2 files changed, 50 insertions, 5 deletions

diff --git a/src/main_gui.cpp b/src/main_gui.cpp
index 2743429..25cde1c 100644
--- a/src/main_gui.cpp
+++ b/src/main_gui.cpp
@@ -196,6 +196,9 @@ static void PrintUsage()
     printf("  /walletsqlite=FILE         (stage-load a SQLite wallet export, then exit)\n");
     printf("  /walletbackend=sqlite      (opt-in: run the node on <datadir>/wallet.sqlite\n");
     printf("                              instead of wallet.dat; export one first)\n");
+    printf("  /createwallet              (headless only: permit creating a new wallet in a\n");
+    printf("                              datadir that has none -- otherwise refused, since\n");
+    printf("                              a missing wallet is usually a mount/backup fault)\n");
     printf("  /rescan                    (walk the chain for coins this wallet owns\n");
     printf("                              but never recorded, then exit)\n");
     printf("\n");
@@ -835,6 +838,32 @@ int main(int argc, char* argv[])
                 else { fUseSQLite = true; fCreateSQLite = true; }
             }
 
+            // A headless node whose datadir holds no wallet of either kind is
+            // far more often an operations fault -- datadir not mounted, or
+            // wallet.dat caught mid-rename by a backup -- than a first run.
+            // Creating one here is not the harmless default it looks like:
+            // success also writes the backend marker, and from then on
+            // restoring the real wallet.dat no longer takes effect, because the
+            // marker keeps the node on the empty wallet it just made. Under
+            // 1.2.19 the same fault created a wallet.dat that a restore
+            // overwrote, so operators could recover by putting the file back.
+            // Refuse instead, and name the flag that makes it deliberate.
+            if (fCreateSQLite && fHeadlessStartup &&
+                !arg(argc, argv, "/createwallet") && !arg(argc, argv, "-createwallet"))
+            {
+                AttachTerminal();
+                fprintf(stderr,
+                        "No wallet found in %s\n"
+                        "Refusing to create one. On a headless node an absent wallet is\n"
+                        "usually a mount or backup fault, and creating one would record a\n"
+                        "backend marker that makes restoring the real wallet a no-op.\n"
+                        "Pass -createwallet to start a new one deliberately, or\n"
+                        "-walletbackend=bdb to run on a Berkeley DB wallet.dat.\n",
+                        GetAppDir().c_str());
+                fflush(stderr);
+                return 1;
+            }
+
             if (fUseSQLite)
             {
                 AttachTerminal();
diff --git a/src/selftest.cpp b/src/selftest.cpp
index 2ada8f3..c62d70f 100644
--- a/src/selftest.cpp
+++ b/src/selftest.cpp
@@ -2580,7 +2580,11 @@ static int RunWalletBackendDefaultSelfTest()
 
     try
     {
-        // 1. Fresh datadir, no flag -> new wallet.sqlite, marker "sqlite", no wallet.dat.
+        // 1. Fresh datadir, no flag -> this fork refuses, where upstream creates.
+        //    An empty datadir on a headless node is far more often a mount or
+        //    backup fault than a first run, and creating a wallet also pins the
+        //    backend marker, after which restoring the real wallet is a no-op.
+        //    Nothing may be left behind: no wallet of either kind, no marker.
         string d1 = tmp + "/fresh";
         nFail += Check(MakeDirLocal(d1), "fresh scenario dir can be created") ? 0 : 1;
         vector<string> a1;
@@ -2588,19 +2592,31 @@ static int RunWalletBackendDefaultSelfTest()
         a1.push_back("-nomanagedtor");
         a1.push_back("-nogui");
         a1.push_back("-newaddress");
-        int r1 = RunBitflashChild(strExe, a1);
+        int r0 = RunBitflashChild(strExe, a1);
+        nFail += Check(r0 != 0 &&
+                       !FileExists((d1 + "/wallet.sqlite").c_str()) &&
+                       !FileExists((d1 + "/wallet.dat").c_str()) &&
+                       !FileExists((d1 + "/wallet-backend").c_str()),
+                       "a flagless headless start refuses to create a wallet") ? 0 : 1;
+
+        // 1a. -createwallet says it was meant: new wallet.sqlite, marker
+        //     "sqlite", no wallet.dat.
+        vector<string> a1c = a1;
+        a1c.push_back("-createwallet");
+        int r1 = RunBitflashChild(strExe, a1c);
         nFail += Check(r1 == 0 &&
                        FileExists((d1 + "/wallet.sqlite").c_str()) &&
                        !FileExists((d1 + "/wallet.dat").c_str()) &&
                        FileContainsText(d1 + "/wallet-backend", "sqlite"),
-                       "a fresh install starts on SQLite (new default) and records the marker") ? 0 : 1;
+                       "-createwallet starts a fresh install on SQLite and records the marker") ? 0 : 1;
 
-        // 1b. Second run reuses it, still SQLite, still no wallet.dat.
+        // 1b. Second run reuses it without the flag -- the refusal only guards
+        //     creation, so an existing wallet still starts flagless.
         int r1b = RunBitflashChild(strExe, a1);
         nFail += Check(r1b == 0 &&
                        FileExists((d1 + "/wallet.sqlite").c_str()) &&
                        !FileExists((d1 + "/wallet.dat").c_str()),
-                       "the recorded SQLite choice survives a restart") ? 0 : 1;
+                       "the recorded SQLite choice survives a flagless restart") ? 0 : 1;
 
         // 2. Existing wallet.dat, no flag -> stays on Berkeley DB.
         string d2 = tmp + "/existing-bdb";