1 files changed, 569 insertions, 27 deletions

diff --git a/src/main_gui.cpp b/src/main_gui.cpp
index bee4b95..2e4eb91 100644
--- a/src/main_gui.cpp
+++ b/src/main_gui.cpp
@@ -1,7 +1,10 @@
 // Bitflash entry point -- starts node threads then runs GUI (or headless).
 
 #include "headers_core.h"
+#include "nostr.h"
+#include "proxy.h"
 #include "selftest.h"
+#include "tor.h"
 #include "walletcmd.h"
 #include <thread>          // hardware_concurrency, to sanity-check /genproclimit
 #ifndef _WIN32
@@ -108,9 +111,16 @@ static void PrintUsage()
     printf("  /help, -help, --help, /?\n");
     printf("  /datadir=PATH\n");
     printf("  /debug\n");
+    printf("  /debugrelay                (/debug plus per-message relay chatter and block dumps)\n");
+    printf("  /maxdebugfilesize=N        (roll debug.log at N MB, default 1024; 0 = never)\n");
     printf("  /gen\n");
     printf("  /nogui or /daemon\n");
-    printf("  /selftest=wallet-keypool, wallet-hd, wallet-format, wallet-crypto, or wallet-encrypt\n");
+    printf("  /selftest=wallet-keypool, wallet-hd, wallet-format, wallet-storage-sanity,\n");
+    printf("            db-env-reopen, wallet-sqlite, wallet-sqlite-migration,\n");
+    printf("            wallet-crypto, wallet-encrypt, wallet-portability,\n");
+    printf("            net-message,\n");
+    printf("            consensus-limits, pool-stratum,\n");
+    printf("            parse-money, network-params, socks5-proxy, or managed-tor\n");
     printf("\n");
     printf("Mining mode:\n");
     printf("  /operator\n");
@@ -118,22 +128,36 @@ static void PrintUsage()
     printf("  /payoutaddr=BTF_ADDRESS  (participant: pay shares to this address, no wallet needed)\n");
     printf("  /payoutfile=FILE         (participant: rotate payout addresses from file)\n");
     printf("  /hashthreads=N           (participant: mining threads, default cores-1)\n");
+    printf("  /stratumbridge=POOL_BTF_ADDRESS\n");
+    printf("  /stratumbridgeport=N       (default 3333; listen on 127.0.0.1)\n");
     printf("  /solomine\n");
     printf("  /genproclimit=N            (mining threads; 0 or absent = every core but one)\n");
+    printf("  /nolargepages              (do not ask for 2 MB pages for the RandomX\n");
+    printf("                              cache, dataset and scratchpads)\n");
     printf("  /checkblocks=N             (blocks re-verified at startup, default 288, 0 = all)\n");
     printf("\n");
     printf("Pool operator announcement:\n");
     printf("  /poolname=NAME\n");
     printf("  /poolfee=PCT\n");
     printf("  /pooldashboard=URL  (alias: /pooldash=URL)\n");
+    printf("  /poolstatusfile=PATH       (write pool status JSON for dashboards)\n");
+    printf("  /poolroundsfile=PATH       (write public pool round proofs JSON)\n");
     printf("\n");
     printf(".btf and rendezvous:\n");
     printf("  /connectbtf=PEER_BTF_ADDRESS\n");
     printf("  /rvrelay=HOST:PORT\n");
     printf("  /announcerelay=HOST:PORT\n");
+    printf("  /onionservice=HOST.onion:PORT  (advertise this node's Tor hidden service)\n");
     printf("\n");
     printf("Network:\n");
-    printf("  /port=N                    (P2P listen port, default 8433)\n");
+    printf("  /testnet                   (isolated test network genesis, datadir, port, and magic)\n");
+    printf("  /port=N                    (P2P listen port, default 8433; testnet 18433)\n");
+    printf("  /socks=HOST:PORT           (SOCKS5 proxy for Nostr, .btf relay, and onion dials)\n");
+    printf("  /tor[=HOST:PORT]           (Tor mode; default SOCKS5 proxy is 127.0.0.1:9050)\n");
+    printf("  /managedtor[=PATH]         (start Tor, create a hidden service, advertise its onion)\n");
+    printf("  /automanagedtor            (auto-start a bundled Tor if one sits next to the executable)\n");
+    printf("  /nomanagedtor              (disable automatic bundled Tor startup)\n");
+    printf("  /oniononly                 (do not fall back to rendezvous when a .btf onion dial fails)\n");
     printf("  /btfseed=ADDRESS:ENCHEX    (extra bootstrap peer, repeatable)\n");
     printf("\n");
     printf("Wallet:\n");
@@ -160,6 +184,26 @@ static void PrintUsage()
     printf("  /recoveryaudit             (show how much spendable balance is\n");
     printf("                              covered by the recovery phrase;\n");
     printf("                              exits 2 when wallet.dat is still needed)\n");
+    printf("  /walletstorageaudit        (count wallet.dat record types without\n");
+    printf("                              printing wallet values, then exit)\n");
+    printf("  /walletstorageauditjson=FILE\n");
+    printf("                              (write the same audit as deterministic JSON)\n");
+    printf("  /walletstoragecheck        (fail closed on inconsistent or unsafe\n");
+    printf("                              wallet.dat storage state)\n");
+    printf("  /walletsqliteexport=FILE   (copy raw wallet.dat records into an\n");
+    printf("                              SQLite store, then exit)\n");
+    printf("  /walletsqliteverify=FILE   (compare wallet.dat with a SQLite export,\n");
+    printf("                              printing counts only, then exit)\n");
+    printf("  /walletsqliterestore=FILE  (rebuild wallet.dat from a SQLite export in\n");
+    printf("                              an empty data directory, then exit)\n");
+    printf("  /walletsqliteloadcheck=FILE\n");
+    printf("                              (parse a SQLite export like the wallet loader)\n");
+    printf("  /walletsqlite=FILE         (stage-load a SQLite wallet export, then exit)\n");
+    printf("  /walletbackend=sqlite      (opt-in: run the node on <datadir>/wallet.sqlite\n");
+    printf("                              instead of wallet.dat; export one first)\n");
+    printf("  /createwallet              (headless only: permit creating a new wallet in a\n");
+    printf("                              datadir that has none -- otherwise refused, since\n");
+    printf("                              a missing wallet is usually a mount/backup fault)\n");
     printf("  /rescan                    (walk the chain for coins this wallet owns\n");
     printf("                              but never recorded, then exit)\n");
     printf("\n");
@@ -173,9 +217,60 @@ static void ParseStartupArguments(int argc, char* argv[])
     if (arg(argc,argv,"/datadir") || arg(argc,argv,"-datadir"))
         strSetDataDir = argval2(argc, argv, "/datadir", "-datadir");
 
+    bool fUseTestNet = arg(argc, argv, "/testnet") || arg(argc, argv, "-testnet");
+    SelectChainParams(fUseTestNet);
+
     if (arg(argc,argv,"/debug") || arg(argc,argv,"-debug"))
         fDebug = true;
 
+    // /debugrelay -- everything /debug shows, plus the per-message firehose
+    // ("relay" and "nostrdiscovery" categories: sending: tx, Relaying wtx,
+    // raw CBlock dumps, per-peer discovery lines). That traffic was ~90% of
+    // a 13-hour production debug.log (issue #35), so plain /debug leaves it
+    // off; the message text itself is unchanged for anyone grepping it.
+    if (arg(argc,argv,"/debugrelay") || arg(argc,argv,"-debugrelay"))
+    {
+        fDebug = true;
+        fDebugRelay = true;
+    }
+
+    // /maxdebugfilesize=N -- roll debug.log to debug.log.old once it passes
+    // N MB, checked on each write. Default is 1024 (see util.cpp); 0 turns
+    // the check off and leaves rotation entirely to logrotate.
+    string strMaxDebugSize = argval2(argc, argv, "/maxdebugfilesize", "-maxdebugfilesize");
+    if (!strMaxDebugSize.empty())
+    {
+        // Parsed with atoi64() before, which is strtoll() with the endptr
+        // thrown away: it returns 0 for anything it cannot read, so
+        // /maxdebugfilesize=1G and =1024MB both came out as 0 -- "never
+        // roll", identical to asking for that on purpose, with nothing said
+        // to the operator. The old code also multiplied without a range
+        // check, so a big enough N wrapped to a negative cap, which the roll
+        // reads as "off" too. Every rejection is now reported and leaves the
+        // default in place; the value is a plain count of MB, no suffix.
+        const char* psz = strMaxDebugSize.c_str();
+        char* pszEnd = NULL;
+        errno = 0;
+        int64 nMB = strtoll(psz, &pszEnd, 10);
+        // INT64_MAX, without depending on which limits header this tree pulls in.
+        const int64 nMaxMB = (int64)((~(uint64)0) >> 1) / (1024 * 1024);
+        const char* pszWhy = NULL;
+        if (pszEnd == psz)
+            pszWhy = "not a number";
+        else if (*pszEnd != '\0')
+            pszWhy = "trailing characters -- the value is a count of MB, with no unit suffix";
+        else if (errno == ERANGE || nMB < 0)
+            pszWhy = "not a size in MB";
+        else if (nMB > nMaxMB)
+            pszWhy = "larger than a file size can be";
+        if (pszWhy)
+            fprintf(stderr, "Ignoring /maxdebugfilesize=%s: %s (keeping %lld MB)\n",
+                    strMaxDebugSize.c_str(), pszWhy,
+                    (long long)(nMaxDebugFileSize / 1024 / 1024));
+        else
+            nMaxDebugFileSize = nMB * 1024 * 1024;
+    }
+
     if (arg(argc,argv,"/gen") || arg(argc,argv,"-gen"))
     {
         fGenerateBitcoins = 1;
@@ -195,6 +290,11 @@ static void ParseStartupArguments(int argc, char* argv[])
     if (!strCheckBlocks.empty())
         nCheckBlocksOnLoad = atoi(strCheckBlocks.c_str());
 
+    // Must be read before LoadBlockIndex(), which is what first calls
+    // RandomXInit() and fixes how the cache is allocated.
+    if (arg(argc,argv,"/nolargepages") || arg(argc,argv,"-nolargepages"))
+        fRandomXLargePages = false;
+
     // /genproclimit=N -- threads to hash with. 0 or absent means automatic,
     // which is every core but one. Named after Bitcoin's own option so it reads
     // familiarly to anyone who has run one of these before.
@@ -240,6 +340,22 @@ static void ParseStartupArguments(int argc, char* argv[])
     if (!hashThreads.empty())
         nHashThreads = atoi(hashThreads.c_str());
 
+    if (arg(argc,argv,"/stratumbridge") || arg(argc,argv,"-stratumbridge"))
+    {
+        fStratumBridge = true;
+        string bridgePool = argval2(argc, argv, "/stratumbridge", "-stratumbridge");
+        if (!bridgePool.empty())
+            strParticipantPool = bridgePool;
+    }
+
+    string bridgePort = argval2(argc, argv, "/stratumbridgeport", "-stratumbridgeport");
+    if (!bridgePort.empty())
+    {
+        int nPort = atoi(bridgePort.c_str());
+        if (nPort > 0 && nPort <= 65535)
+            nStratumBridgePort = nPort;
+    }
+
     string poolName = argval2(argc, argv, "/poolname", "-poolname");
     if (!poolName.empty())
         strPoolName = poolName;
@@ -260,9 +376,18 @@ static void ParseStartupArguments(int argc, char* argv[])
     if (!poolFee.empty())
         dPoolFeePercent = atof(poolFee.c_str());
 
+    string poolStatusFile = argval2(argc, argv, "/poolstatusfile", "-poolstatusfile");
+    if (!poolStatusFile.empty())
+        strPoolStatusFile = poolStatusFile;
+
+    string poolRoundsFile = argval2(argc, argv, "/poolroundsfile", "-poolroundsfile");
+    if (!poolRoundsFile.empty())
+        strPoolRoundsFile = poolRoundsFile;
+
     string btfConnect = argval2(argc, argv, "/connectbtf", "-connectbtf");
     if (!btfConnect.empty())
         strBtfConnect = btfConnect;
+    fBtfOnionOnly = arg(argc, argv, "/oniononly") || arg(argc, argv, "-oniononly");
 
     string rvRelay = argval2(argc, argv, "/rvrelay", "-rvrelay");
     if (!rvRelay.empty())
@@ -283,10 +408,102 @@ static void ParseStartupArguments(int argc, char* argv[])
         }
     }
 
+    // net.cpp has described nListenPort as "tunable via /port" since it was
+    // written, but nothing ever read the option, so the port was fixed at 8433
+    // and a second node could not start on a machine already running one. Parse
+    // it before Tor setup so a managed hidden service maps the real listener.
+    string strPort = argval2(argc, argv, "/port", "-port");
+    if (!strPort.empty())
+    {
+        int nPort = atoi(strPort.c_str());
+        if (nPort <= 0 || nPort > 65535)
+            fprintf(stderr, "Ignoring /port=%s: not a port number\n", strPort.c_str());
+        else
+        {
+            nListenPort = htons((unsigned short)nPort);
+            // Or we would announce a port we never bound.
+            addrLocalHost.port = nListenPort;
+        }
+    }
+
     string announceRelay = argval2(argc, argv, "/announcerelay", "-announcerelay");
     if (!announceRelay.empty())
         strBtfAnnounceRelay = announceRelay;
 
+    string onionService = argval2(argc, argv, "/onionservice", "-onionservice");
+    if (!onionService.empty())
+    {
+        string err;
+        if (!BtfSetLocalOnionEndpoint(onionService, err))
+            fprintf(stderr, "Ignoring /onionservice=%s: %s\n", onionService.c_str(), err.c_str());
+        else
+            fprintf(stderr, "Direct onion peer endpoint advertised: %s\n",
+                    BtfLocalOnionEndpoint().c_str());
+    }
+
+    bool fManagedTor = arg(argc, argv, "/managedtor") || arg(argc, argv, "-managedtor");
+    bool fNoManagedTor = arg(argc, argv, "/nomanagedtor") || arg(argc, argv, "-nomanagedtor");
+    bool fTorMode = arg(argc, argv, "/tor") || arg(argc, argv, "-tor");
+    string socksProxy = argval2(argc, argv, "/socks", "-socks");
+    string bundledTorPath;
+    // Managed Tor is opt-in on this fork. Upstream 1.2.19 auto-starts a
+    // bundled tor whenever one sits next to the executable, which silently
+    // moves Nostr/.btf traffic onto Tor, creates a hidden service, and starts
+    // publishing descriptors with meeting_node="rendezvous-pending" on nodes
+    // that never asked for it -- against our pinned-relay posture. The
+    // upstream behavior remains available under the explicit /automanagedtor.
+    bool fAutoManagedTor = !fManagedTor && !fNoManagedTor && !fTorMode &&
+                            socksProxy.empty() &&
+                            (arg(argc, argv, "/automanagedtor") || arg(argc, argv, "-automanagedtor")) &&
+                            BtfBundledTorPath(bundledTorPath);
+    if (fManagedTor || fAutoManagedTor)
+    {
+        if (fManagedTor && (fTorMode || !socksProxy.empty()))
+            fprintf(stderr, "Warning: /managedtor takes precedence over /tor and /socks\n");
+
+        string torPath = fManagedTor ? argval2(argc, argv, "/managedtor", "-managedtor") : bundledTorPath;
+        string err;
+        if (!BtfStartManagedTor(torPath, err))
+        {
+            if (fAutoManagedTor)
+                fprintf(stderr, "Bundled Tor not enabled automatically: %s\n", err.c_str());
+            else
+                fprintf(stderr, "Ignoring /managedtor=%s: %s\n", torPath.c_str(), err.c_str());
+        }
+        else
+            fprintf(stderr, "Managed Tor enabled%s: %s\n",
+                    fAutoManagedTor ? " automatically" : "",
+                    BtfManagedTorStatus().c_str());
+    }
+    else if (fTorMode)
+    {
+        if (!socksProxy.empty())
+            fprintf(stderr, "Warning: /tor takes precedence over /socks=%s\n",
+                    socksProxy.c_str());
+
+        string torProxy = argval2(argc, argv, "/tor", "-tor");
+        string err;
+        if (!BtfEnableTorProxy(torProxy, err))
+            fprintf(stderr, "Ignoring /tor=%s: %s\n", torProxy.c_str(), err.c_str());
+        else
+            fprintf(stderr, "Tor mode enabled through SOCKS5 proxy %s\n",
+                    BtfSocks5ProxyName().c_str());
+    }
+    else
+    {
+        if (!socksProxy.empty())
+        {
+            string err;
+            if (!BtfSetSocks5Proxy(socksProxy, err))
+                fprintf(stderr, "Ignoring /socks=%s: %s\n", socksProxy.c_str(), err.c_str());
+            else
+                fprintf(stderr, "SOCKS5 proxy enabled for outbound discovery/relay dials: %s\n",
+                        BtfSocks5ProxyName().c_str());
+        }
+    }
+    if (fBtfOnionOnly && !BtfSocks5ProxyEnabled())
+        fprintf(stderr, "Warning: /oniononly without /tor, /managedtor, or /socks cannot dial .onion peers\n");
+
     // /btfseed=ADDRESS:ENCHEX -- extra bootstrap peers, repeatable. Useful for
     // testing the seed path and for private networks that ship no compiled list.
     for (int i = 1; i < argc; i++)
@@ -306,22 +523,6 @@ static void ParseStartupArguments(int argc, char* argv[])
         vBtfExtraSeeds.push_back(make_pair(val.substr(0, colon), val.substr(colon + 1)));
     }
 
-    // net.cpp has described nListenPort as "tunable via /port" since it was
-    // written, but nothing ever read the option, so the port was fixed at 8433
-    // and a second node could not start on a machine already running one.
-    string strPort = argval2(argc, argv, "/port", "-port");
-    if (!strPort.empty())
-    {
-        int nPort = atoi(strPort.c_str());
-        if (nPort <= 0 || nPort > 65535)
-            fprintf(stderr, "Ignoring /port=%s: not a port number\n", strPort.c_str());
-        else
-        {
-            nListenPort = htons((unsigned short)nPort);
-            // Or we would announce a port we never bound.
-            addrLocalHost.port = nListenPort;
-        }
-    }
 }
 
 // Report a startup failure somewhere the user will actually see it.
@@ -368,6 +569,36 @@ static void FatalStartupError(bool fHeadless, const string& strWhat, const strin
 #endif
 }
 
+#ifdef _WIN32
+// Windows equivalent of the SIGINT/SIGTERM handler the headless loop installs on
+// POSIX. Without it a headless node on Windows had no way to reach the clean
+// StopNode()+DBFlush() path: Ctrl-C, closing the console window, a service stop
+// and OS shutdown all killed it mid-write, and a wallet.dat left unflushed by
+// Berkeley DB will not reopen. For CLOSE/LOGOFF/SHUTDOWN the OS terminates us
+// shortly after the handler returns, so we set fShutdown and then block until the
+// main loop signals the flush is done -- returning any sooner throws the flush
+// away, which is the whole bug. (A `taskkill /F` is still an uncatchable hard
+// kill; nothing can help there, and nothing should pretend to.)
+static volatile bool g_fHeadlessShutdownDone = false;
+static BOOL WINAPI HeadlessConsoleCtrlHandler(DWORD dwCtrlType)
+{
+    switch (dwCtrlType)
+    {
+    case CTRL_C_EVENT:
+    case CTRL_BREAK_EVENT:
+    case CTRL_CLOSE_EVENT:
+    case CTRL_LOGOFF_EVENT:
+    case CTRL_SHUTDOWN_EVENT:
+        fShutdown = true;
+        while (!g_fHeadlessShutdownDone)
+            Sleep(50);
+        return TRUE;
+    default:
+        return FALSE;
+    }
+}
+#endif
+
 int main(int argc, char* argv[])
 {
     if (arg(argc,argv,"/help") || arg(argc,argv,"-help") ||
@@ -384,10 +615,119 @@ int main(int argc, char* argv[])
 
     ParseStartupArguments(argc, argv);
 
+#ifdef _WIN32
+    // Set by the GUI "Restart Now" button: give the previous instance a moment
+    // to release the network port and the block-index files before this one
+    // opens them, so a relaunch does not race the process it is replacing.
+    if (arg(argc, argv, "/restartwait") || arg(argc, argv, "-restartwait"))
+        Sleep(2500);
+#endif
+
+    // Hidden self-test helper. It must run before LoadWallet(): several
+    // storage-sanity scenarios deliberately make wallet.dat unsafe to load.
+    string strSelfTestMutateWallet =
+        argval2(argc, argv, "/selftestmutatewallet", "-selftestmutatewallet");
+    if (!strSelfTestMutateWallet.empty())
+        return RunSelfTestMutateWallet(strSelfTestMutateWallet);
+
     string strSelfTest = argval2(argc, argv, "/selftest", "-selftest");
     if (!strSelfTest.empty())
         return RunSelfTest(strSelfTest);
 
+    // Storage diagnostics must run before LoadWallet(). Their job is to
+    // explain wallet.dat states that the normal wallet loader may refuse.
+    string strWalletStorageAuditJson =
+        argval2(argc, argv, "/walletstorageauditjson", "-walletstorageauditjson");
+    bool fDiagWantsAudit = arg(argc,argv,"/walletstorageaudit") ||
+                           arg(argc,argv,"-walletstorageaudit") ||
+                           !strWalletStorageAuditJson.empty();
+    bool fDiagWantsCheck = arg(argc,argv,"/walletstoragecheck") ||
+                           arg(argc,argv,"-walletstoragecheck");
+
+    // These diagnostics normally read wallet.dat. Under -walletbackend=sqlite
+    // the live wallet is wallet.sqlite, so open it read-only as the active
+    // store and let the same scan walk the right file. This runs before the
+    // normal backend resolution further down, so validate the value here too.
+    string strDiagBackend = argval2(argc, argv, "/walletbackend", "-walletbackend");
+    if ((fDiagWantsAudit || fDiagWantsCheck) && !strDiagBackend.empty() &&
+        strDiagBackend != "sqlite" && strDiagBackend != "bdb")
+    {
+        AttachTerminal();
+        fprintf(stderr, "Unknown wallet backend '%s'. Use -walletbackend=sqlite "
+                        "or -walletbackend=bdb.\n", strDiagBackend.c_str());
+        return 1;
+    }
+    bool fDiagSQLite = (strDiagBackend == "sqlite") &&
+                       (fDiagWantsAudit || fDiagWantsCheck);
+    if (fDiagSQLite)
+    {
+        AttachTerminal();
+        string strSQLitePath = GetAppDir() + "/wallet.sqlite";
+        string strOpenErr;
+        if (!WalletSQLiteRuntimeOpenReadOnly(strSQLitePath, strOpenErr))
+        {
+            fprintf(stderr, "Cannot open the SQLite wallet for diagnostics: %s\n",
+                    strOpenErr.c_str());
+            return 1;
+        }
+    }
+
+    if (fDiagWantsAudit)
+    {
+        int nRet = CmdWalletStorageAudit(strWalletStorageAuditJson);
+        if (fDiagSQLite)
+            WalletSQLiteRuntimeClose();
+        else
+            DBFlush(true);
+        return nRet;
+    }
+
+    if (fDiagWantsCheck)
+    {
+        int nRet = CmdWalletStorageCheck();
+        if (fDiagSQLite)
+            WalletSQLiteRuntimeClose();
+        else
+            DBFlush(true);
+        return nRet;
+    }
+
+    string strWalletSQLiteExport =
+        argval2(argc, argv, "/walletsqliteexport", "-walletsqliteexport");
+    if (!strWalletSQLiteExport.empty())
+    {
+        int nRet = CmdWalletSQLiteExport(strWalletSQLiteExport);
+        DBFlush(true);
+        return nRet;
+    }
+
+    string strWalletSQLiteVerify =
+        argval2(argc, argv, "/walletsqliteverify", "-walletsqliteverify");
+    if (!strWalletSQLiteVerify.empty())
+    {
+        int nRet = CmdWalletSQLiteVerify(strWalletSQLiteVerify);
+        DBFlush(true);
+        return nRet;
+    }
+
+    string strWalletSQLiteRestore =
+        argval2(argc, argv, "/walletsqliterestore", "-walletsqliterestore");
+    if (!strWalletSQLiteRestore.empty())
+    {
+        int nRet = CmdWalletSQLiteRestore(strWalletSQLiteRestore);
+        DBFlush(true);
+        return nRet;
+    }
+
+    string strWalletSQLiteLoadCheck =
+        argval2(argc, argv, "/walletsqliteloadcheck", "-walletsqliteloadcheck");
+    if (!strWalletSQLiteLoadCheck.empty())
+    {
+        int nRet = CmdWalletSQLiteLoadCheck(strWalletSQLiteLoadCheck);
+        DBFlush(true);
+        return nRet;
+    }
+
     // Berkeley DB reports failure by throwing, and CDB's constructor lets it
     // through. Nothing on this path caught anything, so an unreadable
     // blkindex.dat or wallet.dat -- one written by another platform's Berkeley
@@ -432,18 +772,197 @@ int main(int argc, char* argv[])
     printf("Loading wallet...\n");
     try
     {
-        if (!LoadWallet())
+        string strWalletBackend =
+            argval2(argc, argv, "/walletbackend", "-walletbackend");
+        string strWalletSQLite =
+            argval2(argc, argv, "/walletsqlite", "-walletsqlite");
+
+        // A misspelled backend must not fall through to Berkeley DB silently --
+        // someone who typed -walletbackend=sqlit meant to run on SQLite, and
+        // opening wallet.dat instead of telling them is the wrong surprise.
+        if (!strWalletBackend.empty() &&
+            strWalletBackend != "sqlite" && strWalletBackend != "bdb")
         {
-            // LoadWallet() explains itself into strWalletLoadError when it
-            // knows why -- an unsupported wallet format, for one, which is the
-            // case this whole path exists to make visible.
-            FatalStartupError(fHeadlessStartup, "Cannot open wallet.dat.",
-                              strWalletLoadError);
+            AttachTerminal();
+            FatalStartupError(fHeadlessStartup,
+                strprintf("Unknown wallet backend '%s'.", strWalletBackend.c_str()),
+                "Use -walletbackend=sqlite for the SQLite backend, or "
+                "-walletbackend=bdb for the Berkeley DB wallet.dat.");
             return 1;
         }
 
+        if (strWalletBackend == "sqlite")
+        {
+            // Explicit opt-in via the flag. The node runs on
+            // <datadir>/wallet.sqlite and never opens wallet.dat, but the user
+            // has to have exported one first -- there is no silent migration,
+            // and wallet.dat is left
+            // exactly where it is so a plain restart goes back to it.
+            AttachTerminal();
+            string strSQLitePath = GetAppDir() + "/wallet.sqlite";
+            if (!FileExists(strSQLitePath.c_str()))
+            {
+                string strGuide = strprintf(
+                    "No SQLite wallet was found at\n"
+                    "  %s\n\n"
+                    "The SQLite wallet backend is opt-in and needs an exported\n"
+                    "wallet first. Your Berkeley DB wallet.dat is not touched by\n"
+                    "any of this.\n\n"
+                    "  Step 1  Export your existing wallet to SQLite:\n"
+                    "            bitflash -walletsqliteexport=\"%s\"\n"
+                    "  Step 2  Start again with the SQLite backend:\n"
+                    "            bitflash -walletbackend=sqlite\n\n"
+                    "To go back to Berkeley DB at any time, just start without\n"
+                    "-walletbackend=sqlite. wallet.dat is still your wallet.",
+                    strSQLitePath.c_str(), strSQLitePath.c_str());
+                FatalStartupError(fHeadlessStartup,
+                                  "The SQLite wallet backend needs an exported wallet first.",
+                                  strGuide);
+                return 1;
+            }
+
+            if (!LoadWalletFromSQLiteRuntime(strSQLitePath))
+            {
+                FatalStartupError(fHeadlessStartup,
+                                  "Cannot open the SQLite wallet backend.",
+                                  strWalletLoadError);
+                return 1;
+            }
+
+            fprintf(stderr,
+                    "Wallet backend: SQLite\n"
+                    "  %s\n"
+                    "Your Berkeley DB wallet.dat is left untouched. Restart without\n"
+                    "-walletbackend=sqlite to go back to it.\n",
+                    strSQLitePath.c_str());
+            fflush(stderr);
+            // Fall through and run the node normally: every CWalletDB read,
+            // write, and erase now routes to this SQLite file.
+        }
+        else if (!strWalletSQLite.empty())
+        {
+            AttachTerminal();
+            if (!LoadWalletFromSQLite(strWalletSQLite))
+            {
+                FatalStartupError(fHeadlessStartup,
+                                  "Cannot open SQLite wallet export.",
+                                  strWalletLoadError);
+                return 1;
+            }
+
+            fprintf(stderr, "SQLite wallet loaded: read-only staging backend\n");
+            fprintf(stderr, "SQLite runtime writes are not enabled yet; exiting before "
+                            "network, mining, GUI, or wallet mutation starts.\n");
+            fflush(stderr);
+            DBFlush(true);
+            return 0;
+        }
+        else if (strWalletBackend == "bdb")
+        {
+            // Explicit -walletbackend=bdb overrides the marker and the default:
+            // force Berkeley DB (LoadWallet creates wallet.dat if none exists).
+            if (!LoadWallet())
+            {
+                FatalStartupError(fHeadlessStartup, "Cannot open wallet.dat.",
+                                  strWalletLoadError);
+                return 1;
+            }
+        }
+        else
+        {
+            // No explicit -walletbackend on the command line. Resolve it from
+            // the persistent marker, then defaults: an existing wallet.sqlite
+            // stays on SQLite, an existing wallet.dat stays on Berkeley DB (the
+            // GUI offers to convert), and a fresh install starts on SQLite --
+            // the new default. wallet.dat is never touched by any of this.
+            string strSQLitePath = GetAppDir() + "/wallet.sqlite";
+            bool fSQLiteExists = FileExists(strSQLitePath.c_str());
+            bool fWalletDatExists = FileExists((GetAppDir() + "/wallet.dat").c_str());
+            string strMarker = ReadWalletBackendMarker();
+
+            bool fUseSQLite = false;
+            bool fCreateSQLite = false;
+            if (strMarker == "sqlite")
+            {
+                if (fSQLiteExists)          fUseSQLite = true;
+                else if (fWalletDatExists)  fUseSQLite = false;  // marker stale; real wallet is BDB
+                else { fUseSQLite = true; fCreateSQLite = true; }
+            }
+            else if (strMarker == "bdb")
+            {
+                fUseSQLite = false;
+            }
+            else  // no marker recorded yet
+            {
+                if (fSQLiteExists && !fWalletDatExists) fUseSQLite = true;
+                else if (fWalletDatExists)              fUseSQLite = false;
+                else { fUseSQLite = true; fCreateSQLite = true; }
+            }
+
+            // A headless node whose datadir holds no wallet of either kind is
+            // far more often an operations fault -- datadir not mounted, or
+            // wallet.dat caught mid-rename by a backup -- than a first run.
+            // Creating one here is not the harmless default it looks like:
+            // success also writes the backend marker, and from then on
+            // restoring the real wallet.dat no longer takes effect, because the
+            // marker keeps the node on the empty wallet it just made. Under
+            // 1.2.19 the same fault created a wallet.dat that a restore
+            // overwrote, so operators could recover by putting the file back.
+            // Refuse instead, and name the flag that makes it deliberate.
+            if (fCreateSQLite && fHeadlessStartup &&
+                !arg(argc, argv, "/createwallet") && !arg(argc, argv, "-createwallet"))
+            {
+                AttachTerminal();
+                fprintf(stderr,
+                        "No wallet found in %s\n"
+                        "Refusing to create one. On a headless node an absent wallet is\n"
+                        "usually a mount or backup fault, and creating one would record a\n"
+                        "backend marker that makes restoring the real wallet a no-op.\n"
+                        "Pass -createwallet to start a new one deliberately, or\n"
+                        "-walletbackend=bdb to run on a Berkeley DB wallet.dat.\n",
+                        GetAppDir().c_str());
+                fflush(stderr);
+                return 1;
+            }
+
+            if (fUseSQLite)
+            {
+                AttachTerminal();
+                bool fOk = fCreateSQLite
+                    ? CreateNewSQLiteWallet(strSQLitePath)
+                    : LoadWalletFromSQLiteRuntime(strSQLitePath);
+                if (!fOk)
+                {
+                    FatalStartupError(fHeadlessStartup,
+                        fCreateSQLite ? "Cannot create the SQLite wallet."
+                                      : "Cannot open the SQLite wallet.",
+                        strWalletLoadError);
+                    return 1;
+                }
+                // Record the choice so it is stable from here on.
+                if (ReadWalletBackendMarker() != "sqlite")
+                    WriteWalletBackendMarker("sqlite");
+                fprintf(stderr, "Wallet backend: SQLite\n  %s\n%s",
+                        strSQLitePath.c_str(),
+                        fCreateSQLite ? "A new wallet was created here.\n" : "");
+                fflush(stderr);
+                // Fall through and run the node; CWalletDB routes to this file.
+            }
+            else if (!LoadWallet())
+            {
+                // LoadWallet() explains itself into strWalletLoadError when it
+                // knows why -- an unsupported wallet format, for one, which is
+                // the case this whole path exists to make visible.
+                FatalStartupError(fHeadlessStartup, "Cannot open wallet.dat.",
+                                  strWalletLoadError);
+                return 1;
+            }
+        }
+
         // After the block index, so there is a chain to compare the wallet
-        // against, and before anything reports a balance.
+        // against, and before anything reports a balance. Works on either
+        // backend: RescanSpentFlags writes corrected flags through CWalletDB,
+        // which routes to SQLite when that backend is active.
         RescanSpentFlags();
     }
     catch (const std::exception& e)
@@ -668,7 +1187,12 @@ int main(int argc, char* argv[])
         return 0;
     }
 
-    if (!StartNode(strErrors)) { fprintf(stderr,"StartNode: %s\n",strErrors.c_str()); return 1; }
+    if (!StartNode(strErrors))
+    {
+        fprintf(stderr,"StartNode: %s\n",strErrors.c_str());
+        BtfStopManagedTor();
+        return 1;
+    }
 
     if (nMineMode == MINE_OPERATOR) {
         gPoolServerRunning = true;
@@ -676,6 +1200,10 @@ int main(int argc, char* argv[])
         if (_beginthread(ThreadRPCServer, 0, NULL) == (uintptr_t)-1)
             printf("Error: _beginthread(ThreadRPCServer) failed\n");
     }
+    if (fStratumBridge) {
+        if (_beginthread(ThreadStratumBridge, 0, NULL) == (uintptr_t)-1)
+            printf("Error: _beginthread(ThreadStratumBridge) failed\n");
+    }
     if (fGenerateBitcoins)
         StartMinerThreads();
 
@@ -688,18 +1216,30 @@ int main(int argc, char* argv[])
 #endif
 
     if (fHeadless) {
-#ifndef _WIN32
+#ifdef _WIN32
+        SetConsoleCtrlHandler(HeadlessConsoleCtrlHandler, TRUE);
+#else
         auto sig=[](int){fShutdown=true;};
         signal(SIGINT,sig); signal(SIGTERM,sig);
 #endif
         printf("Running headless. Ctrl-C to stop.\n");
         while (!fShutdown) Sleep(500);
         StopNode();
+        BtfStopManagedTor();
         // Checkpoints, releases wallet.dat from this directory's Berkeley DB
         // environment, and closes it. Declared since 2009 and never once
         // called here, which is why a wallet.dat copied elsewhere would not
         // open -- issue #40. Not optional.
         DBFlush(true);
+        // Checkpoint and close the SQLite wallet backend if one is active. A
+        // no-op on the Berkeley DB path. Safe to kill before this runs: WAL +
+        // synchronous=FULL already made every committed write durable.
+        WalletSQLiteRuntimeClose();
+#ifdef _WIN32
+        // wallet.dat is safely flushed and closed now; let a pending console
+        // control handler (CLOSE/LOGOFF/SHUTDOWN) return so the OS can finish.
+        g_fHeadlessShutdownDone = true;
+#endif
         return 0;
     }
 
@@ -709,7 +1249,9 @@ int main(int argc, char* argv[])
     int ret = RunGUI(argc, argv);
     fShutdown = true;
     StopNode();
+    BtfStopManagedTor();
     DBFlush(true);
+    WalletSQLiteRuntimeClose();
     return ret;
 #endif
 }