1 files changed, 990 insertions, 162 deletions

diff --git a/src/rpc.cpp b/src/rpc.cpp
index 03d1f44..8af2fbe 100644
--- a/src/rpc.cpp
+++ b/src/rpc.cpp
@@ -236,35 +236,73 @@ static bool RebuildJob()
         CBlock block;
         block.vtx.push_back(txNew);
 
+        // Fill the block the same way BitcoinMiner() does, because this is the
+        // same job: a block that gets mined and submitted for real.
+        //
+        // It used to differ in two ways, and both were bugs.
+        //
+        // One pass over mapTransactions is not enough. That map is keyed by
+        // hash, so it has no dependency order, and a transaction spending the
+        // still-unconfirmed output of another (change from a recent send, most
+        // commonly) fails ConnectInputs whenever its parent happens to sit
+        // later in map order. A single pass then drops it -- and because map
+        // order does not change between rebuilds, every later rebuild drops it
+        // again at the same point. Deterministic exclusion, not bad luck: if
+        // pool operators mine most of the blocks, a transaction of that shape
+        // can stay unconfirmed for as long as its parent does.
+        //
+        // Diagnosis and fix both come from Vic-Nas, who found it in his fork
+        // of this code and described it exactly. The fork has since been
+        // deleted, so this carries it back rather than losing it.
+        int64 nFees = 0;
         {
             CTxDB txdb("r");
             CRITICAL_BLOCK(cs_mapTransactions)
             {
                 map<uint256, CTxIndex> pool;
+                vector<char> vfAlreadyAdded(mapTransactions.size());
+                bool fFoundSomething = true;
                 unsigned int sz = 0;
-                for (auto& kv : mapTransactions) {
-                    CTransaction& tx = kv.second;
-                    if (tx.IsCoinBase() || !tx.IsFinal()) continue;
-                    int64 nFees = 0;
-                    map<uint256, CTxIndex> tmp(pool);
-                    if (!tx.ConnectInputs(txdb, tmp, CDiskTxPos(1,1,1), 0, nFees,
-                                          false, true, tx.GetMinFee(block.vtx.size() < 100)))
-                        continue;
-                    pool = tmp;
-                    block.vtx.push_back(tx);
-                    sz += ::GetSerializeSize(tx, SER_NETWORK);
-                    // Must stay under the consensus cap CheckBlock() enforces.
-                    // This is the pool's job builder, so a block over the cap
-                    // is not just one wasted solve -- it is every miner on the
-                    // pool working a template the network will reject. The
-                    // transaction is already pushed above, so this can overshoot
-                    // by one; half the cap leaves room for that.
-                    if (sz > MAX_BLOCK_SIZE / 2) break;
+                // The cap is MAX_BLOCK_SIZE/2, not MAX_SIZE/2. MAX_SIZE is the
+                // 32 MB serialisation ceiling, so half of it is 16 MB -- this
+                // builder would happily assemble a template that its own
+                // CheckBlock() rejects at the 1 MB consensus cap. This is the
+                // pool's job builder, so a block over the cap is not one
+                // wasted solve, it is every miner on the pool working a
+                // template the network will reject. The inner break bounds the
+                // overshoot to a single transaction within a pass.
+                while (fFoundSomething && sz < MAX_BLOCK_SIZE / 2)
+                {
+                    fFoundSomething = false;
+                    unsigned int n = 0;
+                    for (map<uint256, CTransaction>::iterator mi = mapTransactions.begin();
+                         mi != mapTransactions.end(); ++mi, ++n)
+                    {
+                        if (vfAlreadyAdded[n])
+                            continue;
+                        CTransaction& tx = (*mi).second;
+                        if (tx.IsCoinBase() || !tx.IsFinal()) continue;
+                        map<uint256, CTxIndex> tmp(pool);
+                        if (!tx.ConnectInputs(txdb, tmp, CDiskTxPos(1,1,1), 0, nFees,
+                                              false, true, tx.GetMinFee(block.vtx.size() < 100)))
+                            continue;
+                        swap(pool, tmp);
+                        block.vtx.push_back(tx);
+                        sz += ::GetSerializeSize(tx, SER_NETWORK);
+                        vfAlreadyAdded[n] = true;
+                        fFoundSomething = true;
+                        if (sz > MAX_BLOCK_SIZE / 2) break;
+                    }
                 }
             }
         }
 
-        block.vtx[0].vout[0].nValue = block.GetBlockValue(pindexPrev->nHeight + 1, 0);
+        // And the fees actually go to the coinbase now. nFees was declared
+        // inside the scan loop, so every transaction reset it and the total was
+        // thrown away, while this line passed a hardcoded 0. A pool operator
+        // collected fees into a block and paid none of them to itself. Solo
+        // mining has always passed nFees here; only this builder did not.
+        block.vtx[0].vout[0].nValue = block.GetBlockValue(pindexPrev->nHeight + 1, nFees);
         block.hashPrevBlock  = pindexPrev->GetBlockHash();
         block.hashMerkleRoot = block.BuildMerkleTree();
         block.nTime = max((unsigned int)(pindexPrev->GetMedianTimePast() + 1),
@@ -297,26 +335,110 @@ struct PendingPayout {
     // supposed to pay it: a 280-block reorg once left ~14.4k BTF of debt
     // owed against blocks that no longer existed, which then drained the
     // wallet paying fork-era miners out of real-chain coin.
+    //
+    // Upstream keys these on the string "block-<height>". That is the same
+    // bug this fork already paid for, and height keying additionally lets
+    // FindRecordedPoolPayout match the *previous* round's transaction after a
+    // reorg and silently skip a miner, so their `id` is deliberately dropped.
     int                          blockHeight = 0;
     // Must be explicitly zeroed: uint256's default constructor is empty
     // (uint256.h:514), so leaving this unassigned gives every ledger entry
     // loaded from an older file a garbage hash, which then matches no block
     // and gets voided as "orphaned". That mistake voided a live payout.
     uint256                      blockHash = 0;  // zero = entry predates hash keying
-    int                          matureAtHeight;
+    int                          matureAtHeight = 0;
     std::map<std::string, int64> amounts; // address -> satoshis
+    // From upstream: which recipients already have a transaction. This is what
+    // lets an entry stay on disk until every address in `amounts` is paid,
+    // instead of being erased the moment the batch is handed off.
+    std::map<std::string, std::string> paidTxids; // address -> txid
     int                          retries = 0;    // exec-thread only: SendMoney attempts so far
     int                          deferrals = 0;  // exec-thread only: waits for spendable coin
+    // Upstream's `nextAttempt` is this field under another name; ours is kept
+    // so the retry/deferral policy above stays coherent with it.
     int64                        retryAfter = 0; // exec-thread only: unix time, 0 = ready now
 };
 static std::vector<PendingPayout> gPendingPayouts;
+static std::mutex                 gPayoutLedgerMutex;
+
+struct PoolRoundProof {
+    std::string                  id;
+    int                          blockHeight;
+    int                          matureAtHeight;
+    int64                        createdAt;
+    std::string                  blockHash;
+    std::string                  coinbaseTxid;
+    std::string                  foundBy;
+    double                       feePercent;
+    uint64                       totalShares;
+    int64                        coinbaseValue;
+    int64                        subsidy;
+    int64                        minerReward;
+    int64                        operatorReward;
+    int                          skippedDust;
+    int64                        forfeitedBadAddress;
+    std::map<std::string, uint64> shares;
+    std::map<std::string, int64>  payouts;
+    std::map<std::string, std::string> paidTxids;
+
+    PoolRoundProof()
+        : blockHeight(0), matureAtHeight(0), createdAt(0), feePercent(0.0),
+          totalShares(0), coinbaseValue(0), subsidy(0), minerReward(0), operatorReward(0),
+          skippedDust(0), forfeitedBadAddress(0) {}
+};
+static std::vector<PoolRoundProof> gPoolRounds;
+static std::mutex                  gPoolRoundsMutex;
+static const size_t                MAX_POOL_ROUNDS = 200;
 
 static std::string PayoutFilePath()
 {
     return GetAppDir() + "/pending_payouts.json";
 }
 
-static void SavePendingPayouts()
+static std::string PoolRoundsFilePath()
+{
+    if (!strPoolRoundsFile.empty())
+        return strPoolRoundsFile;
+    return GetAppDir() + "/pool_rounds.json";
+}
+
+// Identity of a payout round. Used as the pool-round proof id and, more
+// importantly, as the `pool_payout_id` written into wallet transaction
+// metadata and matched by FindRecordedPoolPayout().
+//
+// Derived from the block HASH, not from its height alone. Upstream uses
+// "block-<height>", which names two different blocks identically across a
+// reorg -- and because this id is what the crash-recovery probe matches on, a
+// height-keyed id lets that probe find the *previous* round's transaction and
+// conclude a miner has already been paid when they have not. The height stays
+// in the string for readability only.
+//
+// A zero hash means the entry predates hash keying; those keep the old form so
+// anything already recorded against them still matches.
+static std::string PayoutIdForBlock(int blockHeight, const uint256& blockHash)
+{
+    if (blockHash == 0)
+        return strprintf("block-%d", blockHeight);
+    return strprintf("block-%d-%s", blockHeight,
+                     blockHash.ToString().substr(0, 16).c_str());
+}
+
+static bool PayoutFullyPaid(const PendingPayout& pp)
+{
+    for (const auto& kv : pp.amounts)
+        if (pp.paidTxids.count(kv.first) == 0)
+            return false;
+    return true;
+}
+
+// Serialise the ledger. Caller must hold gPayoutLedgerMutex.
+//
+// Split from the file write so the payout thread can hold the mutex just long
+// enough to read the structure and then do the I/O with it released. Upstream
+// writes the file inside the per-recipient loop with gPayoutLedgerMutex held,
+// while the event loop's FlushMaturePayouts blocks on that same mutex -- one
+// slow fsync per recipient, on the thread the miners' I/O shares.
+static std::string SerializePendingPayoutsLocked()
 {
     nlohmann::json arr = nlohmann::json::array();
     for (const auto& pp : gPendingPayouts) {
@@ -324,21 +446,49 @@ static void SavePendingPayouts()
         obj["blockHeight"]    = pp.blockHeight;
         obj["blockHash"]      = pp.blockHash.ToString();
         obj["matureAtHeight"] = pp.matureAtHeight;
+        obj["retryAfter"]     = pp.retryAfter;
         nlohmann::json amounts = nlohmann::json::object();
         for (const auto& kv : pp.amounts)
             amounts[kv.first] = kv.second;
         obj["amounts"] = amounts;
+        nlohmann::json paid = nlohmann::json::object();
+        for (const auto& kv : pp.paidTxids)
+            paid[kv.first] = kv.second;
+        obj["paidTxids"] = paid;
         arr.push_back(obj);
     }
+    return arr.dump(2);
+}
+
+// Write the serialised ledger. Holds no lock; safe to call with the mutex
+// released. Atomic tmp+rename so a crash mid-write cannot truncate the record
+// of who is still owed money.
+static void WritePendingPayoutsFile(const std::string& s)
+{
     std::string path = PayoutFilePath();
-    FILE* f = fopen(path.c_str(), "w");
-    if (f) {
-        std::string s = arr.dump(2);
-        fwrite(s.c_str(), 1, s.size(), f);
-        fclose(f);
-    } else {
-        LogPrint("payout", "[payout] WARNING: could not write %s\n", path.c_str());
+    std::string tmp = path + ".tmp";
+    FILE* f = fopen(tmp.c_str(), "w");
+    if (!f) {
+        LogPrint("payout", "[payout] WARNING: could not write %s\n", tmp.c_str());
+        return;
     }
+    fwrite(s.c_str(), 1, s.size(), f);
+    if (fclose(f) != 0) {
+        LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
+        return;
+    }
+#ifdef _WIN32
+    remove(path.c_str());
+#endif
+    if (rename(tmp.c_str(), path.c_str()) != 0)
+        LogPrint("payout", "[payout] WARNING: could not replace %s\n", path.c_str());
+}
+
+// Convenience for the cold paths (startup, queueing) where holding the mutex
+// across the write costs nothing. Caller must hold gPayoutLedgerMutex.
+static void SavePendingPayoutsLocked()
+{
+    WritePendingPayoutsFile(SerializePendingPayoutsLocked());
 }
 
 static void LoadPendingPayouts()
@@ -354,6 +504,7 @@ static void LoadPendingPayouts()
     fclose(f);
     try {
         nlohmann::json arr = nlohmann::json::parse(s);
+        std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
         for (const auto& obj : arr) {
             PendingPayout pp;
             pp.matureAtHeight = obj["matureAtHeight"].get<int>();
@@ -364,8 +515,24 @@ static void LoadPendingPayouts()
                 pp.blockHash.SetHex(obj["blockHash"].get<std::string>());
             if (obj.contains("blockHeight") && obj["blockHeight"].is_number())
                 pp.blockHeight = obj["blockHeight"].get<int>();
+            // Upstream's tolerance for an entry with no usable height, kept
+            // because it costs nothing and an entry that cannot name its block
+            // is worse than one derived from its maturity. COINBASE_MATURITY
+            // and not COINBASE_SPENDABLE_DEPTH: this reverses whatever the
+            // writer of *that* file used, and only files old enough to lack
+            // blockHeight are affected -- they were written when maturity was
+            // still COINBASE_MATURITY.
+            if (pp.blockHeight == 0 && pp.matureAtHeight > COINBASE_MATURITY)
+                pp.blockHeight = pp.matureAtHeight - COINBASE_MATURITY;
+            // Absent in every file written before this merge; default 0 means
+            // "ready now", which is the right answer for a restored entry.
+            if (obj.contains("retryAfter") && obj["retryAfter"].is_number())
+                pp.retryAfter = obj["retryAfter"].get<int64>();
             for (auto it = obj["amounts"].begin(); it != obj["amounts"].end(); ++it)
                 pp.amounts[it.key()] = it.value().get<int64>();
+            if (obj.contains("paidTxids") && obj["paidTxids"].is_object())
+                for (auto it = obj["paidTxids"].begin(); it != obj["paidTxids"].end(); ++it)
+                    pp.paidTxids[it.key()] = it.value().get<std::string>();
             gPendingPayouts.push_back(pp);
         }
         LogPrint("payout", "[payout] loaded %zu pending payout(s) from disk\n",
@@ -396,6 +563,17 @@ struct PayingRecord {
     int         retries    = 0;
     int         deferrals  = 0;
     int64       retryAfter = 0;
+    // Ask the wallet whether this payment already went out, once, before the
+    // first send attempt. Upstream asks on every attempt: FindRecordedPoolPayout
+    // is a linear scan of mapWallet under cs_mapWallet, per recipient, so with
+    // 2000 rotating payout addresses and a retry budget of 1440 that is a
+    // scan per address per minute for a day. The question it answers -- "did a
+    // previous process send this before it died?" -- can only change across a
+    // restart, and every restart re-sets this flag (ReconcilePayouts), so
+    // asking once per record is the whole of the answer.
+    //
+    // Not persisted: a record read back from disk is by definition a restart.
+    bool        fProbeWallet = true;
 };
 static std::vector<PayingRecord> gPaying; // guarded by gPayoutExecMutex
 static std::mutex                gPayoutExecMutex;
@@ -432,8 +610,19 @@ static void SavePayingLocked()
     }
     std::string s = arr.dump(2);
     fwrite(s.c_str(), 1, s.size(), f);
-    fflush(f);
-    fclose(f);
+    // fclose() is where buffered data actually reaches the OS, so a failure
+    // here means the .tmp is short -- renaming it over the real file would
+    // destroy the good copy. Upstream's check, taken because a truncated
+    // list of who is owed money is exactly what this function exists to
+    // prevent. rename() on Windows will not replace an existing file, hence
+    // the remove() first.
+    if (fclose(f) != 0) {
+        LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
+        return;
+    }
+#ifdef _WIN32
+    remove(path.c_str());
+#endif
     if (rename(tmp.c_str(), path.c_str()) != 0)
         LogPrint("payout", "[payout] WARNING: could not rename %s -> %s\n",
                  tmp.c_str(), path.c_str());
@@ -475,6 +664,143 @@ static void LoadPaying()
     }
 }
 
+// ---------------------------------------------------------------------------
+// Pool round proofs (upstream cbdd06d). Disjoint from the in-flight ledger
+// above -- this is the operator's published record of how a round was split,
+// not an obligation to pay. Both sides added code at this offset; both are
+// kept.
+// ---------------------------------------------------------------------------
+static nlohmann::json PoolRoundToJson(const PoolRoundProof& r)
+{
+    nlohmann::json j;
+    j["id"] = r.id;
+    j["blockHeight"] = r.blockHeight;
+    j["matureAtHeight"] = r.matureAtHeight;
+    j["createdAt"] = r.createdAt;
+    j["blockHash"] = r.blockHash;
+    j["coinbaseTxid"] = r.coinbaseTxid;
+    j["foundBy"] = r.foundBy;
+    j["feePercent"] = r.feePercent;
+    j["totalShares"] = r.totalShares;
+    j["coinbaseValueSatoshis"] = r.coinbaseValue;
+    j["coinbaseValueBtf"] = FormatMoney(r.coinbaseValue);
+    j["subsidySatoshis"] = r.subsidy;
+    j["subsidyBtf"] = FormatMoney(r.subsidy);
+    j["minerRewardSatoshis"] = r.minerReward;
+    j["minerRewardBtf"] = FormatMoney(r.minerReward);
+    j["operatorRewardSatoshis"] = r.operatorReward;
+    j["operatorRewardBtf"] = FormatMoney(r.operatorReward);
+    j["skippedDust"] = r.skippedDust;
+    j["forfeitedBadAddressSatoshis"] = r.forfeitedBadAddress;
+    j["forfeitedBadAddressBtf"] = FormatMoney(r.forfeitedBadAddress);
+
+    j["shares"] = nlohmann::json::object();
+    for (const auto& kv : r.shares)
+        j["shares"][kv.first] = kv.second;
+
+    j["payouts"] = nlohmann::json::object();
+    for (const auto& kv : r.payouts) {
+        nlohmann::json p;
+        p["amountSatoshis"] = kv.second;
+        p["amountBtf"] = FormatMoney(kv.second);
+        std::map<std::string, std::string>::const_iterator tx = r.paidTxids.find(kv.first);
+        if (tx != r.paidTxids.end())
+            p["txid"] = tx->second;
+        else
+            p["txid"] = nullptr;
+        j["payouts"][kv.first] = p;
+    }
+    return j;
+}
+
+static void SavePoolRoundsLocked()
+{
+    nlohmann::json root;
+    root["schema"] = "bitflash-pool-rounds-1";
+    root["updatedAt"] = GetTime();
+    root["rounds"] = nlohmann::json::array();
+    for (const PoolRoundProof& r : gPoolRounds)
+        root["rounds"].push_back(PoolRoundToJson(r));
+
+    std::string path = PoolRoundsFilePath();
+    std::string tmp = path + ".tmp";
+    FILE* f = fopen(tmp.c_str(), "w");
+    if (!f) {
+        LogPrint("payout", "[payout] WARNING: could not write %s\n", tmp.c_str());
+        return;
+    }
+    std::string s = root.dump(2);
+    fwrite(s.c_str(), 1, s.size(), f);
+    if (fclose(f) != 0) {
+        LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
+        return;
+    }
+#ifdef _WIN32
+    remove(path.c_str());
+#endif
+    if (rename(tmp.c_str(), path.c_str()) != 0)
+        LogPrint("payout", "[payout] WARNING: could not replace %s\n", path.c_str());
+}
+
+static void LoadPoolRounds()
+{
+    std::string path = PoolRoundsFilePath();
+    FILE* f = fopen(path.c_str(), "r");
+    if (!f) return;
+    fseek(f, 0, SEEK_END);
+    long sz = ftell(f);
+    fseek(f, 0, SEEK_SET);
+    std::string s(sz, '\0');
+    fread(&s[0], 1, sz, f);
+    fclose(f);
+
+    try {
+        nlohmann::json root = nlohmann::json::parse(s);
+        nlohmann::json arr = root.is_array() ? root : root["rounds"];
+        std::lock_guard<std::mutex> lk(gPoolRoundsMutex);
+        for (const auto& obj : arr) {
+            PoolRoundProof r;
+            if (obj.contains("id") && obj["id"].is_string()) r.id = obj["id"].get<std::string>();
+            if (obj.contains("blockHeight")) r.blockHeight = obj["blockHeight"].get<int>();
+            if (obj.contains("matureAtHeight")) r.matureAtHeight = obj["matureAtHeight"].get<int>();
+            if (obj.contains("createdAt")) r.createdAt = obj["createdAt"].get<int64>();
+            if (obj.contains("blockHash") && obj["blockHash"].is_string()) r.blockHash = obj["blockHash"].get<std::string>();
+            if (obj.contains("coinbaseTxid") && obj["coinbaseTxid"].is_string()) r.coinbaseTxid = obj["coinbaseTxid"].get<std::string>();
+            if (obj.contains("foundBy") && obj["foundBy"].is_string()) r.foundBy = obj["foundBy"].get<std::string>();
+            if (obj.contains("feePercent")) r.feePercent = obj["feePercent"].get<double>();
+            if (obj.contains("totalShares")) r.totalShares = obj["totalShares"].get<uint64>();
+            if (obj.contains("coinbaseValueSatoshis")) r.coinbaseValue = obj["coinbaseValueSatoshis"].get<int64>();
+            if (obj.contains("subsidySatoshis")) r.subsidy = obj["subsidySatoshis"].get<int64>();
+            if (obj.contains("minerRewardSatoshis")) r.minerReward = obj["minerRewardSatoshis"].get<int64>();
+            if (obj.contains("operatorRewardSatoshis")) r.operatorReward = obj["operatorRewardSatoshis"].get<int64>();
+            if (obj.contains("skippedDust")) r.skippedDust = obj["skippedDust"].get<int>();
+            if (obj.contains("forfeitedBadAddressSatoshis")) r.forfeitedBadAddress = obj["forfeitedBadAddressSatoshis"].get<int64>();
+            if (obj.contains("shares") && obj["shares"].is_object())
+                for (auto it = obj["shares"].begin(); it != obj["shares"].end(); ++it)
+                    r.shares[it.key()] = it.value().get<uint64>();
+            if (obj.contains("payouts") && obj["payouts"].is_object())
+                for (auto it = obj["payouts"].begin(); it != obj["payouts"].end(); ++it) {
+                    if (it.value().is_object()) {
+                        r.payouts[it.key()] = it.value().value("amountSatoshis", (int64)0);
+                        if (it.value().contains("txid") && it.value()["txid"].is_string())
+                            r.paidTxids[it.key()] = it.value()["txid"].get<std::string>();
+                    } else if (it.value().is_number_integer()) {
+                        r.payouts[it.key()] = it.value().get<int64>();
+                    }
+                }
+            if (!r.id.empty())
+                gPoolRounds.push_back(r);
+        }
+        while (gPoolRounds.size() > MAX_POOL_ROUNDS)
+            gPoolRounds.erase(gPoolRounds.begin());
+        LogPrint("payout", "[payout] loaded %zu pool round proof(s) from disk\n",
+                 gPoolRounds.size());
+    } catch (const std::exception& e) {
+        LogPrint("payout", "[payout] WARNING: failed to parse %s: %s\n",
+                 path.c_str(), e.what());
+    }
+}
+
 // Is the block that funds this payout still on the main chain?
 //
 // A zero hash means the entry was written before payouts recorded one, so
@@ -499,85 +825,55 @@ static std::string PayoutComment(int blockHeight)
     return strprintf("Pool payout height %d", blockHeight);
 }
 
-// Did we already send this payment before dying? Looks for a wallet
-// transaction of ours carrying this payout's comment and paying exactly this
-// amount to this address.
+// Startup reconciliation.
 //
-// Biased towards reporting "already paid" on any doubt: skipping a payment a
-// miner is owed is visible and recoverable from the log, while paying twice
-// is neither.
-static bool WalletAlreadyPaid(const PayingRecord& r)
-{
-    uint160 h160;
-    if (!AddressToHash160(r.address, h160))
-        return false;
-    CScript want;
-    want << OP_DUP << OP_HASH160 << h160 << OP_EQUALVERIFY << OP_CHECKSIG;
-    const std::string comment = PayoutComment(r.blockHeight);
-
-    CRITICAL_BLOCK(cs_mapWallet)
-    {
-        for (std::map<uint256, CWalletTx>::iterator it = mapWallet.begin();
-             it != mapWallet.end(); ++it) {
-            CWalletTx& wtx = it->second;
-            // The comment is written only by the payout path, so its presence
-            // already identifies the transaction as one of ours.
-            std::map<std::string, std::string>::const_iterator ci =
-                wtx.mapValue.find("comment");
-            if (ci == wtx.mapValue.end() || ci->second != comment)
-                continue;
-            foreach (const CTxOut& txout, wtx.vout)
-                if (txout.nValue == r.amount && txout.scriptPubKey == want)
-                    return true;
-        }
-    }
-    return false;
-}
-
-// Startup reconciliation. Drops in-flight records the wallet shows were
-// already sent, and drops ledger entries that were already exploded into
-// records (which happens if we died between writing the records and rewriting
-// the ledger -- both files then describe the same debt).
+// This used to be the crash-recovery mechanism: it scanned the wallet with
+// WalletAlreadyPaid() and then dropped ledger entries that had already been
+// exploded into in-flight records. Neither job is right any more.
+//
+// The ledger is now authoritative and an entry survives until every recipient
+// has a txid recorded against it (upstream cbdd06d), so dropping ledger
+// entries here would reintroduce exactly the loss this merge is adopting that
+// model to prevent. And the wallet scan is now FindRecordedPoolPayout(), done
+// once per record on its first attempt, which is the same question asked in
+// the one place that can act on the answer. Running both would be two
+// authorities for the same debt.
+//
+// What is left is the useful part: the in-flight list restored from disk may
+// contain records the ledger already shows as paid (we died between the send
+// and the in-flight file being rewritten). The ledger wins.
 static void ReconcilePayouts()
 {
-    std::lock_guard<std::mutex> lk(gPayoutExecMutex);
+    std::lock_guard<std::mutex> exec(gPayoutExecMutex);
+    std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
 
     size_t settled = 0;
     int64  settledAmount = 0;
     for (auto it = gPaying.begin(); it != gPaying.end(); ) {
-        if (WalletAlreadyPaid(*it)) {
+        bool paid = false;
+        for (const PendingPayout& pp : gPendingPayouts)
+            if (pp.blockHash == it->blockHash && pp.paidTxids.count(it->address)) {
+                paid = true;
+                break;
+            }
+        if (paid) {
             settledAmount += it->amount;
             settled++;
             it = gPaying.erase(it);
         } else {
+            // Every restored record gets one wallet probe before it is allowed
+            // to send: this is precisely the window where the wallet may hold
+            // a transaction the ledger has not recorded yet.
+            it->fProbeWallet = true;
             ++it;
         }
     }
     if (settled) {
-        LogPrint("payout", "[payout] %zu in-flight payment(s) totalling %s were"
-                 " already sent before the last shutdown -- not resending\n",
+        LogPrint("payout", "[payout] %zu in-flight payment(s) totalling %s are"
+                 " already recorded paid in the ledger -- not resending\n",
                  settled, FormatMoney(settledAmount).c_str());
-        SavePayingLocked();
-    }
-
-    size_t dropped = 0;
-    for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ) {
-        bool exploded = false;
-        for (const auto& r : gPaying)
-            if (r.matureAtHeight == it->matureAtHeight && r.blockHash == it->blockHash) {
-                exploded = true;
-                break;
-            }
-        if (exploded) {
-            LogPrint("payout", "[payout] ledger entry for block %d is already"
-                     " in flight -- dropping the duplicate\n", it->blockHeight);
-            it = gPendingPayouts.erase(it);
-            dropped++;
-        } else {
-            ++it;
-        }
     }
-    if (dropped) SavePendingPayouts();
+    SavePayingLocked();
 
     if (!gPaying.empty()) {
         int64 owed = 0;
@@ -587,12 +883,100 @@ static void ReconcilePayouts()
     }
 }
 
+static void RecordPoolRound(const PoolRoundProof& round)
+{
+    std::lock_guard<std::mutex> lk(gPoolRoundsMutex);
+    for (PoolRoundProof& existing : gPoolRounds) {
+        if (existing.id == round.id) {
+            existing = round;
+            SavePoolRoundsLocked();
+            return;
+        }
+    }
+    gPoolRounds.push_back(round);
+    while (gPoolRounds.size() > MAX_POOL_ROUNDS)
+        gPoolRounds.erase(gPoolRounds.begin());
+    SavePoolRoundsLocked();
+}
+
+static void MarkPoolRoundPaid(const std::string& id,
+                              const std::string& address,
+                              const std::string& txid)
+{
+    std::lock_guard<std::mutex> lk(gPoolRoundsMutex);
+    for (PoolRoundProof& r : gPoolRounds) {
+        if (r.id != id)
+            continue;
+        r.paidTxids[address] = txid;
+        SavePoolRoundsLocked();
+        return;
+    }
+}
+
+// Upstream's gPayoutExecQueue/gPayoutExecMutex/gPayoutThreadRunning are
+// declared above with gPaying: the in-flight list IS the exec queue in this
+// tree, at per-recipient rather than per-round granularity, so a second queue
+// would be a second answer to "who is owed money". Only the dedupe set is new.
+//
+// Ids of rounds currently exploded into gPaying, so a flush cannot queue the
+// same round twice. Guarded by gPayoutExecMutex.
+static std::set<std::string>      gQueuedPayouts;
+
+static bool FindRecordedPoolPayout(const std::string& id,
+                                   const std::string& address,
+                                   int64 amount,
+                                   std::string& txidRet)
+{
+    CRITICAL_BLOCK(cs_mapWallet)
+    {
+        for (map<uint256, CWalletTx>::const_iterator it = mapWallet.begin();
+             it != mapWallet.end(); ++it)
+        {
+            const CWalletTx& wtx = it->second;
+            map<string, string>::const_iterator idIt = wtx.mapValue.find("pool_payout_id");
+            if (idIt == wtx.mapValue.end() || idIt->second != id)
+                continue;
+            map<string, string>::const_iterator addrIt = wtx.mapValue.find("pool_payout_address");
+            if (addrIt == wtx.mapValue.end() || addrIt->second != address)
+                continue;
+            map<string, string>::const_iterator amtIt = wtx.mapValue.find("pool_payout_amount");
+            if (amtIt == wtx.mapValue.end() || amtIt->second != strprintf("%lld", amount))
+                continue;
+            txidRet = wtx.GetHash().GetHex();
+            return true;
+        }
+    }
+    return false;
+}
+
+// blockHash stays a uint256 and not upstream's display string: it is the key
+// this fork's payout ledger is built on, and a key that has been through
+// ToString() is a key that can be compared wrong. It is converted to text only
+// where the round proof needs text. The other three arguments are upstream's,
+// carried for the round-proof data.
 static void QueuePayouts(int blockHeight,
                          const uint256& blockHash,
+                         const std::string& coinbaseTxid,
+                         int64 coinbaseValue,
+                         const std::string& foundBy,
                          const std::map<std::string, uint64>& shareCount,
                          uint64 total)
 {
+    PoolRoundProof round;
+    round.id = PayoutIdForBlock(blockHeight, blockHash);
+    round.blockHeight = blockHeight;
+    round.matureAtHeight = blockHeight + COINBASE_SPENDABLE_DEPTH;
+    round.createdAt = GetTime();
+    round.blockHash = blockHash.ToString();
+    round.coinbaseTxid = coinbaseTxid;
+    round.coinbaseValue = coinbaseValue;
+    round.foundBy = foundBy;
+    round.feePercent = dPoolFeePercent;
+    round.totalShares = total;
+    round.shares = shareCount;
+
     if (total == 0) {
+        RecordPoolRound(round);
         LogPrint("payout", "[payout] block %d: zero shares recorded -- nothing to pay out\n",
                  blockHeight);
         return;
@@ -608,6 +992,10 @@ static void QueuePayouts(int blockHeight,
     int64 nSubsidy = 50 * COIN;
     nSubsidy >>= (blockHeight / 210000); // halving schedule
     int64 minerReward = (int64)((double)nSubsidy * (1.0 - feeFrac));
+    int64 operatorCut = nSubsidy - minerReward;
+    round.subsidy = nSubsidy;
+    round.minerReward = minerReward;
+    round.operatorReward = operatorCut;
 
     PendingPayout pp;
     pp.blockHeight = blockHeight;
@@ -621,7 +1009,9 @@ static void QueuePayouts(int blockHeight,
     // alone on a private fork paying itself, so it says nothing about a pool
     // competing on the real chain. Waiting the extra 20 blocks makes each
     // payout funded by construction, and puts the maturity gate past the
-    // reorg depth that orphaned 280 blocks of obligations.
+    // reorg depth that orphaned 280 blocks of obligations. Upstream uses
+    // COINBASE_MATURITY here; this is a considered disagreement, not an
+    // oversight -- see the merge commit message.
     pp.matureAtHeight = blockHeight + COINBASE_SPENDABLE_DEPTH;
 
     int skipped = 0;
@@ -643,12 +1033,18 @@ static void QueuePayouts(int blockHeight,
             continue;
         }
         pp.amounts[kv.first] = amount;
+        round.payouts[kv.first] = amount;
     }
+    round.skippedDust = skipped;
+    round.forfeitedBadAddress = burned;
 
-    gPendingPayouts.push_back(pp);
-    SavePendingPayouts();
+    {
+        std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
+        gPendingPayouts.push_back(pp);
+        SavePendingPayoutsLocked();
+    }
+    RecordPoolRound(round);
 
-    int64 operatorCut = nSubsidy - minerReward;
     LogPrint("payout",
              "[payout] block %d: subsidy %s BTF, miners get %s"
              " (fee %.2f%% = %s to operator),"
@@ -664,66 +1060,110 @@ static void QueuePayouts(int blockHeight,
                         : "");
 }
 
-// Called from event loop: move matured entries into the in-flight list (fast).
+// Called from the event loop: explode matured ledger entries into per-recipient
+// in-flight records (fast; no wallet or disk work beyond one small write).
+//
+// The ledger entry SURVIVES here. That is upstream's model and it is the
+// crash-safe one: this fork used to erase the entry as soon as its payments
+// were handed off, so a death in that window left the debt described by
+// nothing at all -- a container restart on 2026-07-30 silently dropped
+// ~1,156 BTF exactly that way. An entry is removed only once every recipient
+// in it has a txid recorded (PayoutFullyPaid), which the payout thread does.
 //
-// Ordering matters and is deliberate: the in-flight records are written and
-// fsync'd to their own file *before* the ledger entry is erased, so the debt
-// is always described by at least one of the two files. Dying in the window
-// where both describe it is handled at startup by ReconcilePayouts, which
-// drops the ledger entry it can see is already in flight.
+// gPaying is kept on top of that as the in-flight working set: it carries the
+// per-recipient retry/deferral state that a per-round `nextAttempt` cannot
+// express, and it is what the payout thread iterates. It is a cache of work
+// derived from the ledger, never an independent record of debt -- if it were
+// lost entirely the ledger would rebuild it on the next flush.
 static void FlushMaturePayouts()
 {
-    // Void obligations whose funding block lost a reorg. The coin that was
-    // meant to pay them does not exist, so paying anyway spends real-chain
-    // coin the pool owes to somebody else.
-    bool voided = false;
-    for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ) {
-        if (PayoutBlockStillOnChain(it->blockHash)) { ++it; continue; }
-        int64 total = 0;
-        for (auto& kv : it->amounts) total += kv.second;
-        LogPrint("payout", "[payout] block %d (%s) was orphaned -- voiding %zu"
-                 " payment(s) totalling %s\n",
-                 it->blockHeight, it->blockHash.ToString().substr(0, 14).c_str(),
-                 it->amounts.size(), FormatMoney(total).c_str());
-        it = gPendingPayouts.erase(it);
-        voided = true;
+    // Which funding blocks are still on the main chain? Asked with no payout
+    // lock held: PayoutBlockStillOnChain takes cs_main, and cs_main is held by
+    // ProcessBlock and SendMoney for long stretches. Holding the ledger mutex
+    // across it would let the event loop park the payout thread behind a chain
+    // lock it has no interest in. (It is not a deadlock either way -- nothing
+    // takes the ledger mutex while holding cs_main -- but it is exactly the
+    // kind of stall this merge is removing from the ledger path.)
+    std::vector<uint256> orphaned;
+    {
+        std::vector<uint256> hashes;
+        {
+            std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
+            for (const PendingPayout& pp : gPendingPayouts)
+                hashes.push_back(pp.blockHash);
+        }
+        for (const uint256& h : hashes)
+            if (!PayoutBlockStillOnChain(h))
+                orphaned.push_back(h);
     }
-    if (voided) SavePendingPayouts();
 
     std::vector<PendingPayout> ready;
-    for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ) {
-        if (nBestHeight < it->matureAtHeight) { ++it; continue; }
-        LogPrint("payout", "[payout] block height %d matured -- queuing %zu payments\n",
-                 it->matureAtHeight, it->amounts.size());
-        ready.push_back(*it);   // copy first; erase after save
-        ++it;
-    }
-    if (!ready.empty()) {
-        // Record the individual payments first, and only then drop the ledger
-        // entries that produced them.
-        {
-            std::lock_guard<std::mutex> lk(gPayoutExecMutex);
-            for (const auto& pp : ready) {
-                for (const auto& kv : pp.amounts) {
-                    PayingRecord r;
-                    r.blockHeight    = pp.blockHeight;
-                    r.blockHash      = pp.blockHash;
-                    r.matureAtHeight = pp.matureAtHeight;
-                    r.address        = kv.first;
-                    r.amount         = kv.second;
-                    gPaying.push_back(r);
-                }
-            }
-            SavePayingLocked();
-        }
+    {
+        std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
+
+        // Void obligations whose funding block lost a reorg. The coin that was
+        // meant to pay them does not exist, so paying anyway spends real-chain
+        // coin the pool owes to somebody else.
+        bool voided = false;
         for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ) {
-            if (nBestHeight >= it->matureAtHeight)
-                it = gPendingPayouts.erase(it);
-            else
+            if (std::find(orphaned.begin(), orphaned.end(), it->blockHash) == orphaned.end()) {
                 ++it;
+                continue;
+            }
+            int64 total = 0;
+            for (auto& kv : it->amounts) total += kv.second;
+            LogPrint("payout", "[payout] block %d (%s) was orphaned -- voiding %zu"
+                     " payment(s) totalling %s\n",
+                     it->blockHeight, it->blockHash.ToString().substr(0, 14).c_str(),
+                     it->amounts.size(), FormatMoney(total).c_str());
+            it = gPendingPayouts.erase(it);
+            voided = true;
         }
-        SavePendingPayouts();
+        if (voided) SavePendingPayoutsLocked();
+
+        int64 now = GetTime();
+        for (const PendingPayout& pp : gPendingPayouts) {
+            if (nBestHeight < pp.matureAtHeight)
+                continue;
+            if (pp.retryAfter > now)
+                continue;
+            if (PayoutFullyPaid(pp))
+                continue;
+            ready.push_back(pp);
+        }
+    }
+
+    if (ready.empty())
+        return;
+
+    std::lock_guard<std::mutex> queue(gPayoutExecMutex);
+    size_t added = 0;
+    for (const PendingPayout& pp : ready) {
+        const std::string id = PayoutIdForBlock(pp.blockHeight, pp.blockHash);
+        if (gQueuedPayouts.count(id))
+            continue;   // already exploded into gPaying and still in flight
+        size_t n = 0;
+        for (const auto& kv : pp.amounts) {
+            // Upstream's per-recipient dedupe: a recipient already carrying a
+            // txid is done, even though the entry as a whole is not.
+            if (pp.paidTxids.count(kv.first))
+                continue;
+            PayingRecord r;
+            r.blockHeight    = pp.blockHeight;
+            r.blockHash      = pp.blockHash;
+            r.matureAtHeight = pp.matureAtHeight;
+            r.address        = kv.first;
+            r.amount         = kv.second;
+            gPaying.push_back(r);
+            n++;
+        }
+        gQueuedPayouts.insert(id);
+        added += n;
+        LogPrint("payout", "[payout] block height %d matured -- queuing payout %s"
+                 " (%zu of %zu recipients still owed)\n",
+                 pp.matureAtHeight, id.c_str(), n, pp.amounts.size());
     }
+    if (added) SavePayingLocked();
 }
 
 // Identity of a payment, for finding its record again after SendMoney.
@@ -737,13 +1177,24 @@ static bool SamePayment(const PayingRecord& a, const PayingRecord& b)
 }
 
 // Settle a payment: it is either done or abandoned, either way it stops being
-// owed. Removing the record and rewriting the file is what makes the payment
-// not happen twice after a restart.
+// in flight. Note this only retires the working record -- whether the miner is
+// still OWED the money is the ledger's business, and the ledger is updated
+// separately by RecordPayoutTxid().
 static void ForgetPayment(const PayingRecord& r)
 {
     std::lock_guard<std::mutex> lk(gPayoutExecMutex);
     for (auto it = gPaying.begin(); it != gPaying.end(); ++it)
         if (SamePayment(*it, r)) { gPaying.erase(it); break; }
+
+    // When the last record for a round is gone the round is no longer in
+    // flight, so a later flush may explode it again if the ledger still shows
+    // recipients owed (a give-up, for instance, leaves the entry standing).
+    bool stillInFlight = false;
+    for (const auto& e : gPaying)
+        if (e.blockHash == r.blockHash) { stillInFlight = true; break; }
+    if (!stillInFlight)
+        gQueuedPayouts.erase(PayoutIdForBlock(r.blockHeight, r.blockHash));
+
     SavePayingLocked();
 }
 
@@ -753,14 +1204,77 @@ static void ReschedulePayment(const PayingRecord& r)
     std::lock_guard<std::mutex> lk(gPayoutExecMutex);
     for (auto& e : gPaying)
         if (SamePayment(e, r)) {
-            e.retries    = r.retries;
-            e.deferrals  = r.deferrals;
-            e.retryAfter = r.retryAfter;
+            e.retries      = r.retries;
+            e.deferrals    = r.deferrals;
+            e.retryAfter   = r.retryAfter;
+            // Carry the cleared probe flag back, or every retry re-scans the
+            // whole wallet -- the cost this merge is specifically removing.
+            e.fProbeWallet = r.fProbeWallet;
             break;
         }
     SavePayingLocked();
 }
 
+// Record that a recipient has been paid, in the ledger, which is the only
+// durable statement that the debt is settled.
+//
+// The file write happens with gPayoutLedgerMutex RELEASED. Upstream calls
+// SavePendingPayoutsLocked() inside the per-recipient loop with the mutex
+// held, so every recipient costs the event loop a full serialise+fsync it has
+// to wait for in FlushMaturePayouts.
+static void RecordPayoutTxid(const PayingRecord& r, const std::string& txid)
+{
+    std::string blob;
+    bool complete = false;
+    {
+        std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
+        for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ++it) {
+            if (it->blockHash != r.blockHash)
+                continue;
+            it->paidTxids[r.address] = txid;
+            it->retryAfter = 0;
+            if (PayoutFullyPaid(*it)) {
+                LogPrint("payout", "[payout] payout for block %d complete --"
+                         " removing from ledger\n", it->blockHeight);
+                gPendingPayouts.erase(it);
+                complete = true;
+            }
+            break;
+        }
+        blob = SerializePendingPayoutsLocked();
+    }
+    WritePendingPayoutsFile(blob);
+    // The round proof records a txid per address, so this is per recipient and
+    // not only on completion.
+    MarkPoolRoundPaid(PayoutIdForBlock(r.blockHeight, r.blockHash), r.address, txid);
+    if (complete)
+        LogPrint("payout", "[payout] block %d fully settled\n", r.blockHeight);
+}
+
+// Write a recipient off. Only reached after the full retry budget against a
+// block that is still on the main chain with coin available to spend, i.e. a
+// wallet fault rather than a maturity or reorg question.
+//
+// The amount is removed from the entry rather than marked paid, so the money
+// is not reported as sent. Once nothing is left owed the entry retires.
+static void ForfeitPayoutRecipient(const PayingRecord& r)
+{
+    std::string blob;
+    {
+        std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
+        for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ++it) {
+            if (it->blockHash != r.blockHash)
+                continue;
+            it->amounts.erase(r.address);
+            if (it->amounts.empty() || PayoutFullyPaid(*it))
+                gPendingPayouts.erase(it);
+            break;
+        }
+        blob = SerializePendingPayoutsLocked();
+    }
+    WritePendingPayoutsFile(blob);
+}
+
 // Payout execution thread: works through gPaying, calls SendMoney.
 // Runs independently of the event loop so slow wallet operations
 // (SendMoney takes cs_main) never stall miner I/O.
@@ -780,9 +1294,12 @@ static void PayoutThreadFn(void*)
         }
 
         for (PayingRecord r : batch) {
+            const std::string id = PayoutIdForBlock(r.blockHeight, r.blockHash);
+
             // Re-check here and not only at maturity: a payment can sit in this
             // list for hours across retries, and the reorg that kills its
-            // funding block can land at any point in that window.
+            // funding block can land at any point in that window. Upstream has
+            // no equivalent -- it decides once, when the entry matures.
             if (!PayoutBlockStillOnChain(r.blockHash)) {
                 LogPrint("payout", "[payout] block %d (%s) orphaned while queued"
                          " -- dropping %s to %s\n",
@@ -792,6 +1309,25 @@ static void PayoutThreadFn(void*)
                 continue;
             }
 
+            // Upstream's per-recipient dedupe, against the ledger rather than
+            // against the batch: if a txid is already recorded for this
+            // address, the money went out and nothing more is owed.
+            {
+                bool alreadyPaid = false;
+                {
+                    std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
+                    for (const PendingPayout& pp : gPendingPayouts)
+                        if (pp.blockHash == r.blockHash && pp.paidTxids.count(r.address)) {
+                            alreadyPaid = true;
+                            break;
+                        }
+                }
+                if (alreadyPaid) {
+                    ForgetPayment(r);
+                    continue;
+                }
+            }
+
             uint160 h160;
             if (!AddressToHash160(r.address, h160)) {
                 // Should not happen -- bad addresses are filtered in QueuePayouts
@@ -803,6 +1339,22 @@ static void PayoutThreadFn(void*)
             CScript sc;
             sc << OP_DUP << OP_HASH160 << h160 << OP_EQUALVERIFY << OP_CHECKSIG;
 
+            // Did a previous process send this and die before recording it?
+            // Only asked once per record -- see PayingRecord::fProbeWallet.
+            if (r.fProbeWallet) {
+                std::string recovered;
+                r.fProbeWallet = false;
+                if (FindRecordedPoolPayout(id, r.address, r.amount, recovered)) {
+                    LogPrint("payout", "[payout] recovered recorded payout %s to %s"
+                             " from wallet tx %s -- not resending\n",
+                             FormatMoney(r.amount).c_str(), r.address.c_str(),
+                             recovered.c_str());
+                    RecordPayoutTxid(r, recovered);
+                    ForgetPayment(r);
+                    continue;
+                }
+            }
+
             // Waiting for coin to mature is not a failure, so it must not
             // consume the retry budget. Burning a retry every 60s means a
             // payment the pool fully intends to honour can hit GIVING UP
@@ -825,11 +1377,22 @@ static void PayoutThreadFn(void*)
 
             CWalletTx wtx;
             wtx.mapValue["comment"] = PayoutComment(r.blockHeight);
+            // Upstream's structured metadata. This is what makes the wallet
+            // probe above possible at all -- the old comment-only form could
+            // not distinguish two rounds paying the same address the same
+            // amount. Keyed by the hash-derived id, so a reorg cannot make one
+            // round's transaction answer for another's.
+            wtx.mapValue["pool_payout_id"]      = id;
+            wtx.mapValue["pool_payout_address"] = r.address;
+            wtx.mapValue["pool_payout_amount"]  = strprintf("%lld", r.amount);
 
             if (SendMoney(sc, r.amount, wtx)) {
                 // The wallet holds the transaction before this returns, so a
-                // crash here is recoverable: ReconcilePayouts finds it by
-                // comment+address+amount and does not resend.
+                // crash between here and the ledger write is recoverable: the
+                // probe above finds it by id+address+amount and does not
+                // resend. Ledger first, in-flight record second -- the debt is
+                // described by at least one of them at every instant.
+                RecordPayoutTxid(r, wtx.GetHash().GetHex());
                 ForgetPayment(r);
                 LogPrint("payout", "[payout] paid %s to %s (tx %s)\n",
                          FormatMoney(r.amount).c_str(), r.address.c_str(),
@@ -857,6 +1420,12 @@ static void PayoutThreadFn(void*)
                          FormatMoney(r.amount).c_str(), r.address.c_str(),
                          r.retries, r.blockHeight,
                          FormatMoney(nSpendable).c_str());
+                // Write the debt off in the ledger as well as dropping the
+                // in-flight record. Under the survives-until-fully-paid model
+                // the entry would otherwise never complete, and every later
+                // flush would explode it again -- a forfeit that silently
+                // becomes an infinite retry.
+                ForfeitPayoutRecipient(r);
                 ForgetPayment(r);
             }
         }
@@ -881,6 +1450,7 @@ static StatsSnapshot                   gStats;
 static std::vector<PoolWorkerStatView> gWorkerStats;
 static std::vector<PendingPayoutView>  gPayoutViews;
 static std::mutex                      gStatsMutex;
+static int64                           gLastPoolStatusWrite = 0;
 
 void GetPoolOperatorStats(int& authorizedMiners, int& blocksFound, uint64& roundShares, double& totalHashRate)
 {
@@ -903,6 +1473,107 @@ void GetPendingPayouts(std::vector<PendingPayoutView>& out)
     out = gPayoutViews;
 }
 
+static std::string PoolStatusFilePath()
+{
+    if (!strPoolStatusFile.empty())
+        return strPoolStatusFile;
+    return GetAppDir() + "/pool_status.json";
+}
+
+static void WritePoolStatusJsonLocked()
+{
+    nlohmann::json j;
+    j["schema"] = "bitflash-pool-status-1";
+    j["network"] = "bitflash";
+    j["updatedAt"] = GetTime();
+
+    j["operator"] = {
+        {"name", strPoolName},
+        {"btfAddress", BtfLocalAddress()},
+        {"feePercent", dPoolFeePercent},
+        {"dashboardUrl", strPoolDashboardUrl},
+        {"roundsFile", "pool_rounds.json"}
+    };
+
+    j["node"] = {
+        {"height", nBestHeight},
+        {"poolRunning", (bool)gPoolRunning},
+        {"mode", nMineMode}
+    };
+
+    j["pool"] = {
+        {"authorizedMiners", gStats.authorizedMiners},
+        {"blocksFoundSession", gStats.blocksFound},
+        {"roundShares", gStats.roundShares},
+        {"hashRate", gStats.totalHashRate}
+    };
+
+    j["workers"] = nlohmann::json::array();
+    for (const PoolWorkerStatView& row : gWorkerStats) {
+        j["workers"].push_back({
+            {"address", row.address},
+            {"worker", row.worker},
+            {"totalShares", row.totalShares},
+            {"roundShares", row.roundShares},
+            {"lastSeen", row.lastSeen},
+            {"hashRate", row.hashRate}
+        });
+    }
+
+    j["pendingPayouts"] = nlohmann::json::array();
+    for (const PendingPayoutView& row : gPayoutViews) {
+        j["pendingPayouts"].push_back({
+            {"matureAtHeight", row.matureAtHeight},
+            {"recipients", row.recipients},
+            {"totalAmountSatoshis", row.totalAmount},
+            {"totalAmountBtf", FormatMoney(row.totalAmount)}
+        });
+    }
+
+    j["recentRounds"] = nlohmann::json::array();
+    {
+        std::lock_guard<std::mutex> lk(gPoolRoundsMutex);
+        size_t start = gPoolRounds.size() > 10 ? gPoolRounds.size() - 10 : 0;
+        for (size_t i = start; i < gPoolRounds.size(); i++) {
+            const PoolRoundProof& r = gPoolRounds[i];
+            int unpaid = 0;
+            for (const auto& kv : r.payouts)
+                if (r.paidTxids.count(kv.first) == 0)
+                    unpaid++;
+            j["recentRounds"].push_back({
+                {"id", r.id},
+                {"blockHeight", r.blockHeight},
+                {"blockHash", r.blockHash},
+                {"coinbaseTxid", r.coinbaseTxid},
+                {"totalShares", r.totalShares},
+                {"payouts", (int)r.payouts.size()},
+                {"unpaidPayouts", unpaid},
+                {"coinbaseValueBtf", FormatMoney(r.coinbaseValue)},
+                {"minerRewardBtf", FormatMoney(r.minerReward)}
+            });
+        }
+    }
+
+    std::string path = PoolStatusFilePath();
+    std::string tmp = path + ".tmp";
+    FILE* f = fopen(tmp.c_str(), "w");
+    if (!f) {
+        LogPrint("pool", "[pool] WARNING: could not write status file %s\n", tmp.c_str());
+        return;
+    }
+    std::string s = j.dump(2);
+    fwrite(s.c_str(), 1, s.size(), f);
+    if (fclose(f) != 0) {
+        LogPrint("pool", "[pool] WARNING: could not close status file %s\n", tmp.c_str());
+        return;
+    }
+#ifdef _WIN32
+    remove(path.c_str());
+#endif
+    if (rename(tmp.c_str(), path.c_str()) != 0)
+        LogPrint("pool", "[pool] WARNING: could not replace status file %s\n", path.c_str());
+}
+
 // ---------------------------------------------------------------------------
 // Miner state -- event loop thread only
 // ---------------------------------------------------------------------------
@@ -1453,7 +2124,11 @@ static bool HandleLine(Miner* m, const std::string& rawLine,
             int foundHeight = gCurrentJob.height;
             // b is the block we submitted, untouched by ProcessBlock (which
             // took a copy), so its hash is what the payout must be keyed on.
-            QueuePayouts(foundHeight, b.GetHash(), roundShareCount, roundShareTotal);
+            // Passed as a uint256, not hex: the ledger key must stay a real
+            // hash. The remaining arguments are upstream's round-proof data.
+            QueuePayouts(foundHeight, b.GetHash(), b.vtx[0].GetHash().GetHex(),
+                         b.vtx[0].vout[0].nValue, m->address,
+                         roundShareCount, roundShareTotal);
             // Reset round shares
             roundShareCount.clear();
             roundShareTotal = 0;
@@ -1479,6 +2154,147 @@ static bool HandleLine(Miner* m, const std::string& rawLine,
     return true;
 }
 
+int RunPoolStratumSelfTest()
+{
+    int nFail = 0;
+    auto check = [&](bool ok, const char* msg) {
+        fprintf(stdout, "  %s   %s\n", ok ? "ok" : "FAIL", msg);
+        if (!ok) nFail++;
+    };
+
+    fprintf(stdout, "pool-stratum self-test\n");
+
+    StratumJob savedJob = gCurrentJob;
+    bool savedHaveJob = gHaveJob;
+
+    CTransaction coinbase;
+    coinbase.vin.resize(1);
+    coinbase.vin[0].prevout.SetNull();
+    coinbase.vin[0].scriptSig << 1 << (CBigNum)1;
+    coinbase.vout.resize(1);
+    coinbase.vout[0].nValue = 50 * COIN;
+
+    CBlock block;
+    block.vtx.push_back(coinbase);
+    block.nVersion = 1;
+    block.nBits = 0x1f0fffff;
+    block.nTime = 1;
+    block.nNonce = 1;
+    block.hashMerkleRoot = block.BuildMerkleTree();
+
+    gCurrentJob.jobId = "selftest";
+    gCurrentJob.block = block;
+    gCurrentJob.target = 0; // accepted share, not a block candidate
+    gCurrentJob.height = 1;
+    gHaveJob = true;
+
+    Miner miner(INVALID_SOCKET);
+    miner.authorised = true;
+    miner.address = "selftest-address";
+    miner.worker = "worker";
+    miner.shareTarget = ~uint256(0); // every RandomX hash is a valid share
+    miner.difficulty = 0.001;
+    miner.vardiffWindowStart = GetTime();
+
+    std::map<std::string, uint64> roundShareCount;
+    uint64 roundShareTotal = 0;
+    int blocksFound = 0;
+
+    uint256 targetFromNotify;
+    CBlock minerBlock = BuildMinerBlock(gCurrentJob, miner.extranonce2);
+    json params = MakeNotifyParams(gCurrentJob, minerBlock, miner.shareTarget, true);
+    std::vector<unsigned char> targetBytes = FromHex(params[3].get<std::string>());
+    if (targetBytes.size() == 32)
+        memcpy(&targetFromNotify, &targetBytes[0], 32);
+    check(targetFromNotify == miner.shareTarget,
+          "mining.notify exposes the same share target the pool validates");
+
+    json submit = {
+        {"id", 7},
+        {"method", "mining.submit"},
+        {"params", json::array({miner.address, "selftest", ToHex(&minerBlock.nNonce, 4)})}
+    };
+    HandleLine(&miner, submit.dump(), roundShareCount, roundShareTotal, blocksFound);
+
+    check(roundShareTotal == 1, "fake low-difficulty share increments the round total");
+    check(roundShareCount[miner.address] == 1, "fake share is credited to the submitting address");
+    check(miner.sessionShares == 1 && miner.roundShares == 1 && miner.totalShares == 1,
+          "miner share counters advance together");
+    check(blocksFound == 0, "share below block target is not counted as a found block");
+
+    json stale = {
+        {"id", 8},
+        {"method", "mining.submit"},
+        {"params", json::array({miner.address, "stale", ToHex(&minerBlock.nNonce, 4)})}
+    };
+    HandleLine(&miner, stale.dump(), roundShareCount, roundShareTotal, blocksFound);
+    check(roundShareTotal == 1, "stale submit does not increment shares");
+
+    std::vector<PoolRoundProof> savedRounds = gPoolRounds;
+    std::string savedRoundsFile = strPoolRoundsFile;
+    std::string proofPath = "pool_rounds_selftest.json";
+    remove(proofPath.c_str());
+    remove((proofPath + ".tmp").c_str());
+    gPoolRounds.clear();
+    strPoolRoundsFile = proofPath;
+
+    PoolRoundProof proof;
+    proof.id = "selftest-round";
+    proof.blockHeight = 42;
+    proof.matureAtHeight = 42 + COINBASE_MATURITY;
+    proof.createdAt = GetTime();
+    proof.blockHash = block.GetHash().GetHex();
+    proof.coinbaseTxid = coinbase.GetHash().GetHex();
+    proof.foundBy = miner.address;
+    proof.feePercent = 1.25;
+    proof.totalShares = 3;
+    proof.coinbaseValue = 50 * COIN;
+    proof.subsidy = 50 * COIN;
+    proof.minerReward = 49 * COIN;
+    proof.operatorReward = 1 * COIN;
+    proof.shares[miner.address] = 3;
+    proof.payouts[miner.address] = 49 * COIN;
+    RecordPoolRound(proof);
+    MarkPoolRoundPaid(proof.id, miner.address, "selftest-txid");
+
+    bool proofOk = false;
+    FILE* pf = fopen(proofPath.c_str(), "r");
+    if (pf) {
+        fseek(pf, 0, SEEK_END);
+        long sz = ftell(pf);
+        fseek(pf, 0, SEEK_SET);
+        std::string s(sz, '\0');
+        fread(&s[0], 1, sz, pf);
+        fclose(pf);
+        try {
+            json root = json::parse(s);
+            proofOk =
+                root.value("schema", "") == "bitflash-pool-rounds-1" &&
+                root["rounds"].is_array() &&
+                root["rounds"].size() == 1 &&
+                root["rounds"][0].value("id", "") == proof.id &&
+                root["rounds"][0]["shares"].value(miner.address, (uint64)0) == 3 &&
+                root["rounds"][0]["payouts"][miner.address].value("txid", "") == "selftest-txid";
+        } catch (...) {
+            proofOk = false;
+        }
+    }
+    check(proofOk, "pool round proof ledger is written and paid txid is recorded");
+
+    remove(proofPath.c_str());
+    remove((proofPath + ".tmp").c_str());
+    strPoolRoundsFile = savedRoundsFile;
+    gPoolRounds = savedRounds;
+
+    gCurrentJob = savedJob;
+    gHaveJob = savedHaveJob;
+
+    fprintf(stdout, "%s (%d failure%s)\n", nFail == 0 ? "ALL TESTS PASSED" : "TESTS FAILED",
+            nFail, nFail == 1 ? "" : "s");
+    fflush(stdout);
+    return nFail == 0 ? 0 : 1;
+}
+
 // ---------------------------------------------------------------------------
 // Stats refresh -- called every 2s from event loop
 // ---------------------------------------------------------------------------
@@ -1512,16 +2328,27 @@ static void RefreshStats(int blocksFoundThisSession, uint64 roundShareTotal)
                                                   : a.lastSeen > b.lastSeen;
         });
 
-    // gPendingPayouts is event-loop-only data (no lock needed here since
-    // RefreshStats is always called from the event loop thread).
     gPayoutViews.clear();
+    std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
     for (const PendingPayout& pp : gPendingPayouts) {
         PendingPayoutView pv;
         pv.matureAtHeight = pp.matureAtHeight;
-        pv.recipients     = (int)pp.amounts.size();
+        pv.recipients     = 0;
         pv.totalAmount    = 0;
-        for (auto& kv : pp.amounts) pv.totalAmount += kv.second;
-        gPayoutViews.push_back(pv);
+        for (auto& kv : pp.amounts) {
+            if (pp.paidTxids.count(kv.first))
+                continue;
+            pv.recipients++;
+            pv.totalAmount += kv.second;
+        }
+        if (pv.recipients > 0)
+            gPayoutViews.push_back(pv);
+    }
+
+    int64 now = GetTime();
+    if (now - gLastPoolStatusWrite >= 10) {
+        WritePoolStatusJsonLocked();
+        gLastPoolStatusWrite = now;
     }
 }
 
@@ -1901,10 +2728,11 @@ void ThreadRPCServer(void*)
     }
 
     LoadPendingPayouts();
+    LoadPoolRounds();
     LoadPaying();
     // Must run before the payout thread starts, so nothing is resent that the
-    // wallet already shows as sent, and nothing is owed twice because we died
-    // between recording the payments and rewriting the ledger.
+    // ledger already shows as sent, and every restored in-flight record is
+    // armed for its one wallet probe before it is allowed to send.
     ReconcilePayouts();
 
     _beginthread(AcceptLoopFn, 0, NULL);