1 files changed, 29 insertions, 0 deletions

diff --git a/src/main_gui.cpp b/src/main_gui.cpp
index 2743429..25cde1c 100644
--- a/src/main_gui.cpp
+++ b/src/main_gui.cpp
@@ -196,6 +196,9 @@ static void PrintUsage()
     printf("  /walletsqlite=FILE         (stage-load a SQLite wallet export, then exit)\n");
     printf("  /walletbackend=sqlite      (opt-in: run the node on <datadir>/wallet.sqlite\n");
     printf("                              instead of wallet.dat; export one first)\n");
+    printf("  /createwallet              (headless only: permit creating a new wallet in a\n");
+    printf("                              datadir that has none -- otherwise refused, since\n");
+    printf("                              a missing wallet is usually a mount/backup fault)\n");
     printf("  /rescan                    (walk the chain for coins this wallet owns\n");
     printf("                              but never recorded, then exit)\n");
     printf("\n");
@@ -835,6 +838,32 @@ int main(int argc, char* argv[])
                 else { fUseSQLite = true; fCreateSQLite = true; }
             }
 
+            // A headless node whose datadir holds no wallet of either kind is
+            // far more often an operations fault -- datadir not mounted, or
+            // wallet.dat caught mid-rename by a backup -- than a first run.
+            // Creating one here is not the harmless default it looks like:
+            // success also writes the backend marker, and from then on
+            // restoring the real wallet.dat no longer takes effect, because the
+            // marker keeps the node on the empty wallet it just made. Under
+            // 1.2.19 the same fault created a wallet.dat that a restore
+            // overwrote, so operators could recover by putting the file back.
+            // Refuse instead, and name the flag that makes it deliberate.
+            if (fCreateSQLite && fHeadlessStartup &&
+                !arg(argc, argv, "/createwallet") && !arg(argc, argv, "-createwallet"))
+            {
+                AttachTerminal();
+                fprintf(stderr,
+                        "No wallet found in %s\n"
+                        "Refusing to create one. On a headless node an absent wallet is\n"
+                        "usually a mount or backup fault, and creating one would record a\n"
+                        "backend marker that makes restoring the real wallet a no-op.\n"
+                        "Pass -createwallet to start a new one deliberately, or\n"
+                        "-walletbackend=bdb to run on a Berkeley DB wallet.dat.\n",
+                        GetAppDir().c_str());
+                fflush(stderr);
+                return 1;
+            }
+
             if (fUseSQLite)
             {
                 AttachTerminal();