        return;
+    }
+
+    std::string meetingHostPort;
+    unsigned char service_enc_pub[32];
+    if (!BtfResolve(pool, meetingHostPort, service_enc_pub))
+    {
+        LogPrint("worker", "[bridge] failed to resolve pool %s\n", pool.c_str());
+        BtfCloseSocket(miner);
+        return;
+    }
+
+    size_t colon = meetingHostPort.rfind(':');
+    if (colon == std::string::npos)
+    {
+        LogPrint("worker", "[bridge] bad pool endpoint '%s'\n", meetingHostPort.c_str());
+        BtfCloseSocket(miner);
+        return;
+    }
+    std::string host = meetingHostPort.substr(0, colon);
+    int port = atoi(meetingHostPort.substr(colon + 1).c_str());
+    if (port <= 0 || port > 65535)
+    {
+        LogPrint("worker", "[bridge] bad pool port in '%s'\n", meetingHostPort.c_str());
+        BtfCloseSocket(miner);
+        return;
+    }
+
+    SOCKET poolSock = btf::BtfClientTunnel(host.c_str(), (unsigned short)port,
+                                           target_pubkey, service_enc_pub);
+    if (poolSock == INVALID_SOCKET)
+    {
+        LogPrint("worker", "[bridge] tunnel connect failed for pool %s via %s\n",
+                 pool.c_str(), meetingHostPort.c_str());
+        BtfCloseSocket(miner);
+        return;
+    }
+
+    LogPrint("worker", "[bridge] miner connected to pool %s via %s\n",
+             pool.c_str(), meetingHostPort.c_str());
+    BridgePump(miner, poolSock);
+    BtfCloseSocket(poolSock);
+    BtfCloseSocket(miner);
+    LogPrint("worker", "[bridge] miner disconnected from pool %s\n", pool.c_str());
+}
+
+void ThreadStratumBridge(void*)
+{
+    if (strParticipantPool.empty())
+    {
+        printf("Stratum bridge: no pool selected. Use /stratumbridge=POOL_BTF_ADDRESS\n");
+        return;
+    }
+
+    SOCKET listener = BtfSocketTag(socket(AF_INET, SOCK_STREAM, IPPROTO_TCP),
+                                   SOCK_STRATUM_BRIDGE);
+    if (listener == INVALID_SOCKET)
+    {
+        printf("Stratum bridge: could not create listen socket\n");
+        return;
+    }
+
+    int yes = 1;
+    setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, (char*)&yes, sizeof(yes));
+
+    sockaddr_in addr;
+    memset(&addr, 0, sizeof(addr));
+    addr.sin_family = AF_INET;
+    addr.sin_addr.s_addr = htonl(0x7f000001);
+    addr.sin_port = htons((unsigned short)nStratumBridgePort);
+
+    if (bind(listener, (sockaddr*)&addr, sizeof(addr)) != 0 ||
+        listen(listener, 16) != 0)
+    {
+        printf("Stratum bridge: could not listen on 127.0.0.1:%d\n",
+               nStratumBridgePort);
+        BtfCloseSocket(listener);
+        return;
+    }
+
+    printf("Stratum bridge: listening on 127.0.0.1:%d for pool %s\n",
+           nStratumBridgePort, strParticipantPool.c_str());
+
+    while (!fShutdown)
+    {
+        fd_set rd;
+        FD_ZERO(&rd);
+        FD_SET(listener, &rd);
+        struct timeval tv = {1, 0};
+        if (select((int)listener + 1, &rd, NULL, NULL, &tv) <= 0)
+            continue;
+
+        sockaddr_in cli;
+#ifdef _WIN32
+        int len = sizeof(cli);
+#else
+        socklen_t len = sizeof(cli);
+#endif
+        SOCKET miner = BtfSocketTag(accept(listener, (sockaddr*)&cli, &len),
+                                    SOCK_STRATUM_BRIDGE);
+        if (miner == INVALID_SOCKET)
+            continue;
+
+        StratumBridgeClientCtx* ctx = new StratumBridgeClientCtx();
+        ctx->miner = miner;
+        ctx->pool = strParticipantPool;
+        if (_beginthread(ThreadStratumBridgeClient, 0, ctx) == (uintptr_t)-1)
+        {
+            delete ctx;
+            BtfCloseSocket(miner);
+            LogPrint("worker", "[bridge] failed to spawn client thread\n");
+        }
+    }
+
+    BtfCloseSocket(listener);
+    printf("Stratum bridge: stopped\n");
+}
+
 bool BitcoinMiner(int nThreadId)
 {
     // Relay mode: never mines, just relays/syncs. (Shouldn't normally get here
@@ -4138,11 +4884,51 @@ bool BitcoinMiner(int nThreadId)
     // Participant mode: connect to external pool instead of mining solo/operator
     if (nMineMode == MINE_PARTICIPANT)
     {
+        // An attempt that never got work backs off (10s doubling to 120s)
+        // instead of hammering the same path every flat 10s, and a streak
+        // lasting minutes is said at printf level: the identical once-per-10s
+        // LogPrint line is how a worker idled all night unnoticed (issue #17).
+        //
+        // Only a session the pool actually sent a job to resets either. The
+        // weaker test -- "the session returned" -- was gameable: a pool that
+        // completes the tunnel and drops without ever sending work leaves by
+        // the same tidy cleanup path a healthy one does, which would pin the
+        // retry at 10s forever and defeat the backoff in exactly the scenario
+        // it exists for.
+        int   nRetrySecs    = 10;
+        int64 nFailingSince = 0;
         while (fGenerateBitcoins && nMineMode == MINE_PARTICIPANT && !fShutdown) {
-            PoolParticipantMiner();
+            bool fGotWork = PoolParticipantMiner();
             if (fGenerateBitcoins && nMineMode == MINE_PARTICIPANT && !fShutdown) {
-                LogPrint("worker", "PoolParticipantMiner: reconnecting in 10s\n");
-                for (int i = 0; i < 10 && !fShutdown; i++) Sleep(1000);
+                if (fGotWork) {
+                    nRetrySecs    = 10;
+                    nFailingSince = 0;
+                } else {
+                    if (nFailingSince == 0)
+                        nFailingSince = GetTime();
+                    int64 nMins = (GetTime() - nFailingSince) / 60;
+                    if (nMins >= 1)
+                        printf("[worker] connection to pool %s has been failing"
+                               " for %lld minutes\n",
+                               strParticipantPool.c_str(), (long long)nMins);
+                }
+                LogPrint("worker", "PoolParticipantMiner: reconnecting in %ds\n",
+                         nRetrySecs);
+                // Poll everything the enclosing while polls, not just
+                // fShutdown. Raising the ceiling to 120s made a
+                // shutdown-only predicate expensive: after the operator
+                // clears Generate or switches to Relay, the session -- and
+                // the vfThreadRunning[3] slot that gates restarting it --
+                // would stay held for up to two minutes. Measured 119s
+                // before, 1s after.
+                for (int i = 0; i < nRetrySecs && !fShutdown && fGenerateBitcoins
+                                && nMineMode == MINE_PARTICIPANT; i++)
+                    Sleep(1000);
+                if (!fGotWork && nRetrySecs < 120) {
+                    nRetrySecs *= 2;
+                    if (nRetrySecs > 120)
+                        nRetrySecs = 120;
+                }
             }
         }
         return true;
@@ -4244,7 +5030,6 @@ bool BitcoinMiner(int nThreadId)
             map<uint256, CTxIndex> mapTestPool;
             vector<char> vfAlreadyAdded(mapTransactions.size());
             bool fFoundSomething = true;
-            unsigned int nBlockSize = 0;
             // Assembly must stop below the consensus cap that CheckBlock()
             // enforces, or we mine a block our own node then rejects.
             //
@@ -4255,9 +5040,30 @@ bool BitcoinMiner(int nThreadId)
             // meant solving a block and throwing it away -- with this pool at
             // ~90% of hashrate, that is the network stalling, not just us.
             //
-            // Half the cap, keeping the original margin: the test runs before
-            // a transaction is added, so the loop can overshoot by one tx.
-            while (fFoundSomething && nBlockSize < MAX_BLOCK_SIZE/2)
+            // The budget test then sat only on this outer while, and the
+            // comment claimed that bounded the overshoot to a single
+            // transaction. It did not. The inner for walks all of
+            // mapTransactions with no test of its own, so one pass could append
+            // the entire mempool: the overshoot was bounded by mempool size,
+            // which is to say not bounded at all. Ask per transaction, before
+            // appending, and the overshoot is zero rather than small.
+            //
+            // Seeded with what the block already weighs -- header, tx count,
+            // coinbase -- because CheckBlock() weighs the whole serialized
+            // block and not just the transactions we chose to add to it.
+            unsigned int nBlockSize = ::GetSerializeSize(*pblock, SER_DISK);
+            // Sigops are a budget too, and CheckBlock() enforces one that no
+            // assembler here counted against. Bytes do not bound validation
+            // cost: every OP_CHECKSIG is an elliptic-curve verification, so a
+            // template well inside the size limit can still be refused for
+            // demanding more work than a block is allowed to. Counted with
+            // CTransaction::GetSigOpCount, the function CheckBlock() itself
+            // sums, so the two cannot disagree about what a transaction costs.
+            //
+            // Seeded from the coinbase because CheckBlock() sums over all of
+            // vtx, coinbase included.
+            unsigned int nBlockSigOps = pblock->vtx[0].GetSigOpCount();
+            while (fFoundSomething && nBlockSize < MAX_BLOCK_SIZE_GEN)
             {
                 fFoundSomething = false;
                 unsigned int n = 0;
@@ -4269,6 +5075,29 @@ bool BitcoinMiner(int nThreadId)
                     if (tx.IsCoinBase() || !tx.IsFinal())
                         continue;
 
+                    // Skip, not break: a transaction too big for the room left
+                    // says nothing about the next one, which may still fit.
+                    //
+                    // This is also the only ceiling on a single transaction's
+                    // size anywhere on the path into a block. CheckTransaction
+                    // does not cap it and neither does AcceptTransaction, so
+                    // the mempool will hold one of any size the wire allows;
+                    // without this test a lone 1.5 MB transaction offering a
+                    // fat fee is selected, and every template built from that
+                    // mempool is one CheckBlock() throws away. The fee is never
+                    // paid, because the block never confirms.
+                    //
+                    // Deliberately before ConnectInputs and not after:
+                    // ConnectInputs adds this transaction's fee to nFees by
+                    // reference on success. Passing it and then declining the
+                    // transaction would credit the coinbase for a fee no
+                    // transaction in the block pays, and the block would be
+                    // rejected for a wholly different reason.
+                    unsigned int nTxSize   = ::GetSerializeSize(tx, SER_NETWORK);
+                    unsigned int nTxSigOps = tx.GetSigOpCount();
+                    if (!BlockTemplateFits(nBlockSize, nBlockSigOps, nTxSize, nTxSigOps))
+                        continue;
+
                     // Transaction fee requirements, mainly only needed for flood control
                     // Under 10K (about 80 inputs) is free for first 100 transactions
                     // Base rate is 0.01 per KB
@@ -4280,7 +5109,8 @@ bool BitcoinMiner(int nThreadId)
                     swap(mapTestPool, mapTestPoolTmp);
 
                     pblock->vtx.push_back(tx);
-                    nBlockSize += ::GetSerializeSize(tx, SER_NETWORK);
+                    nBlockSize   += nTxSize;
+                    nBlockSigOps += nTxSigOps;
                     vfAlreadyAdded[n] = true;
                     fFoundSomething = true;
                 }
@@ -4329,7 +5159,7 @@ bool BitcoinMiner(int nThreadId)
                     //// debug print
                     if (LogAcceptsCategory("net")) printf("BitcoinMiner:\n");
                     if (LogAcceptsCategory("net")) printf("RandomX proof-of-work found  \n  powhash: %s  \ntarget: %s\n", hash.GetHex().c_str(), hashTarget.GetHex().c_str());
-                    if (LogAcceptsCategory("net")) pblock->print();
+                    if (LogAcceptsCategory("relay")) pblock->print();
 
                 SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_NORMAL);
                 CRITICAL_BLOCK(cs_main)
@@ -4435,6 +5265,9 @@ WalletRecoveryAudit GetWalletRecoveryAudit()
     CRITICAL_BLOCK(cs_keyPool)
     {
         audit.fHaveSeed = HaveHDSeed();
+        audit.fSeedEncryptedLocked = !audit.fHaveSeed &&
+                                     (!vchCryptedHDMaster.empty() ||
+                                      !vchCryptedHDChainCode.empty());
         audit.nSchema = nHDKeySchema;
         audit.nDerivedKnown = nHDNext;
         audit.nReceiveNext = nHDReceiveNext;
@@ -4681,9 +5514,17 @@ bool SelectCoins(int64 nTargetValue, set<CWalletTx*>& setCoinsRet)
 
 
 
-bool CreateTransaction(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew, int64& nFeeRequiredRet)
+// presultRet, when given, says WHY this returned false: the caller cannot work
+// it out afterwards. "Coin selection came up short" and "the wallet could not
+// build the transaction" are indistinguishable from the outside -- both are
+// just `false` -- and the difference decides whether a pool defers a payment
+// or counts it against the payment's retry budget. See WalletSendResult.
+bool CreateTransaction(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew, int64& nFeeRequiredRet,
+                       WalletSendResult* presultRet)
 {
     nFeeRequiredRet = 0;
+    if (presultRet)
+        *presultRet = WALLET_SEND_FAILED;
     CRITICAL_BLOCK(cs_main)
     {
         // txdb must be opened before the mapWallet lock
@@ -4714,10 +5555,21 @@ bool CreateTransaction(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew, in
                 // fixed this in 107d9e288.
                 int64 nTotalValue = nValue + nFee;
 
-                // Choose coins to use
+                // Choose coins to use.
+                //
+                // Failing here is a funding shortfall and nothing else: there
+                // is not enough spendable coin for nValue plus the fee this
+                // pass is working with. On the second and later passes that
+                // fee is GetMinFee() of the transaction the first pass built,
+                // so this is also how a wallet that can afford the amount but
+                // not the 11 * CENT charged at 10,000 bytes reports itself.
                 set<CWalletTx*> setCoins;
                 if (!SelectCoins(nTotalValue, setCoins))
+                {
+                    if (presultRet)
+                        *presultRet = WALLET_SEND_INSUFFICIENT_FUNDS;
                     return false;
+                }
                 int64 nValueIn = 0;
                 foreach(CWalletTx* pcoin, setCoins)
                     nValueIn += pcoin->GetCredit();
@@ -4787,6 +5639,8 @@ bool CreateTransaction(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew, in
             }
         }
     }
+    if (presultRet)
+        *presultRet = WALLET_SEND_OK;
     return true;
 }
 
@@ -4849,13 +5703,24 @@ bool CommitTransactionSpent(const CWalletTx& wtxNew)
 
 
 
-bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew)
+// outcomeRet reports what happened rather than only whether it worked. A
+// caller that has to decide what a failure MEANS -- the pool payout thread --
+// cannot reconstruct it from a balance reading afterwards, because the fee
+// that was actually required depends on the size of a transaction that was
+// never built. See WalletSendResult.
+bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew,
+               SendMoneyOutcome& outcomeRet)
 {
+    outcomeRet.result       = WALLET_SEND_FAILED;
+    outcomeRet.nFeeRequired = 0;
     CRITICAL_BLOCK(cs_main)
     {
         int64 nFeeRequired;
-        if (!CreateTransaction(scriptPubKey, nValue, wtxNew, nFeeRequired))
+        WalletSendResult createResult = WALLET_SEND_FAILED;
+        if (!CreateTransaction(scriptPubKey, nValue, wtxNew, nFeeRequired, &createResult))
         {
+            outcomeRet.result       = createResult;
+            outcomeRet.nFeeRequired = nFeeRequired;
             string strError;
             if (nValue + nFeeRequired > GetBalance())
                 // Not an oversized transaction -- this branch is simply "the
@@ -4893,6 +5758,13 @@ bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew)
         }
         wtxNew.RelayWalletTransaction();
     }
+    outcomeRet.result = WALLET_SEND_OK;
     MainFrameRepaint();
     return true;
 }
+
+bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew)
+{
+    SendMoneyOutcome ignored;
+    return SendMoney(scriptPubKey, nValue, wtxNew, ignored);
+}