20 files changed, 1922 insertions, 1040 deletions

diff --git a/src/Makefile b/src/Makefile
index 511fe79..1166daf 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -52,14 +52,14 @@ LIBS = -L$(SECP_LIB) -lsecp256k1 \
 # binary. Nothing crashed here, and nothing would say so if it had.
 HEADERS = headers_core.h headers.h util.h main.h serialize.h uint256.h \
           key.h bignum.h script.h db.h base58.h net.h nostr.h \
-          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h market.h \
+          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h \
           selftest.h walletcmd.h compat.h sockcount.h proxy.h font_roboto.h
 
 IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
              obj/imgui_widgets.o obj/imgui_impl_glfw.o obj/imgui_impl_opengl3.o
 
 NODE_OBJS = obj/util.o obj/script.o obj/db.o obj/net.o obj/main.o \
-            obj/market.o obj/sha.o obj/nostr.o obj/randomx_pow.o \
+            obj/sha.o obj/nostr.o obj/randomx_pow.o \
             obj/btfaddr.o obj/btfchan.o obj/btfrv.o obj/btftunnel.o obj/rpc.o \
             obj/selftest.o obj/bip32.o obj/walletcmd.o obj/proxy.o
 
diff --git a/src/btfrv.cpp b/src/btfrv.cpp
index d4f079f..133eb89 100644
--- a/src/btfrv.cpp
+++ b/src/btfrv.cpp
@@ -102,31 +102,42 @@ static SOCKET ConnectTo(const char* host, unsigned short port)
 #else
     struct addrinfo hints, *res = NULL;
     memset(&hints, 0, sizeof(hints));
-    hints.ai_family = AF_INET;
+    hints.ai_family = AF_UNSPEC; // IPv4 or IPv6 (some relays are v6-only)
     hints.ai_socktype = SOCK_STREAM;
     char portstr[16]; sprintf(portstr, "%u", (unsigned)port);
     if (getaddrinfo(host, portstr, &hints, &res) != 0 || !res) return INVALID_SOCKET;
-    SOCKET s = BtfSocketTag(socket(res->ai_family, res->ai_socktype, res->ai_protocol), SOCK_RV_DIAL);
-    if (s == INVALID_SOCKET) { freeaddrinfo(res); return INVALID_SOCKET; }
 
-    // Apply a short timeout only for the connect() and initial handshake so an
-    // unresponsive relay doesn't block the thread. Once the tunnel is live the
-    // timeout is cleared -- a forwarding pipe must block indefinitely on recv().
+    // Try each resolved address until one connects.
+    SOCKET s = INVALID_SOCKET;
+    for (struct addrinfo* rp = res; rp != NULL; rp = rp->ai_next)
+    {
+        s = BtfSocketTag(socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol), SOCK_RV_DIAL);
+        if (s == INVALID_SOCKET)
+            continue;
+
+        // Apply a short timeout only for the connect() and initial handshake so an
+        // unresponsive relay doesn't block the thread. Once the tunnel is live the
+        // timeout is cleared -- a forwarding pipe must block indefinitely on recv().
 #ifdef _WIN32
-    DWORD tvShort = 10000;
-    setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, (const char*)&tvShort, sizeof(tvShort));
-    setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, (const char*)&tvShort, sizeof(tvShort));
+        DWORD tvShort = 10000;
+        setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, (const char*)&tvShort, sizeof(tvShort));
+        setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, (const char*)&tvShort, sizeof(tvShort));
 #else
-    struct timeval tvShort; tvShort.tv_sec = 10; tvShort.tv_usec = 0;
-    setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, &tvShort, sizeof(tvShort));
-    setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, &tvShort, sizeof(tvShort));
+        struct timeval tvShort; tvShort.tv_sec = 10; tvShort.tv_usec = 0;
+        setsockopt(s, SOL_SOCKET, SO_RCVTIMEO, (char*)&tvShort, sizeof(tvShort));
+        setsockopt(s, SOL_SOCKET, SO_SNDTIMEO, (char*)&tvShort, sizeof(tvShort));
 #endif
 
-    if (connect(s, res->ai_addr, (int)res->ai_addrlen) != 0)
-    {
-        CLOSESOCK(s); freeaddrinfo(res); return INVALID_SOCKET;
+        if (connect(s, rp->ai_addr, (int)rp->ai_addrlen) != 0)
+        {
+            CLOSESOCK(s);
+            s = INVALID_SOCKET;
+            continue;
+        }
+        break;
     }
     freeaddrinfo(res);
+    if (s == INVALID_SOCKET) return INVALID_SOCKET;
 #endif
 
     // Clear the timeout -- the socket is now a live tunnel and must not
diff --git a/src/btftunnel.h b/src/btftunnel.h
index 1fa4f01..24a7509 100644
--- a/src/btftunnel.h
+++ b/src/btftunnel.h
@@ -10,8 +10,12 @@
 // caller), then BtfClientTunnel connects through the relay, runs the echan
 // handshake, and returns a local SOCKET to hand a new outbound CNode.
 //
-// Service side: after RvServiceRegister pairs us with a client, BtfServiceWrap
-// completes the echan handshake and returns a local SOCKET for an inbound CNode.
+// Service side: RvServiceRegister only registers -- callers must then block in
+// RvServiceWaitPaired until a client is actually paired to them. BtfServiceWrap
+// completes the echan handshake on that paired socket and returns a local
+// SOCKET for an inbound CNode. Wrapping a registered-but-unpaired socket reads
+// the relay's 0x01 pairing byte as the first byte of the client's ephemeral
+// key, which silently corrupts the tunnel instead of failing.
 
 #ifndef BITFLASH_BTFTUNNEL_H
 #define BITFLASH_BTFTUNNEL_H
@@ -39,8 +43,9 @@ btf_socket_t BtfClientTunnel(const char* meeting_host, unsigned short port,
                              const unsigned char target_pubkey[32],
                              const unsigned char service_enc_pub[32]);
 
-// Service: wrap an already-paired rendezvous socket (from RvServiceRegister)
-// with echan using my static x25519 secret, returning a local plaintext SOCKET
+// Service: wrap an already-paired rendezvous socket (RvServiceRegister followed
+// by RvServiceWaitPaired -- the pairing byte MUST already be consumed) with
+// echan using my static x25519 secret, returning a local plaintext SOCKET
 // for an inbound CNode. Consumes `rv` (closed when the tunnel tears down).
 btf_socket_t BtfServiceWrap(RvSocket rv, const unsigned char my_enc_sk[32]);
 
diff --git a/src/db.cpp b/src/db.cpp
index 9f62964..405a3db 100644
--- a/src/db.cpp
+++ b/src/db.cpp
@@ -598,20 +598,12 @@ bool CTxDB::LoadBlockIndex()
 
 
 //
-// CReviewDB
+// CReviewDB is gone with the "review" handler. Its write path was
+// read-whole-vector / append-one / write-whole-vector, driven straight from an
+// unauthenticated peer, which is quadratic disk on an unbounded record.
+// Existing reviews.dat files are simply left alone and never opened.
 //
 
-bool CReviewDB::ReadReviews(uint256 hash, vector<CReview>& vReviews)
-{
-    vReviews.size(); // msvc workaround, just need to do anything with vReviews
-    return Read(make_pair(string("reviews"), hash), vReviews);
-}
-
-bool CReviewDB::WriteReviews(uint256 hash, const vector<CReview>& vReviews)
-{
-    return Write(make_pair(string("reviews"), hash), vReviews);
-}
-
 
 
 
diff --git a/src/db.h b/src/db.h
index 4fb5cfd..37a252f 100644
--- a/src/db.h
+++ b/src/db.h
@@ -8,8 +8,6 @@ class CTxIndex;
 class CDiskBlockIndex;
 class CDiskTxPos;
 class COutPoint;
-class CUser;
-class CReview;
 class CAddress;
 class CWalletTx;
 
@@ -314,27 +312,6 @@ public:
 
 
 
-class CReviewDB : public CDB
-{
-public:
-    CReviewDB(const char* pszMode="r+", bool fTxn=false) : CDB("reviews.dat", pszMode, fTxn) { }
-private:
-    CReviewDB(const CReviewDB&);
-    void operator=(const CReviewDB&);
-public:
-    bool ReadUser(uint256 hash, CUser& user)
-    {
-        return Read(make_pair(string("user"), hash), user);
-    }
-
-    bool WriteUser(uint256 hash, const CUser& user)
-    {
-        return Write(make_pair(string("user"), hash), user);
-    }
-
-    bool ReadReviews(uint256 hash, vector<CReview>& vReviews);
-    bool WriteReviews(uint256 hash, const vector<CReview>& vReviews);
-};
 
 
 
diff --git a/src/headers_core.h b/src/headers_core.h
index 6c0c602..6a60b52 100644
--- a/src/headers_core.h
+++ b/src/headers_core.h
@@ -66,7 +66,6 @@ inline typename std::common_type<T1,T2>::type max(const T1& a, const T2& b)
 #include "nostr.h"
 #include "randomx_pow.h"
 #include "main.h"
-#include "market.h"
 
 // GUI callback -- implemented in gui.cpp (or as no-op in headless builds)
 void MainFrameRepaint();
diff --git a/src/main.cpp b/src/main.cpp
index f83164f..252911b 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -87,6 +87,8 @@ CKey keyUser;
 string strSetDataDir;
 int nDropMessagesTest = 0;
 bool fSoloMineTest = false; // /solomine: mine without requiring a peer (local test)
+bool fPoolNoAnnounce = false; // /noannounce: operator serves miners but never publishes pool announcements
+bool fPoolMineBlind = false; // /poolmineblind: issue jobs even when no peer has reported a height
 
 // Settings
 int fGenerateBitcoins;
@@ -102,6 +104,9 @@ CAddress addrIncoming;
 int    nMineMode        = MINE_RELAY;
 bool   fMineModeFromCommandLine = false;
 string strParticipantPool;           // participant mode: pool .btf address
+string strPayoutAddress;             // participant: /payoutaddr override (mine without a wallet)
+string strPayoutFile;                // participant: /payoutfile with one address per line, rotated per reconnect
+int    nHashThreads      = 0;        // participant: /hashthreads override (0 = cores-1)
 string strPoolName       = "Bitflash Pool";
 string strPoolDashboardUrl;
 string strPoolStatusFile;
@@ -163,12 +168,32 @@ int MinerThreadCount()
 {
     if (nMinerThreads > 0)
         return nMinerThreads;
-    unsigned int nCores = std::thread::hardware_concurrency();
+    unsigned int nCores = AvailableCoreCount();
     if (nCores <= 1)
         return 1;
     return (int)(nCores - 1);
 }
 
+// Hash threads one participant session runs.
+//
+// Explicit /hashthreads=N is honored exactly, including 1 -- a miner who says
+// one means one. Automatic leaves a core to the node, the Stratum I/O loop and
+// everything else the process still has to do, for the same reason
+// MinerThreadCount() does.
+//
+// Lives here, next to that function, because the two are easy to confuse and
+// StartMinerThreads() needs to be able to tell them apart: only ONE session
+// runs in participant mode, and this is what sizes it.
+int ParticipantHashThreadCount()
+{
+    if (nHashThreads > 0)
+        return nHashThreads;
+    int nWorkers = (int)AvailableCoreCount();
+    if (nWorkers < 2)
+        nWorkers = 2;
+    return nWorkers - 1;
+}
+
 static void SecureClearBytes(vector<unsigned char>& vch);
 static void SecureClearKeyingMaterial(CKeyingMaterial& vch);
 
@@ -1551,7 +1576,7 @@ int CMerkleTx::GetBlocksToMaturity() const
 {
     if (!IsCoinBase())
         return 0;
-    return max(0, (COINBASE_MATURITY+20) - GetDepthInMainChain());
+    return max(0, COINBASE_SPENDABLE_DEPTH - GetDepthInMainChain());
 }
 
 
@@ -2819,9 +2844,10 @@ bool AlreadyHave(CTxDB& txdb, const CInv& inv)
     {
     case MSG_TX:        return mapTransactions.count(inv.hash) || txdb.ContainsTx(inv.hash);
     case MSG_BLOCK:     return mapBlockIndex.count(inv.hash) || mapOrphanBlocks.count(inv.hash);
-    case MSG_REVIEW:    return true;
-    case MSG_PRODUCT:   return mapProducts.count(inv.hash);
     }
+    // MSG_REVIEW / MSG_PRODUCT / MSG_TABLE are the 2009 marketplace inventory
+    // types. Nothing announces or serves them any more (see ProcessMessage),
+    // so they fall through to the default and are never requested.
     // Don't know what it is, just say we already got one
     return true;
 }
@@ -2864,11 +2890,13 @@ bool ProcessMessages(CNode* pfrom)
             if (LogAcceptsCategory("net")) printf("\n\nPROCESSMESSAGE SKIPPED %d BYTES\n\n", (int)(pstart - vRecv.begin()));
         vRecv.erase(vRecv.begin(), pstart);
 
-        // Read the header from a copy first. The old path consumed the header,
-        // noticed the payload was incomplete, inserted the header back at the
-        // front of the receive buffer, then slept inside the shared message
-        // thread. A peer could announce a large payload and drip bytes forever,
-        // making every pass pay for an O(n) insert and a 100 ms stall.
+        // Read the header from a copy first, and do not consume it until the
+        // whole body is here. The old path consumed the header, noticed the
+        // payload was incomplete, inserted the header back at the front of the
+        // receive buffer, then slept inside the shared message thread. A peer
+        // could announce a large payload and drip bytes forever, making every
+        // pass pay for an O(n) insert and a 100 ms stall -- a cheap way for one
+        // peer to slow the thread that serves all of them. (upstream #109)
         CMessageHeader hdr;
         CDataStream vHeader(vRecv.begin(), vRecv.begin() + sizeof(CMessageHeader),
                             vRecv.nType, vRecv.nVersion);
@@ -2878,7 +2906,10 @@ bool ProcessMessages(CNode* pfrom)
             if (LogAcceptsCategory("net")) printf("\n\nPROCESSMESSAGE: ERRORS IN HEADER %s\n\n\n", hdr.GetCommand().c_str());
             if (hdr.nMessageSize > MAX_PROTOCOL_MESSAGE_SIZE)
                 pfrom->fDisconnect = true;
-            pfrom->nIncompleteMessageStart = 0;
+            pfrom->nMsgWaitSince = 0;
+            pfrom->nMsgWaitSize  = 0;
+            // The header was read from a copy, so it is still in vRecv. Skip it
+            // explicitly or this loop never advances.
             vRecv.ignore(sizeof(CMessageHeader));
             continue;
         }
@@ -2889,30 +2920,63 @@ bool ProcessMessages(CNode* pfrom)
         unsigned int nPayloadAvailable = vRecv.size() - sizeof(CMessageHeader);
         if (nMessageSize > nPayloadAvailable)
         {
-            if (pfrom->nIncompleteMessageStart == 0 ||
-                pfrom->nIncompleteMessageSize != nMessageSize ||
-                pfrom->strIncompleteMessageCommand != strCommand)
+            // Wait for the rest of the message. The header stays in vRecv.
+            //
+            // This is the mechanism the original note asked for: "need a
+            // mechanism to give up waiting for overlong message size error".
+            // Without one the wait is unbounded, and unbounded here means
+            // permanent. The header stays at the front of vRecv and the loop
+            // breaks; if the body never completes, every later pass re-reads
+            // that same header and breaks in the same place. The peer is never
+            // parsed again -- no blocks, no inv, not even its version message,
+            // so it never reports a height either, which is why a wedged node
+            // has peers and GetPeerMedianHeight() still returns -1.
+            //
+            // Nothing rescues it. A header could claim up to 256 MB and still
+            // pass CMessageHeader::IsValid() -- now capped at
+            // MAX_PROTOCOL_MESSAGE_SIZE -- and any byte that arrives
+            // refreshes nLastRecv, so the inactivity timeout that drops a
+            // silent peer never fires on one that is merely unreadable. The
+            // socket stays ESTABLISHED and select() keeps offering it.
+            // Measured on a wedged pool: this branch ran 2014 times in the
+            // deaf window, against 607 in the healthy window before it.
+            if (LogAcceptsCategory("net")) printf("MESSAGE-BREAK 2\n");
+            //
+            // Time the STALL, not the wait. A big message on a slow link is
+            // still arriving, and dropping that peer would be a bug of our own
+            // making; what must be caught is a buffer that has stopped growing
+            // while we go on expecting more. So the clock restarts whenever
+            // even one more byte has landed since the last look.
+            //
+            // Upstream #109 times this differently: it restarts the clock only
+            // when the (size, command) pair changes, which drops a peer sending
+            // one big message slowly but honestly. Progress is the better test,
+            // so that half is kept as it was.
+            int64 nNow = GetTime();
+            if (pfrom->nMsgWaitSince == 0 || nPayloadAvailable > pfrom->nMsgWaitSize)
             {
-                pfrom->nIncompleteMessageStart = GetTime();
-                pfrom->nIncompleteMessageSize = nMessageSize;
-                pfrom->strIncompleteMessageCommand = strCommand;
+                pfrom->nMsgWaitSince = nNow;
+                pfrom->nMsgWaitSize  = nPayloadAvailable;
             }
-            else if (GetTime() - pfrom->nIncompleteMessageStart >
-                     BTF_INCOMPLETE_MESSAGE_TIMEOUT_SECS)
+            else if (nNow - pfrom->nMsgWaitSince > BTF_MSG_WAIT_MAX_SECS)
             {
-                LogPrint("net",
-                         "disconnecting %s: incomplete %s message, %u of %u bytes after %d seconds\n",
-                         pfrom->addr.ToString().c_str(), strCommand.c_str(),
-                         nPayloadAvailable, nMessageSize,
-                         BTF_INCOMPLETE_MESSAGE_TIMEOUT_SECS);
+                // Deliberately not behind a debug category. This is the node
+                // going deaf to a peer, which is the thing nobody could see.
+                printf("peer %s announced a %u byte '%s' and has sent nothing more "
+                       "for %d s (%d of %u payload bytes) -- dropping, this peer is unreadable\n",
+                       pfrom->addr.ToString().c_str(), nMessageSize,
+                       strCommand.c_str(), (int)(nNow - pfrom->nMsgWaitSince),
+                       (int)nPayloadAvailable, nMessageSize);
                 pfrom->fDisconnect = true;
             }
+            // No re-insert, no Sleep(): the header was never consumed, so there
+            // is nothing to put back, and sleeping here stalls every peer.
             break;
         }
-        pfrom->nIncompleteMessageStart = 0;
-        pfrom->nIncompleteMessageSize = 0;
-        pfrom->strIncompleteMessageCommand.clear();
         vRecv.ignore(sizeof(CMessageHeader));
+        // The body arrived, so this peer is readable again.
+        pfrom->nMsgWaitSince = 0;
+        pfrom->nMsgWaitSize  = 0;
 
         // Copy message to its own buffer
         CDataStream vMsg(vRecv.begin(), vRecv.begin() + nMessageSize, vRecv.nType, vRecv.nVersion);
@@ -2941,7 +3005,6 @@ bool ProcessMessages(CNode* pfrom)
 
 bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
 {
-    static map<unsigned int, vector<unsigned char> > mapReuseKey;
     if (LogAcceptsCategory("net")) { printf("received: %-12s (%d bytes)  ", strCommand.c_str(), (int)vRecv.size()); for (int i = 0; i < min(vRecv.size(), (unsigned int)25); i++) printf("%02x ", vRecv[i] & 0xff); printf("\n"); }
     if (nDropMessagesTest > 0 && GetRand(nDropMessagesTest) == 0)
     {
@@ -3180,22 +3243,18 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
     }
 
 
-    else if (strCommand == "review")
-    {
-        CDataStream vMsg(vRecv);
-        CReview review;
-        vRecv >> review;
-
-        CInv inv(MSG_REVIEW, review.GetHash());
-        pfrom->AddInventoryKnown(inv);
-
-        if (review.AcceptReview())
-        {
-            // Relay the original message as-is in case it's a higher version than we know how to parse
-            RelayMessage(inv, vMsg);
-            mapAlreadyAskedFor.erase(inv);
-        }
-    }
+    // "review" used to be handled here. It took a CReview off the wire from an
+    // unauthenticated peer, checked a signature the sender had made with a key
+    // of its own choosing -- which proves possession of that key and authorises
+    // nothing -- and then appended the message to reviews.dat by reading the
+    // whole vector for the target hash, pushing one entry, and writing all of
+    // it back. That is quadratic disk for a stream an attacker controls, on a
+    // record whose mapValue is an unbounded map<string,string> read straight
+    // from the socket, followed by AddAtomsAndPropagate walking a link graph
+    // the same peer supplied, and finally RelayMessage forwarding it to every
+    // other node. Unbounded remote disk growth with network amplification and
+    // no authorisation anywhere in the path. The marketplace it belonged to has
+    // not existed since 2009; the handler is gone rather than bounded.
 
 
     else if (strCommand == "block")
@@ -3210,41 +3269,46 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
         pfrom->AddInventoryKnown(inv);
 
         if (ProcessBlock(pfrom, pblock.release()))
+        {
             mapAlreadyAskedFor.erase(inv);
-    }
-
 
-    else if (strCommand == "checkorder" || strCommand == "submitorder")
-    {
-        // Legacy Bitcoin 0.1 marketplace messages are not part of Bitflash's
-        // supported protocol. They used to let a remote peer make this wallet
-        // reserve a key or import/broadcast a wallet transaction. Keep the
-        // command names explicit so old peers get a quiet no-op instead of a
-        // wallet side effect.
-        if (LogAcceptsCategory("net"))
-            printf("ProcessMessage(%s) : disabled legacy order message\n", strCommand.c_str());
-        vRecv.clear();
+            // A peer that just handed us a block is demonstrably at least at
+            // that block's height. Without this, nStartingHeight is a snapshot
+            // taken once during the version handshake and never touched again,
+            // so on a long-lived connection it is the peer's height from
+            // however many hours ago it happened to connect. The pool's
+            // behind-the-network check compares against the median of those
+            // numbers, so as connections age it drifts toward "everyone is
+            // behind us" and quietly stops firing -- the opposite of its job.
+            map<uint256, CBlockIndex*>::iterator mi = mapBlockIndex.find(inv.hash);
+            if (mi != mapBlockIndex.end() && mi->second)
+                pfrom->nStartingHeight = max(pfrom->nStartingHeight, mi->second->nHeight);
+        }
     }
 
 
-    else if (strCommand == "reply")
-    {
-        uint256 hashReply;
-        vRecv >> hashReply;
-
-        CRequestTracker tracker;
-        CRITICAL_BLOCK(pfrom->cs_mapRequests)
-        {
-            map<uint256, CRequestTracker>::iterator mi = pfrom->mapRequests.find(hashReply);
-            if (mi != pfrom->mapRequests.end())
-            {
-                tracker = (*mi).second;
-                pfrom->mapRequests.erase(mi);
-            }
-        }
-        if (!tracker.IsNull())
-            tracker.fn(tracker.param1, vRecv);
-    }
+    // "checkorder", "submitorder" and "reply" -- the 2009 buy-from-a-merchant
+    // exchange -- used to be handled here. All three are gone.
+    //
+    // "checkorder" called GenerateNewKey() for any peer that asked, which is
+    // AddKey() and a wallet.dat write, and handed the pubkey back. The comment
+    // said "keep giving the same key to the same ip until they use it", and on
+    // a 2009 network of routable IPs that held. It does not hold here: every
+    // inbound peer arrives through a rendezvous tunnel and is tagged with
+    // BtfMarkerAddr() over three random bytes (net.cpp), so addr.ip is freshly
+    // random per connection and the cache never hits. Reconnect in a loop and
+    // the node mints a key per connection -- unbounded wallet growth, unbounded
+    // growth of the static map that held them, and every one of those keys
+    // missing from every backup taken beforehand, which for this pre-BIP32
+    // wallet is how coins are lost.
+    //
+    // "submitorder" took a CWalletTx from an unauthenticated peer and, if it
+    // was merely a valid transaction, AddToWallet()'d it. Valid is not the same
+    // as ours: any peer could write chosen transactions into wallet.dat.
+    //
+    // "reply" dispatched to a CRequestTracker callback. Nothing in this tree
+    // has ever called PushRequest, so mapRequests was permanently empty and the
+    // handler could only ever be a parser for hostile input.
 
 
     else if (strCommand == "ping")
@@ -3502,6 +3566,102 @@ static bool StratumRecvLine(SOCKET s, std::string& buf,
 // How long to wait for a mining.notify after authorize before giving up
 static const int64 STUCK_NO_JOB_TIMEOUT_SECS = 120;
 
+// ------------------------------------------------------------------
+// Multi-threaded pool worker. The original loop hashed a single nonce
+// per blocking 50ms socket poll, capping one instance at ~20 H/s no
+// matter how many cores the machine has. The socket and job bookkeeping
+// stay on the calling thread; N hash threads grind nonce ranges on their
+// own RandomX VMs (all sharing the one ~2 GB dataset) and drop found
+// shares on a queue the I/O thread drains and submits.
+// ------------------------------------------------------------------
+struct ParticipantJobShared
+{
+    std::mutex mtx;
+    unsigned char header[80];
+    uint256 target;
+    std::string jobId;
+    uint64 jobSeq;
+    bool haveJob;
+    bool stop;
+    ParticipantJobShared() : jobSeq(0), haveJob(false), stop(false)
+    {
+        memset(header, 0, sizeof(header));
+    }
+};
+
+struct ParticipantShareHit
+{
+    uint64 jobSeq;
+    std::string jobId;
+    unsigned int nonce;
+};
+
+static void ParticipantHashWorker(ParticipantJobShared* sh, int idx, int nWorkers,
+                                  std::vector<ParticipantShareHit>* hits,
+                                  std::mutex* hitsMtx)
+{
+    void* vm = RandomXCreateMinerVM();
+    if (!vm)
+    {
+        LogPrint("worker", "[worker] hash thread %d: RandomX VM creation failed\n", idx);
+        return;
+    }
+
+    unsigned char header[80];
+    uint256 target;
+    std::string jobId;
+    uint64 mySeq = 0;
+    bool active = false;
+    unsigned int nNonce = 0;
+    uint64 localHashes = 0;
+
+    while (!fShutdown)
+    {
+        {
+            std::lock_guard<std::mutex> lk(sh->mtx);
+            if (sh->stop)
+                break;
+            if (sh->haveJob && sh->jobSeq != mySeq)
+            {
+                memcpy(header, sh->header, 80);
+                target = sh->target;
+                jobId  = sh->jobId;
+                mySeq  = sh->jobSeq;
+                nNonce = (unsigned int)(idx + 1);
+                active = true;
+            }
+        }
+        if (!active)
+        {
+            Sleep(50);
+            continue;
+        }
+
+        memcpy(header + 76, &nNonce, 4);
+        uint256 hash = RandomXHashWithVM(vm, header, 80);
+        localHashes++;
+        if ((localHashes & 0x3ff) == 0)
+            gParticipantHashes.fetch_add(0x400);
+
+        if (hash <= target)
+        {
+            LogPrint("worker", "[worker] share found! nonce=%u job=%s (thread %d)\n",
+                     nNonce, jobId.c_str(), idx);
+            std::lock_guard<std::mutex> lk(*hitsMtx);
+            hits->push_back(ParticipantShareHit{mySeq, jobId, nNonce});
+        }
+
+        unsigned int next = nNonce + (unsigned int)nWorkers;
+        if (next < nNonce) // wrapped past 2^32: range exhausted, wait for next job
+            active = false;
+        else
+            nNonce = next;
+    }
+
+    gParticipantHashes.fetch_add(localHashes & 0x3ff);
+    RandomXDestroyMinerVM(vm);
+}
+
 static bool PoolParticipantMiner()
 {
     // ------------------------------------------------------------------
@@ -3516,6 +3676,51 @@ static bool PoolParticipantMiner()
     LogPrint("worker", "[worker] connecting to pool %s\n", strParticipantPool.c_str());
     SetParticipantMiningStatus("resolving pool address");
 
+    // ------------------------------------------------------------------
+    // Steps 1-2: connect to the pool. Two address forms:
+    //   tcp:HOST:PORT  -- plain TCP straight to the pool's stratum port
+    //                     (e.g. our own operator node on this machine),
+    //                     no .btf resolution or rendezvous tunnel involved
+    //   <name>.btf     -- resolve via Nostr, dial through a rendezvous relay
+    // ------------------------------------------------------------------
+    btf_socket_t s = INVALID_SOCKET;
+    if (strParticipantPool.compare(0, 4, "tcp:") == 0)
+    {
+        std::string hp = strParticipantPool.substr(4);
+        size_t colon = hp.rfind(':');
+        if (colon == std::string::npos) {
+            LogPrint("worker", "[worker] bad tcp pool address '%s' (want tcp:host:port)\n",
+                     strParticipantPool.c_str());
+            SetParticipantMiningStatus("bad pool address");
+            return false;
+        }
+        std::string host = hp.substr(0, colon);
+        int port = atoi(hp.substr(colon + 1).c_str());
+        unsigned long ip = inet_addr(host.c_str());
+        if (port <= 0 || port > 65535 || ip == INADDR_NONE) {
+            LogPrint("worker", "[worker] bad tcp pool endpoint '%s'\n", hp.c_str());
+            SetParticipantMiningStatus("bad pool endpoint");
+            return false;
+        }
+        SetParticipantMiningStatus("connecting to pool (direct tcp)");
+        struct sockaddr_in sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sin_family = AF_INET;
+        sa.sin_port = htons((unsigned short)port);
+        sa.sin_addr.s_addr = ip;
+        SOCKET cs = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+        if (cs == INVALID_SOCKET || connect(cs, (struct sockaddr*)&sa, sizeof(sa)) == SOCKET_ERROR) {
+            LogPrint("worker", "[worker] direct connect to %s FAILED\n", hp.c_str());
+            SetParticipantMiningStatus("pool connect failed");
+            if (cs != INVALID_SOCKET) closesocket(cs);
+            return false;
+        }
+        LogPrint("worker", "[worker] connected directly to pool %s\n", hp.c_str());
+        s = (btf_socket_t)cs;
+        goto connected;
+    }
+
+    {
     unsigned char target_pubkey[32];
     if (!btf::ParseAddress(strParticipantPool, target_pubkey)) {
         LogPrint("worker", "[worker] invalid .btf address: %s\n", strParticipantPool.c_str());
@@ -3550,11 +3755,11 @@ static bool PoolParticipantMiner()
     }
 
     // ------------------------------------------------------------------
-    // Step 2: open encrypted tunnel to pool
+    // Step 2b: open encrypted tunnel to pool
     // ------------------------------------------------------------------
     SetParticipantMiningStatus("opening tunnel");
-    btf_socket_t s = btf::BtfClientTunnel(host.c_str(), (unsigned short)port,
-                                           target_pubkey, service_enc_pub);
+    s = btf::BtfClientTunnel(host.c_str(), (unsigned short)port,
+                             target_pubkey, service_enc_pub);
     if (s == INVALID_SOCKET) {
         LogPrint("worker", "[worker] tunnel connect FAILED via %s"
                  " (relay unreachable or pool not listening)\n",
@@ -3564,11 +3769,48 @@ static bool PoolParticipantMiner()
     }
     LogPrint("worker", "[worker] tunnel open via %s\n", meetingHostPort.c_str());
     SetParticipantMiningStatus("tunnel open");
+    }
+
+connected:
 
     // ------------------------------------------------------------------
-    // Step 3: determine our payout address (mining username)
+    // Step 3: determine our payout address (mining username). /payoutaddr
+    // wins -- it lets a machine mine to an address whose keys live
+    // elsewhere, so no wallet file is needed on the mining machine.
+    // /payoutfile rotates through a list of such addresses: one is picked
+    // per (re)connection, and the session self-limits (see rotation break
+    // in the main loop) so consecutive rounds land on fresh addresses.
     // ------------------------------------------------------------------
-    std::string username;
+    static std::vector<std::string> vPayoutAddrs;
+    static size_t nPayoutRot = 0;
+    if (!strPayoutFile.empty() && vPayoutAddrs.empty())
+    {
+        FILE* f = fopen(strPayoutFile.c_str(), "r");
+        if (f)
+        {
+            char line[256];
+            while (fgets(line, sizeof(line), f))
+            {
+                std::string a = line;
+                while (!a.empty() && (a.back() == '\n' || a.back() == '\r' ||
+                                      a.back() == ' '  || a.back() == '\t'))
+                    a.pop_back();
+                if (!a.empty())
+                    vPayoutAddrs.push_back(a);
+            }
+            fclose(f);
+            LogPrint("worker", "[worker] loaded %zu payout addresses from %s\n",
+                     vPayoutAddrs.size(), strPayoutFile.c_str());
+        }
+        else
+            LogPrint("worker", "[worker] cannot open payout file %s\n",
+                     strPayoutFile.c_str());
+    }
+
+    std::string username = strPayoutAddress;
+    if (username.empty() && !vPayoutAddrs.empty())
+        username = vPayoutAddrs[nPayoutRot++ % vPayoutAddrs.size()];
+    if (username.empty())
     {
         std::vector<unsigned char> vchPubKey;
         if (CWalletDB("r").ReadDefaultKey(vchPubKey))
@@ -3606,16 +3848,14 @@ static bool PoolParticipantMiner()
     // ------------------------------------------------------------------
     if (!RandomXFastReady()) {
         SetParticipantMiningStatus("building RandomX dataset (~2GB, one-time)");
-        unsigned int nThreads = std::thread::hardware_concurrency();
+        // Fill with the cores we are permitted to use, not the ones the host
+        // happens to have. More threads than the cpuset allows does not build
+        // the dataset any faster -- the CPU budget is the same either way --
+        // it just oversubscribes, and this runs alongside the pool node.
+        unsigned int nThreads = AvailableCoreCount();
         RandomXInitDataset(nThreads > 0 ? (int)nThreads : 1);
     }
-    void* rxvm = RandomXCreateMinerVM();
-    if (!rxvm) {
-        LogPrint("worker", "[worker] failed to create RandomX VM\n");
-        SetParticipantMiningStatus("RandomX init failed");
-        closesocket(s); return false;
-    }
-    LogPrint("worker", "[worker] RandomX VM ready (%s)\n",
+    LogPrint("worker", "[worker] RandomX dataset ready (%s)\n",
              RandomXFastReady() ? "fast 2GB" : "light 256MB");
 
     // ------------------------------------------------------------------
@@ -3633,7 +3873,6 @@ static bool PoolParticipantMiner()
                                  {"params",json::array()}})) {
         LogPrint("worker", "[worker] subscribe send FAILED -- pool dropped connection\n");
         SetParticipantMiningStatus("subscribe send failed");
-        RandomXDestroyMinerVM(rxvm);
         closesocket(s); return false;
     }
 
@@ -3643,11 +3882,31 @@ static bool PoolParticipantMiner()
                                  {"params",json::array({username,"x"})}})) {
         LogPrint("worker", "[worker] authorize send FAILED -- pool dropped connection\n");
         SetParticipantMiningStatus("authorize send failed");
-        RandomXDestroyMinerVM(rxvm);
         closesocket(s); return false;
     }
 
     // ------------------------------------------------------------------
+    // Step 6: spawn hash threads (each with its own RandomX VM on the
+    // shared dataset), then run the I/O loop below: receive pool messages,
+    // publish jobs to the threads, submit the shares they find.
+    // ------------------------------------------------------------------
+    // One count, decided in one place (main.cpp:MinerThreadCount's neighbour),
+    // so that what StartMinerThreads() reports at startup and what actually
+    // hashes here can never drift apart. Explicit /hashthreads=N is honored
+    // exactly, including 1; automatic leaves one core for node + I/O threads.
+    int nWorkers = ParticipantHashThreadCount();
+    ParticipantJobShared jobShared;
+    std::vector<ParticipantShareHit> shareHits;
+    std::mutex shareHitsMtx;
+    std::vector<std::thread> hashThreads;
+    for (int i = 0; i < nWorkers; i++)
+        hashThreads.emplace_back(ParticipantHashWorker, &jobShared, i, nWorkers,
+                                 &shareHits, &shareHitsMtx);
+    LogPrint("worker", "[worker] spawned %d hash threads on shared RandomX dataset\n",
+             nWorkers);
+    const uint64 sessionStartHashes = gParticipantHashes.load();
+
+    // ------------------------------------------------------------------
     // Step 6: main loop -- receive messages, hash, submit shares
     // ------------------------------------------------------------------
     std::string jobId;
@@ -3664,6 +3923,8 @@ static bool PoolParticipantMiner()
     uint64 sessionSharesSent  = 0; // this connection only
     uint64 sessionSharesAccepted = 0;
     int64  sampleStart       = GetTime();
+    int64  connStart         = GetTime();
+    const int64 PAYOUT_ROTATE_SECS = 300; // reconnect with next /payoutfile address
 
     SetParticipantMiningStatus("waiting for pool response");
 
@@ -3771,6 +4032,14 @@ static bool PoolParticipantMiner()
                                     memcpy(&target, tgtBytes.data(), 32);
                                     haveJob = true;
                                     nNonce  = 1;
+                                    {
+                                        std::lock_guard<std::mutex> lk(jobShared.mtx);
+                                        memcpy(jobShared.header, header, 80);
+                                        jobShared.target = target;
+                                        jobShared.jobId  = jobId;
+                                        jobShared.jobSeq++;
+                                        jobShared.haveJob = true;
+                                    }
                                     LogPrint("worker", "[pool->worker] new job %s received\n",
                                              jobId.c_str());
                                     SetParticipantMiningStatus("hashing job " + jobId);
@@ -3826,46 +4095,71 @@ static bool PoolParticipantMiner()
             }
         }
 
+        // -- Payout address rotation: end this session cleanly so the outer
+        // loop reconnects and authorizes the next /payoutfile address --
+        if (!vPayoutAddrs.empty() && GetTime() - connStart > PAYOUT_ROTATE_SECS)
+        {
+            LogPrint("worker", "[worker] payout rotation interval reached"
+                     " -- reconnecting with next address\n");
+            break;
+        }
+
         if (!haveJob) { Sleep(100); continue; }
 
-        // -- Hash one nonce --
-        memcpy(header+76, &nNonce, 4);
-        uint256 hash = RandomXHashWithVM(rxvm, header, 80);
-        hashesSinceSample++;
-        gParticipantHashes.fetch_add(1);
-        if ((hashesSinceSample & 0x3ff) == 0)
-            UpdateParticipantHashRate(hashesSinceSample, sampleStart);
-
-        if (hash <= target) {
-            LogPrint("worker", "[worker] share found! nonce=%u job=%s difficulty=%.4f\n",
-                     nNonce, jobId.c_str(), currentDifficulty);
-            SetParticipantMiningStatus("share found; submitting");
-            int submitId = msgId++;
-            pendingSubmitIds.insert(submitId);
-            gParticipantSharesSent.fetch_add(1);
-            sessionSharesSent++;
-            json submit = {{"id",submitId},{"method","mining.submit"},
-                           {"params",json::array({username, jobId, ToHexStr(&nNonce,4)})}};
-            if (!StratumSendLine(s, submit)) {
-                LogPrint("worker", "[worker] share submit send FAILED"
-                         " -- pool connection lost\n");
-                break;
-            }
-        }
+        // -- Hash rate accounting (hashing happens on the worker threads) --
+        hashesSinceSample = gParticipantHashes.load() - sessionStartHashes;
+        UpdateParticipantHashRate(hashesSinceSample, sampleStart);
 
-        nNonce++;
-        if (nNonce == 0) {
-            LogPrint("worker", "[worker] nonce space exhausted for job %s"
-                     " -- waiting for new job\n", jobId.c_str());
-            haveJob = false;
+        // -- Submit any shares the hash threads found --
+        bool submitFailed = false;
+        {
+            std::vector<ParticipantShareHit> pending;
+            {
+                std::lock_guard<std::mutex> lk(shareHitsMtx);
+                pending.swap(shareHits);
+            }
+            for (ParticipantShareHit& hit : pending)
+            {
+                if (hit.jobId != jobId)
+                {
+                    LogPrint("worker", "[worker] dropping stale share for old job %s\n",
+                             hit.jobId.c_str());
+                    continue;
+                }
+                LogPrint("worker", "[worker] share found! nonce=%u job=%s difficulty=%.4f\n",
+                         hit.nonce, hit.jobId.c_str(), currentDifficulty);
+                SetParticipantMiningStatus("share found; submitting");
+                int submitId = msgId++;
+                pendingSubmitIds.insert(submitId);
+                gParticipantSharesSent.fetch_add(1);
+                sessionSharesSent++;
+                json submit = {{"id",submitId},{"method","mining.submit"},
+                               {"params",json::array({username, hit.jobId,
+                                                      ToHexStr(&hit.nonce,4)})}};
+                if (!StratumSendLine(s, submit)) {
+                    LogPrint("worker", "[worker] share submit send FAILED"
+                             " -- pool connection lost\n");
+                    submitFailed = true;
+                    break;
+                }
+            }
         }
+        if (submitFailed)
+            break;
     }
 
     // ------------------------------------------------------------------
-    // Cleanup
+    // Cleanup: stop the hash threads, then drop the pool connection
     // ------------------------------------------------------------------
-    RandomXDestroyMinerVM(rxvm);
+    {
+        std::lock_guard<std::mutex> lk(jobShared.mtx);
+        jobShared.stop = true;
+        jobShared.haveJob = false;
+    }
+    for (std::thread& t : hashThreads)
+        t.join();
     closesocket(s);
+    hashesSinceSample = gParticipantHashes.load() - sessionStartHashes;
     UpdateParticipantHashRate(hashesSinceSample, sampleStart);
     SetParticipantMiningStatus("disconnected");
     LogPrint("worker", "[worker] disconnected from pool"
@@ -4090,7 +4384,7 @@ bool BitcoinMiner(int nThreadId)
     // Build the fast (~2 GB dataset) RandomX mode once, up front, so we're
     // not stuck mining in the much slower light/cache-only mode forever.
     if (!RandomXFastReady()) {
-        unsigned int nThreads = std::thread::hardware_concurrency();
+        unsigned int nThreads = AvailableCoreCount();
         RandomXInitDataset(nThreads > 0 ? (int)nThreads : 1);
     }
 
@@ -4177,7 +4471,19 @@ bool BitcoinMiner(int nThreadId)
             vector<char> vfAlreadyAdded(mapTransactions.size());
             bool fFoundSomething = true;
             unsigned int nBlockSize = 0;
-            while (fFoundSomething && nBlockSize < MAX_SIZE/2)
+            // Assembly must stop below the consensus cap that CheckBlock()
+            // enforces, or we mine a block our own node then rejects.
+            //
+            // This used to read MAX_SIZE/2 (16 MB), which was consistent while
+            // CheckBlock() also tested against MAX_SIZE (32 MB). Adding
+            // MAX_BLOCK_SIZE inverted it: assembly could fill 16 MB and
+            // validation would refuse anything over 1 MB, so a full mempool
+            // meant solving a block and throwing it away -- with this pool at
+            // ~90% of hashrate, that is the network stalling, not just us.
+            //
+            // Half the cap, keeping the original margin: the test runs before
+            // a transaction is added, so the loop can overshoot by one tx.
+            while (fFoundSomething && nBlockSize < MAX_BLOCK_SIZE/2)
             {
                 fFoundSomething = false;
                 unsigned int n = 0;
@@ -4778,7 +5084,18 @@ bool SendMoney(CScript scriptPubKey, int64 nValue, CWalletTx& wtxNew)
         {
             string strError;
             if (nValue + nFeeRequired > GetBalance())
-                strError = strprintf("Error: This is an oversized transaction that requires a transaction fee of %s ", FormatMoney(nFeeRequired).c_str());
+                // Not an oversized transaction -- this branch is simply "the
+                // spendable balance is too small". Saying otherwise (with a fee
+                // of 0.00, because CreateTransaction failed before setting one)
+                // sends anyone reading the log after a failed payout hunting a
+                // transaction-size problem that does not exist.
+                strError = strprintf("Error: insufficient spendable balance:"
+                                     " need %s (plus fee %s) but only %s is spendable"
+                                     " -- mined coin counts as zero until it is %d deep",
+                                     FormatMoney(nValue).c_str(),
+                                     FormatMoney(nFeeRequired).c_str(),
+                                     FormatMoney(GetBalance()).c_str(),
+                                     COINBASE_SPENDABLE_DEPTH);
             else
                 strError = "Error: Transaction creation failed ";
             return error("SendMoney() : %s\n", strError.c_str());
diff --git a/src/main.h b/src/main.h
index b389f1d..8bb536b 100644
--- a/src/main.h
+++ b/src/main.h
@@ -41,6 +41,12 @@ static const int64 MAX_MONEY = 21000000 * COIN;
 inline bool MoneyRange(int64 nValue) { return (nValue >= 0 && nValue <= MAX_MONEY); }
 static const int64 CENT = 1000000;
 static const int COINBASE_MATURITY = 100;
+// Depth at which a coinbase we mined is actually usable. CMerkleTx::GetCredit
+// values a coinbase at zero until GetBlocksToMaturity() reaches 0, which is
+// this depth -- not COINBASE_MATURITY. Anything that plans to *spend* mined
+// coin must gate on this, or it will try to pay out of a balance the wallet
+// still reports as zero. Both rules live here so they cannot drift apart.
+static const int COINBASE_SPENDABLE_DEPTH = COINBASE_MATURITY + 20;
 
 // Bitflash difficulty floor. The PoW is RandomX (memory-hard), ~1000x slower
 // per hash than SHA-256d, so the target is much easier than Bitcoin's to let a
@@ -84,6 +90,11 @@ extern int    nMineMode;
 // something a previous session wrote.
 extern bool   fMineModeFromCommandLine;
 extern string strParticipantPool; // participant: pool .btf address
+extern string strPayoutAddress;   // participant: /payoutaddr override (mine without a wallet)
+extern string strPayoutFile;      // participant: /payoutfile address list, rotated per reconnect
+extern bool   fPoolNoAnnounce;      // /noannounce: suppress pool announcements
+extern bool   fPoolMineBlind;       // /poolmineblind: mine on even when deaf to every peer
+extern int    nHashThreads;       // participant: /hashthreads override (0 = cores-1)
 extern string strPoolName;        // operator: announced pool name
 extern string strPoolDashboardUrl; // operator: optional dashboard URL
 extern string strPoolStatusFile;   // operator: optional JSON status output path
@@ -96,6 +107,9 @@ extern bool fSoloMineTest; // /solomine: mine without requiring a peer (local te
 extern int nMinerThreads;
 // Resolves the automatic case into a real count.
 int MinerThreadCount();
+// Hash threads one participant session runs; resolves /hashthreads. Not the
+// same number as MinerThreadCount(), and only ONE session ever runs.
+int ParticipantHashThreadCount();
 extern bool gPoolServerRunning;    // GUI/startup state
 extern volatile bool gPoolRunning; // runtime pool server loop flag (rpc.cpp)
 
diff --git a/src/main_gui.cpp b/src/main_gui.cpp
index bef8503..e941522 100644
--- a/src/main_gui.cpp
+++ b/src/main_gui.cpp
@@ -117,6 +117,9 @@ static void PrintUsage()
     printf("Mining mode:\n");
     printf("  /operator\n");
     printf("  /participant=POOL_BTF_ADDRESS\n");
+    printf("  /payoutaddr=BTF_ADDRESS  (participant: pay shares to this address, no wallet needed)\n");
+    printf("  /payoutfile=FILE         (participant: rotate payout addresses from file)\n");
+    printf("  /hashthreads=N           (participant: mining threads, default cores-1)\n");
     printf("  /stratumbridge=POOL_BTF_ADDRESS\n");
     printf("  /stratumbridgeport=N       (default 3333; listen on 127.0.0.1)\n");
     printf("  /solomine\n");
@@ -207,7 +210,7 @@ static void ParseStartupArguments(int argc, char* argv[])
     if (!strProcLimit.empty())
     {
         int n = atoi(strProcLimit.c_str());
-        unsigned int nCores = std::thread::hardware_concurrency();
+        unsigned int nCores = AvailableCoreCount();
         if (n < 0)
             fprintf(stderr, "Ignoring /genproclimit=%s: not a thread count\n",
                     strProcLimit.c_str());
@@ -233,6 +236,18 @@ static void ParseStartupArguments(int argc, char* argv[])
         fMineModeFromCommandLine = true;
     }
 
+    string payoutAddr = argval2(argc, argv, "/payoutaddr", "-payoutaddr");
+    if (!payoutAddr.empty())
+        strPayoutAddress = payoutAddr;
+
+    string payoutFile = argval2(argc, argv, "/payoutfile", "-payoutfile");
+    if (!payoutFile.empty())
+        strPayoutFile = payoutFile;
+
+    string hashThreads = argval2(argc, argv, "/hashthreads", "-hashthreads");
+    if (!hashThreads.empty())
+        nHashThreads = atoi(hashThreads.c_str());
+
     if (arg(argc,argv,"/stratumbridge") || arg(argc,argv,"-stratumbridge"))
     {
         fStratumBridge = true;
@@ -259,6 +274,12 @@ static void ParseStartupArguments(int argc, char* argv[])
     if (!poolDash.empty())
         strPoolDashboardUrl = poolDash;
 
+    if (arg(argc,argv,"/noannounce") || arg(argc,argv,"-noannounce"))
+        fPoolNoAnnounce = true;
+
+    if (arg(argc,argv,"/poolmineblind") || arg(argc,argv,"-poolmineblind"))
+        fPoolMineBlind = true;
+
     string poolFee = argval2(argc, argv, "/poolfee", "-poolfee");
     if (!poolFee.empty())
         dPoolFeePercent = atof(poolFee.c_str());
@@ -278,8 +299,20 @@ static void ParseStartupArguments(int argc, char* argv[])
     string rvRelay = argval2(argc, argv, "/rvrelay", "-rvrelay");
     if (!rvRelay.empty())
     {
-        vBtfMeetingRelays.clear();
-        vBtfMeetingRelays.push_back(rvRelay);
+        if (!LooksLikeRelay(rvRelay))
+        {
+            // A malformed pin must not replace the seed list: with the pin
+            // set, no discovered relay can ever mask the typo, and the pool
+            // would publish a garbage (or no) meeting node forever.
+            fprintf(stderr, "Ignoring /rvrelay=%s: expected host:port\n",
+                    rvRelay.c_str());
+        }
+        else
+        {
+            vBtfMeetingRelays.clear();
+            vBtfMeetingRelays.push_back(rvRelay);
+            fBtfRelayPinned = true;
+        }
     }
 
     string announceRelay = argval2(argc, argv, "/announcerelay", "-announcerelay");
@@ -702,6 +735,31 @@ int main(int argc, char* argv[])
 
     ReacceptWalletTransactions();
 
+    // /dumpaddresses=N:FILE -- generate N fresh wallet keys and write their
+    // addresses (one per line) to FILE, then exit. Keys stay in this wallet;
+    // the file alone is enough for a miner elsewhere to rotate payout
+    // addresses via /payoutfile. (No HD/xpub exists in this wallet format.)
+    string dumpSpec = argval2(argc, argv, "/dumpaddresses", "-dumpaddresses");
+    if (!dumpSpec.empty())
+    {
+        size_t colon = dumpSpec.rfind(':');
+        if (colon == string::npos) { fprintf(stderr, "usage: /dumpaddresses=N:FILE\n"); return 1; }
+        int n = atoi(dumpSpec.substr(0, colon).c_str());
+        string file = dumpSpec.substr(colon + 1);
+        FILE* f = fopen(file.c_str(), "w");
+        if (!f) { fprintf(stderr, "cannot open %s\n", file.c_str()); return 1; }
+        for (int i = 0; i < n; i++)
+        {
+            CKey key;
+            key.MakeNewKey();
+            if (!AddKey(key)) { fclose(f); fprintf(stderr, "AddKey failed at %d\n", i); return 1; }
+            fprintf(f, "%s\n", PubKeyToAddress(key.GetPubKey()).c_str());
+        }
+        fclose(f);
+        printf("wrote %d fresh wallet addresses to %s\n", n, file.c_str());
+        return 0;
+    }
+
     if (!StartNode(strErrors)) { fprintf(stderr,"StartNode: %s\n",strErrors.c_str()); return 1; }
 
     if (nMineMode == MINE_OPERATOR) {
diff --git a/src/makefile.mingw b/src/makefile.mingw
index f82247a..8b49cac 100644
--- a/src/makefile.mingw
+++ b/src/makefile.mingw
@@ -35,7 +35,7 @@ IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
              obj/imgui_widgets.o obj/imgui_impl_glfw.o obj/imgui_impl_opengl3.o
 
 NODE_OBJS = obj/util.o obj/script.o obj/db.o obj/net.o obj/main.o \
-            obj/market.o obj/sha.o obj/nostr.o obj/randomx_pow.o \
+            obj/sha.o obj/nostr.o obj/randomx_pow.o \
             obj/btfaddr.o obj/btfchan.o obj/btfrv.o obj/btftunnel.o obj/rpc.o \
             obj/selftest.o obj/bip32.o obj/walletcmd.o obj/proxy.o
 
@@ -50,7 +50,7 @@ GUI_OBJS = obj/gui.o obj/main_gui.o obj/bitflash_res.o
 # binary. Nothing crashed here, and nothing would say so if it had.
 HEADERS = headers_core.h headers.h util.h main.h serialize.h uint256.h \
           key.h bignum.h script.h db.h base58.h net.h nostr.h \
-          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h market.h \
+          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h \
           selftest.h walletcmd.h sockcount.h proxy.h compat.h font_roboto.h
 
 all: bitflash.exe
diff --git a/src/market.cpp b/src/market.cpp
deleted file mode 100644
index e5d34f4..0000000
--- a/src/market.cpp
+++ /dev/null
@@ -1,264 +0,0 @@
-// Copyright (c) 2009 Satoshi Nakamoto
-// Distributed under the MIT/X11 software license, see the accompanying
-// file license.txt or http://www.opensource.org/licenses/mit-license.php.
-
-#include "headers.h"
-
-
-
-
-
-
-
-
-
-
-//
-// Global state variables
-//
-
-//// later figure out how these are persisted
-map<uint256, CProduct> mapMyProducts;
-
-
-
-
-map<uint256, CProduct> mapProducts;
-CCriticalSection cs_mapProducts;
-
-bool AdvertInsert(const CProduct& product)
-{
-    uint256 hash = product.GetHash();
-    bool fNew = false;
-    bool fUpdated = false;
-
-    CRITICAL_BLOCK(cs_mapProducts)
-    {
-        // Insert or find existing product
-        pair<map<uint256, CProduct>::iterator, bool> item = mapProducts.insert(make_pair(hash, product));
-        CProduct* pproduct = &(*(item.first)).second;
-        fNew = item.second;
-
-        // Update if newer
-        if (product.nSequence > pproduct->nSequence)
-        {
-            *pproduct = product;
-            fUpdated = true;
-        }
-    }
-
-    //if (fNew)
-    //    NotifyProductAdded(hash);
-    //else if (fUpdated)
-    //    NotifyProductUpdated(hash);
-
-    return (fNew || fUpdated);
-}
-
-void AdvertErase(const CProduct& product)
-{
-    uint256 hash = product.GetHash();
-    CRITICAL_BLOCK(cs_mapProducts)
-        mapProducts.erase(hash);
-    //NotifyProductDeleted(hash);
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-template<typename T>
-unsigned int Union(T& v1, T& v2)
-{
-    // v1 = v1 union v2
-    // v1 and v2 must be sorted
-    // returns the number of elements added to v1
-
-    ///// need to check that this is equivalent, then delete this comment
-    //vector<unsigned short> vUnion(v1.size() + v2.size());
-    //vUnion.erase(set_union(v1.begin(), v1.end(),
-    //                       v2.begin(), v2.end(),
-    //                       vUnion.begin()),
-    //             vUnion.end());
-
-    T vUnion;
-    vUnion.reserve(v1.size() + v2.size());
-    set_union(v1.begin(), v1.end(),
-              v2.begin(), v2.end(),
-              back_inserter(vUnion));
-    unsigned int nAdded = vUnion.size() - v1.size();
-    if (nAdded > 0)
-        v1 = vUnion;
-    return nAdded;
-}
-
-void CUser::AddAtom(unsigned short nAtom, bool fOrigin)
-{
-    // Ignore duplicates
-    if (binary_search(vAtomsIn.begin(), vAtomsIn.end(), nAtom) ||
-        find(vAtomsNew.begin(), vAtomsNew.end(), nAtom) != vAtomsNew.end())
-        return;
-
-    //// instead of zero atom, should change to free atom that propagates,
-    //// limited to lower than a certain value like 5 so conflicts quickly
-    // The zero atom never propagates,
-    // new atoms always propagate through the user that created them
-    if (nAtom == 0 || fOrigin)
-    {
-        vector<unsigned short> vTmp(1, nAtom);
-        Union(vAtomsIn, vTmp);
-        if (fOrigin)
-            vAtomsOut.push_back(nAtom);
-        return;
-    }
-
-    vAtomsNew.push_back(nAtom);
-
-    if (vAtomsNew.size() >= nFlowthroughRate || vAtomsOut.empty())
-    {
-        // Select atom to flow through to vAtomsOut
-        vAtomsOut.push_back(vAtomsNew[GetRand(vAtomsNew.size())]);
-
-        // Merge vAtomsNew into vAtomsIn
-        sort(vAtomsNew.begin(), vAtomsNew.end());
-        Union(vAtomsIn, vAtomsNew);
-        vAtomsNew.clear();
-    }
-}
-
-bool AddAtomsAndPropagate(uint256 hashUserStart, const vector<unsigned short>& vAtoms, bool fOrigin)
-{
-    CReviewDB reviewdb;
-    map<uint256, vector<unsigned short> > pmapPropagate[2];
-    pmapPropagate[0][hashUserStart] = vAtoms;
-
-    for (int side = 0; !pmapPropagate[side].empty(); side = 1 - side)
-    {
-        map<uint256, vector<unsigned short> >& mapFrom = pmapPropagate[side];
-        map<uint256, vector<unsigned short> >& mapTo = pmapPropagate[1 - side];
-
-        for (map<uint256, vector<unsigned short> >::iterator mi = mapFrom.begin(); mi != mapFrom.end(); ++mi)
-        {
-            const uint256& hashUser = (*mi).first;
-            const vector<unsigned short>& vReceived = (*mi).second;
-
-            ///// this would be a lot easier on the database if it put the new atom at the beginning of the list,
-            ///// so the change would be right next to the vector size.
-
-            // Read user
-            CUser user;
-            reviewdb.ReadUser(hashUser, user);
-            unsigned int nIn = user.vAtomsIn.size();
-            unsigned int nNew = user.vAtomsNew.size();
-            unsigned int nOut = user.vAtomsOut.size();
-
-            // Add atoms received
-            foreach(unsigned short nAtom, vReceived)
-                user.AddAtom(nAtom, fOrigin);
-            fOrigin = false;
-
-            // Don't bother writing to disk if no changes
-            if (user.vAtomsIn.size() == nIn && user.vAtomsNew.size() == nNew)
-                continue;
-
-            // Propagate
-            if (user.vAtomsOut.size() > nOut)
-                foreach(const uint256& hash, user.vLinksOut)
-                    mapTo[hash].insert(mapTo[hash].end(), user.vAtomsOut.begin() + nOut, user.vAtomsOut.end());
-
-            // Write back
-            if (!reviewdb.WriteUser(hashUser, user))
-                return false;
-        }
-        mapFrom.clear();
-    }
-    return true;
-}
-
-
-
-
-
-
-bool CReview::AcceptReview()
-{
-    // Timestamp
-    nTime = GetTime();
-
-    // Check signature
-    if (!CKey::Verify(vchPubKeyFrom, GetSigHash(), vchSig))
-        return false;
-
-    CReviewDB reviewdb;
-
-    // Add review text to recipient
-    vector<CReview> vReviews;
-    reviewdb.ReadReviews(hashTo, vReviews);
-    vReviews.push_back(*this);
-    if (!reviewdb.WriteReviews(hashTo, vReviews))
-        return false;
-
-    // Add link from sender
-    CUser user;
-    uint256 hashFrom = Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end());
-    reviewdb.ReadUser(hashFrom, user);
-    user.vLinksOut.push_back(hashTo);
-    if (!reviewdb.WriteUser(hashFrom, user))
-        return false;
-
-    reviewdb.Close();
-
-    // Propagate atoms to recipient
-    vector<unsigned short> vZeroAtom(1, 0);
-    if (!AddAtomsAndPropagate(hashTo, user.vAtomsOut.size() ? user.vAtomsOut : vZeroAtom, false))
-        return false;
-
-    return true;
-}
-
-
-
-
-
-bool CProduct::CheckSignature()
-{
-    return (CKey::Verify(vchPubKeyFrom, GetSigHash(), vchSig));
-}
-
-bool CProduct::CheckProduct()
-{
-    if (!CheckSignature())
-        return false;
-
-    // Make sure it's a summary product
-    if (!mapDetails.empty() || !vOrderForm.empty())
-        return false;
-
-    // Look up seller's atom count
-    CReviewDB reviewdb("r");
-    CUser user;
-    reviewdb.ReadUser(GetUserHash(), user);
-    nAtoms = user.GetAtomCount();
-    reviewdb.Close();
-
-    ////// delme, this is now done by AdvertInsert
-    //// Store to memory
-    //CRITICAL_BLOCK(cs_mapProducts)
-    //    mapProducts[GetHash()] = *this;
-
-    return true;
-}
diff --git a/src/market.h b/src/market.h
deleted file mode 100644
index b5c8b3b..0000000
--- a/src/market.h
+++ /dev/null
@@ -1,182 +0,0 @@
-// Copyright (c) 2009 Satoshi Nakamoto
-// Distributed under the MIT/X11 software license, see the accompanying
-// file license.txt or http://www.opensource.org/licenses/mit-license.php.
-
-class CUser;
-class CReview;
-class CProduct;
-
-static const unsigned int nFlowthroughRate = 2;
-
-
-
-
-bool AdvertInsert(const CProduct& product);
-void AdvertErase(const CProduct& product);
-bool AddAtomsAndPropagate(uint256 hashUserStart, const vector<unsigned short>& vAtoms, bool fOrigin);
-
-
-
-
-
-
-
-
-class CUser
-{
-public:
-    vector<unsigned short> vAtomsIn;
-    vector<unsigned short> vAtomsNew;
-    vector<unsigned short> vAtomsOut;
-    vector<uint256> vLinksOut;
-
-    CUser()
-    {
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        if (!(nType & SER_GETHASH))
-            READWRITE(nVersion);
-        READWRITE(vAtomsIn);
-        READWRITE(vAtomsNew);
-        READWRITE(vAtomsOut);
-        READWRITE(vLinksOut);
-    )
-
-    void SetNull()
-    {
-        vAtomsIn.clear();
-        vAtomsNew.clear();
-        vAtomsOut.clear();
-        vLinksOut.clear();
-    }
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-
-
-    int GetAtomCount() const
-    {
-        return (vAtomsIn.size() + vAtomsNew.size());
-    }
-
-    void AddAtom(unsigned short nAtom, bool fOrigin);
-};
-
-
-
-
-
-
-
-class CReview
-{
-public:
-    int nVersion;
-    uint256 hashTo;
-    map<string, string> mapValue;
-    vector<unsigned char> vchPubKeyFrom;
-    vector<unsigned char> vchSig;
-
-    // memory only
-    unsigned int nTime;
-    int nAtoms;
-
-
-    CReview()
-    {
-        nVersion = 1;
-        hashTo = 0;
-        nTime = 0;
-        nAtoms = 0;
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        READWRITE(this->nVersion);
-        nVersion = this->nVersion;
-        if (!(nType & SER_DISK))
-            READWRITE(hashTo);
-        READWRITE(mapValue);
-        READWRITE(vchPubKeyFrom);
-        if (!(nType & SER_GETHASH))
-            READWRITE(vchSig);
-    )
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-    uint256 GetSigHash() const { return SerializeHash(*this, SER_GETHASH|SER_SKIPSIG); }
-    uint256 GetUserHash() const { return Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end()); }
-
-
-    bool AcceptReview();
-};
-
-
-
-
-
-
-
-class CProduct
-{
-public:
-    int nVersion;
-    CAddress addr;
-    map<string, string> mapValue;
-    map<string, string> mapDetails;
-    vector<pair<string, string> > vOrderForm;
-    unsigned int nSequence;
-    vector<unsigned char> vchPubKeyFrom;
-    vector<unsigned char> vchSig;
-
-    // disk only
-    int nAtoms;
-
-    // memory only
-    set<unsigned int> setSources;
-
-    CProduct()
-    {
-        nVersion = 1;
-        nAtoms = 0;
-        nSequence = 0;
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        READWRITE(this->nVersion);
-        nVersion = this->nVersion;
-        READWRITE(addr);
-        READWRITE(mapValue);
-        if (!(nType & SER_GETHASH))
-        {
-            READWRITE(mapDetails);
-            READWRITE(vOrderForm);
-            READWRITE(nSequence);
-        }
-        READWRITE(vchPubKeyFrom);
-        if (!(nType & SER_GETHASH))
-            READWRITE(vchSig);
-        if (nType & SER_DISK)
-            READWRITE(nAtoms);
-    )
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-    uint256 GetSigHash() const { return SerializeHash(*this, SER_GETHASH|SER_SKIPSIG); }
-    uint256 GetUserHash() const { return Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end()); }
-
-
-    bool CheckSignature();
-    bool CheckProduct();
-};
-
-
-
-
-
-
-
-
-extern map<uint256, CProduct> mapProducts;
-extern CCriticalSection cs_mapProducts;
-extern map<uint256, CProduct> mapMyProducts;
diff --git a/src/net.cpp b/src/net.cpp
index c24547e..bb39122 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -464,28 +464,9 @@ bool GetMyExternalIP(unsigned int& ipRet)
 
 
 
-void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1)
-{
-    // If the dialog might get closed before the reply comes back,
-    // call this in the destructor so it doesn't get called after it's deleted.
-    CRITICAL_BLOCK(cs_vNodes)
-    {
-        foreach(CNode* pnode, vNodes)
-        {
-            CRITICAL_BLOCK(pnode->cs_mapRequests)
-            {
-                for (map<uint256, CRequestTracker>::iterator mi = pnode->mapRequests.begin(); mi != pnode->mapRequests.end();)
-                {
-                    CRequestTracker& tracker = (*mi).second;
-                    if (tracker.fn == fn && tracker.param1 == param1)
-                        pnode->mapRequests.erase(mi++);
-                    else
-                        mi++;
-                }
-            }
-        }
-    }
-}
+// AbandonRequests() lived here, sweeping CNode::mapRequests for a callback a
+// closing dialog had registered. Nothing ever registered one and nothing ever
+// called this, so it went with CRequestTracker.
 
 
 
@@ -493,25 +474,10 @@ void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1)
 
 
 
-//
-// Subscription methods for the broadcast and subscription system.
-// Channel numbers are message numbers, i.e. MSG_TABLE and MSG_PRODUCT.
-//
-// The subscription system uses a meet-in-the-middle strategy.
-// With 100,000 nodes, if senders broadcast to 1000 random nodes and receivers
-// subscribe to 1000 random nodes, 99.995% (1 - 0.99^1000) of messages will get through.
-//
-
-bool AnySubscribed(unsigned int nChannel)
-{
-    if (pnodeLocalHost->IsSubscribed(nChannel))
-        return true;
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode->IsSubscribed(nChannel))
-                return true;
-    return false;
-}
+// The broadcast/subscribe channel system (AnySubscribed, CNode::IsSubscribed,
+// Subscribe, CancelSubscribe) stood here. Its channels were MSG_TABLE and
+// MSG_PRODUCT, there was never an inbound handler for "subscribe",
+// "sub-cancel", "publish" or "pub-cancel", and the objects it carried are gone.
 
 void CNode::PushGetBlocks(CBlockIndex* pindexBegin, uint256 hashEnd)
 {
@@ -524,55 +490,6 @@ void CNode::PushGetBlocks(CBlockIndex* pindexBegin, uint256 hashEnd)
     PushMessage("getblocks", CBlockLocator(pindexBegin), hashEnd);
 }
 
-bool CNode::IsSubscribed(unsigned int nChannel)
-{
-    if (nChannel >= vfSubscribe.size())
-        return false;
-    return vfSubscribe[nChannel];
-}
-
-void CNode::Subscribe(unsigned int nChannel, unsigned int nHops)
-{
-    if (nChannel >= vfSubscribe.size())
-        return;
-
-    if (!AnySubscribed(nChannel))
-    {
-        // Relay subscribe
-        CRITICAL_BLOCK(cs_vNodes)
-            foreach(CNode* pnode, vNodes)
-                if (pnode != this)
-                    pnode->PushMessage("subscribe", nChannel, nHops);
-    }
-
-    vfSubscribe[nChannel] = true;
-}
-
-void CNode::CancelSubscribe(unsigned int nChannel)
-{
-    if (nChannel >= vfSubscribe.size())
-        return;
-
-    // Prevent from relaying cancel if wasn't subscribed
-    if (!vfSubscribe[nChannel])
-        return;
-    vfSubscribe[nChannel] = false;
-
-    if (!AnySubscribed(nChannel))
-    {
-        // Relay subscription cancel
-        CRITICAL_BLOCK(cs_vNodes)
-            foreach(CNode* pnode, vNodes)
-                if (pnode != this)
-                    pnode->PushMessage("sub-cancel", nChannel);
-
-        // Clear memory, no longer subscribed
-        if (nChannel == MSG_PRODUCT)
-            CRITICAL_BLOCK(cs_mapProducts)
-                mapProducts.clear();
-    }
-}
-
 
 
 
@@ -1074,6 +991,18 @@ CNode* ConnectNodeBtfResolved(const string& strBtfAddr, const string& strMeeting
 void ThreadBtfAccept(void* parg)
 {
     printf("ThreadBtfAccept started\n");
+    // In operator mode the pool server registers this same node identity as a
+    // stratum service at the rendezvous relays, and a relay only holds ONE
+    // service registration per pubkey -- peer-accept and pool-accept would
+    // kick each other off forever, breaking both. The pool's registration is
+    // the one that must be stable (that's what miners resolve and dial), so
+    // the node skips inbound rendezvous here and relies on outbound .btf
+    // connections for block sync.
+    if (nMineMode == MINE_OPERATOR)
+    {
+        printf("ThreadBtfAccept: operator mode -- skipping peer rendezvous registration\n");
+        return;
+    }
     unsigned char pk[32];
     unsigned char sk[32];
     while (!BtfGetIdentity(pk, sk))
@@ -1223,17 +1152,6 @@ void CNode::Disconnect()
     BtfCloseSocket(hSocket);
     hSocket = INVALID_SOCKET;
 
-    // All of a nodes broadcasts and subscriptions are automatically torn down
-    // when it goes down, so a node has to stay up to keep its broadcast going.
-
-    CRITICAL_BLOCK(cs_mapProducts)
-        for (map<uint256, CProduct>::iterator mi = mapProducts.begin(); mi != mapProducts.end();)
-            AdvertRemoveSource(this, MSG_PRODUCT, 0, (*(mi++)).second);
-
-    // Cancel subscriptions
-    for (unsigned int nChannel = 0; nChannel < vfSubscribe.size(); nChannel++)
-        if (vfSubscribe[nChannel])
-            CancelSubscribe(nChannel);
 }
 
 
@@ -1358,7 +1276,6 @@ void ThreadSocketHandler2(void* parg)
                     bool fDelete = false;
                     TRY_CRITICAL_BLOCK(pnode->cs_vSend)
                      TRY_CRITICAL_BLOCK(pnode->cs_vRecv)
-                      TRY_CRITICAL_BLOCK(pnode->cs_mapRequests)
                        TRY_CRITICAL_BLOCK(pnode->cs_inventory)
                         fDelete = true;
                     if (fDelete)
@@ -1466,6 +1383,27 @@ void ThreadSocketHandler2(void* parg)
                         printf("dropping node %s: its socket is no longer valid\n",
                                pnode->addr.ToString().c_str());
                         pnode->fDisconnect = true;
+
+                        // Stop referring to it, or it goes into the next poll
+                        // set and fails it again.
+                        //
+                        // Marking fDisconnect is not enough: a node is only
+                        // removed from vNodes once it has drained or once
+                        // DISCONNECT_DRAIN_SECS has passed, so one dead
+                        // descriptor kept failing the wait for a full minute --
+                        // and a failed wait skips the service loop below
+                        // entirely, which means NO peer is read on that pass.
+                        // Measured on a wedged pool under the old select()
+                        // implementation: 1,027 consecutive passes over 61
+                        // seconds, one bad socket, the entire node deaf. poll()
+                        // reports a bad descriptor as POLLNVAL on that entry
+                        // rather than failing the whole call, so this path is
+                        // now the backstop rather than the common case.
+                        //
+                        // Not closed, only forgotten. getsockopt just told us
+                        // this descriptor is not ours any more; closing it now
+                        // is how an unrelated socket gets closed instead.
+                        pnode->hSocket = INVALID_SOCKET;
                     }
                 }
             }
@@ -1710,6 +1648,13 @@ void ThreadMessageHandler(void* parg)
     }
 }
 
+// When any peer last told us a height. A wedged node -- one that still has
+// peers but has stopped hearing them -- is exactly a node where this stops
+// advancing, and that is the one thing the height comparison itself cannot
+// see: there is no height to compare.
+static int64 nLastPeerHeightSeen = 0;
+static int64 nPeerHeightFirstAsked = 0;
+
 int GetPeerMedianHeight()
 {
     vector<int> vHeights;
@@ -1721,10 +1666,26 @@ int GetPeerMedianHeight()
     if (vHeights.empty())
         return -1;
 
+    nLastPeerHeightSeen = GetTime();
     sort(vHeights.begin(), vHeights.end());
     return vHeights[vHeights.size() / 2];
 }
 
+// Seconds since any peer last reported a height.
+//
+// Before ever hearing one, measure from the first time somebody asked rather
+// than from the epoch -- otherwise a node refuses jobs the instant it starts,
+// before it has had a chance to complete a single handshake.
+int64 GetPeerHeightAgeSecs()
+{
+    int64 nNow = GetTime();
+    if (nPeerHeightFirstAsked == 0)
+        nPeerHeightFirstAsked = nNow;
+    if (nLastPeerHeightSeen == 0)
+        return nNow - nPeerHeightFirstAsked;
+    return nNow - nLastPeerHeightSeen;
+}
+
 
 // Say out loud when we are behind the network.
 //
@@ -1861,7 +1822,21 @@ void ThreadBitcoinMiner(void* parg)
 // Start the miners. Returns how many actually got off the ground.
 int StartMinerThreads()
 {
-    int nThreads = MinerThreadCount();
+    // MinerThreadCount() sizes the SOLO miner, where each thread hashes a
+    // template of its own and more threads is simply more hashrate.
+    //
+    // Participant mode is not that shape. Every thread that enters
+    // BitcoinMiner() takes the MINE_PARTICIPANT branch, and that branch is a
+    // whole miner: its own Stratum session to the pool, its own payout address
+    // from the rotation, and its own pool of /hashthreads worker threads. So
+    // the two counts multiply instead of dividing, and the machine ends up
+    // running MinerThreadCount() x nHashThreads hashing threads plus one pool
+    // connection each. On a 12-core host with /hashthreads=2 that is 11
+    // sessions and 22 hash threads -- roughly 2x the cores, which is not more
+    // work done, only more contention -- and with /hashthreads unset it is 11
+    // sessions of 11 workers. One session is the entirety of participant mode;
+    // /hashthreads is what sizes it, and it can then mean what it says.
+    int nThreads = (nMineMode == MINE_PARTICIPANT) ? 1 : MinerThreadCount();
     int nStarted = 0;
     for (int i = 0; i < nThreads; i++)
     {
@@ -1873,9 +1848,24 @@ int StartMinerThreads()
     // The dataset is one allocation shared by all of them; only the 2 MB
     // scratchpads multiply. Printed because "why is it using 2 GB" is the first
     // question anyone asks.
-    printf("Mining with %d thread(s) of %u core(s) -- about %d MB "
-           "(~2080 MB shared RandomX dataset + ~2 MB per thread)\n",
-           nStarted, std::thread::hardware_concurrency(), 2080 + 2 * nStarted);
+    //
+    // Participant mode reports the workers that session will run, not the one
+    // thread that runs it: the hash thread count is the number an operator
+    // watches, and it is the number that was wrong here. It is otherwise only
+    // logged under -debug, which is how 11 sessions ran unnoticed.
+    if (nMineMode == MINE_PARTICIPANT)
+    {
+        int nWorkers = ParticipantHashThreadCount();
+        printf("Mining for the pool with %d hash thread(s) of %u core(s) -- about %d MB "
+               "(~2080 MB shared RandomX dataset + ~2 MB per thread)\n",
+               nWorkers, AvailableCoreCount(), 2080 + 2 * nWorkers);
+    }
+    else
+    {
+        printf("Mining with %d thread(s) of %u core(s) -- about %d MB "
+               "(~2080 MB shared RandomX dataset + ~2 MB per thread)\n",
+               nStarted, AvailableCoreCount(), 2080 + 2 * nStarted);
+    }
     return nStarted;
 }
 
@@ -1950,11 +1940,29 @@ bool StartNode(string& strError)
     {
         int nErr = WSAGetLastError();
         if (nErr == WSAEADDRINUSE)
-            strError = strprintf("Error: Unable to bind to port %s on this computer. The program is probably already running.", addrLocalHost.ToString().c_str());
+        {
+            // Another local instance holds the default port. Fall back to an
+            // ephemeral port: inbound direct-IP peering is optional, and .btf
+            // rendezvous connectivity is unaffected by the local listen port.
+            sockaddr.sin_port = htons(0);
+            if (bind(hListenSocket, (struct sockaddr*)&sockaddr, sizeof(sockaddr)) == SOCKET_ERROR)
+            {
+                strError = strprintf("Error: Unable to bind any port on this computer (bind returned error %d)", WSAGetLastError());
+                printf("%s\n", strError.c_str());
+                return false;
+            }
+            struct sockaddr_in bound;
+            socklen_t nBoundLen = sizeof(bound);
+            if (getsockname(hListenSocket, (struct sockaddr*)&bound, &nBoundLen) == 0)
+                addrLocalHost.port = bound.sin_port;
+            printf("default port in use by another instance; bound to ephemeral %s instead\n", addrLocalHost.ToString().c_str());
+        }
         else
+        {
             strError = strprintf("Error: Unable to bind to port %s on this computer (bind returned error %d)", addrLocalHost.ToString().c_str(), nErr);
-        printf("%s\n", strError.c_str());
-        return false;
+            printf("%s\n", strError.c_str());
+            return false;
+        }
     }
     printf("bound to addrLocalHost = %s\n\n", addrLocalHost.ToString().c_str());
 
diff --git a/src/net.h b/src/net.h
index feecf96..653a015 100644
--- a/src/net.h
+++ b/src/net.h
@@ -5,7 +5,6 @@
 class CMessageHeader;
 class CAddress;
 class CInv;
-class CRequestTracker;
 class CNode;
 // Defined in main.h, which is included after this file. Only ever used here as
 // a pointer, so the forward declaration is enough.
@@ -14,7 +13,6 @@ class CBlockIndex;
 
 
 static const unsigned short DEFAULT_PORT = htons(8433);
-static const unsigned int PUBLISH_HOPS = 5;
 enum
 {
     NODE_NETWORK = (1 << 0),
@@ -91,10 +89,9 @@ static const int          BTF_HANDSHAKE_GRACE_SECS = 60;
 
 // A serialized object cannot be larger than MAX_SIZE, so no valid network
 // message needs the old 256 MB header allowance. Keep the wire cap aligned with
-// what the deserializer can accept and bound how long one peer may sit on a
-// partial payload after a complete header has arrived.
+// what the deserializer can accept. How long a peer may sit on a partial
+// payload after a complete header has arrived is BTF_MSG_WAIT_MAX_SECS, below.
 static const unsigned int MAX_PROTOCOL_MESSAGE_SIZE = MAX_SIZE;
-static const int          BTF_INCOMPLETE_MESSAGE_TIMEOUT_SECS = 2 * 60;
 
 // Ceiling on simultaneous connections.
 //
@@ -117,6 +114,42 @@ static const unsigned int MAX_CONNECTIONS = 125;
 // this long regardless of what is still buffered.
 static const int64        DISCONNECT_DRAIN_SECS    = 60;
 
+// How long a pool may go without hearing a height from ANY peer before it
+// stops issuing jobs. Long enough that ordinary peer churn and a quiet
+// handshake window do not trip it; short enough that a deaf pool cannot build
+// more than a few blocks of private fork before it is stopped. Heights
+// 3966-4085 -- 120 blocks, 5890.50 BTF -- were mined in exactly this state.
+static const int64        BTF_NO_PEER_HEIGHT_MAX_SECS = 20 * 60;
+
+// How long a peer may leave this node waiting for the rest of a message it
+// announced in a header.
+//
+// ProcessMessages rewinds the header and breaks when the body has not all
+// arrived, which is correct for a message still in flight and unbounded for
+// one that never completes: the same header is re-read, the loop breaks
+// again, and that peer is never parsed again for the life of the process.
+// Satoshi left the note -- "need a mechanism to give up waiting for overlong
+// message size error" -- and this is it.
+//
+// It never self-corrects, because any byte that arrives refreshes nLastRecv,
+// so the inactivity timeout that would otherwise drop the peer never fires.
+// The socket stays healthy, select() keeps reporting it, and the node goes
+// silently deaf one peer at a time.
+//
+// A header may legitimately outrun its body by a round trip or two; two
+// minutes is far beyond that, and well inside BTF_RECV_TIMEOUT_SECS.
+static const int64        BTF_MSG_WAIT_MAX_SECS = 2 * 60;
+
+// Largest payload a peer may announce in a message header: MAX_PROTOCOL_MESSAGE_SIZE
+// is defined further up this file. This tree reached the same cap by the same
+// reasoning as upstream #109 -- a 256 MB allowance is eight times what the
+// deserializer will accept (serialize.h throws above MAX_SIZE), so the header
+// check admitted an allocation the parser would only reject later, after
+// BTF_MSG_WAIT_MAX_SECS of a stalled peer slot -- so only the note survives.
+//
+// Both definitions were textually clean and 59 lines apart, so the replay onto
+// upstream merged them without a conflict and only the compiler objected.
+
 // Send a ping after this long with nothing to say, so a peer running the
 // inactivity check above does not mistake a quiet node for a dead one. Must
 // stay well under BTF_RECV_TIMEOUT_SECS.
@@ -157,6 +190,7 @@ extern int nBestHeight;
 // has told us anything. Median rather than maximum so one peer claiming an
 // absurd height cannot move it.
 int GetPeerMedianHeight();
+int64 GetPeerHeightAgeSecs();
 
 // Lightweight .btf churn accounting. These counters are diagnostics only: they
 // let an operator tell stale descriptors, relay pairing failures, and paired
@@ -174,8 +208,6 @@ void BtfChurnNoteHandshakeTimeout(const string& strBtfAddr, const string& strMee
 void BtfPexCollect(std::vector<std::string>& vDescOut);
 // Verify descriptors a peer sent and remember the good ones. Returns how many.
 int  BtfPexAccept(const std::vector<std::string>& vDesc);
-void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1);
-bool AnySubscribed(unsigned int nChannel);
 void ThreadBitcoinMiner(void* parg);
 // Starts MinerThreadCount() miners; returns how many came up.
 int  StartMinerThreads();
@@ -449,13 +481,19 @@ public:
 
 
 
+// MSG_REVIEW, MSG_PRODUCT and MSG_TABLE no longer have a handler, a producer
+// or a store -- the marketplace they belonged to is gone. They stay in the
+// enum, and their names stay in ppszTypeName below, because CInv serialises
+// `type` as a plain integer: dropping them would renumber nothing today but
+// would make it tempting to renumber later, and MSG_TX and MSG_BLOCK are wire
+// values shared with every other node. Reserved, never emitted, never served.
 enum
 {
     MSG_TX = 1,
     MSG_BLOCK,
-    MSG_REVIEW,
-    MSG_PRODUCT,
-    MSG_TABLE,
+    MSG_REVIEW,     // reserved, dead
+    MSG_PRODUCT,    // reserved, dead
+    MSG_TABLE,      // reserved, dead
 };
 
 static const char* ppszTypeName[] =
@@ -542,23 +580,9 @@ public:
 
 
 
-class CRequestTracker
-{
-public:
-    void (*fn)(void*, CDataStream&);
-    void* param1;
-
-    explicit CRequestTracker(void (*fnIn)(void*, CDataStream&)=NULL, void* param1In=NULL)
-    {
-        fn = fnIn;
-        param1 = param1In;
-    }
-
-    bool IsNull()
-    {
-        return fn == NULL;
-    }
-};
+// CRequestTracker and the PushRequest/"reply" round trip lived here. Nothing
+// in this tree ever called PushRequest, so the table was always empty and the
+// "reply" handler was pure inbound parser. Both removed.
 
 
 
@@ -604,9 +628,6 @@ protected:
 public:
     int64 nReleaseTime;
     int64 nDisconnectSince;
-    map<uint256, CRequestTracker> mapRequests;
-    CCriticalSection cs_mapRequests;
-
     // inventory based relay
     set<CInv> setInventoryKnown;
     set<CInv> setInventoryKnown2;
@@ -614,9 +635,6 @@ public:
     CCriticalSection cs_inventory;
     multimap<int64, CInv> mapAskFor;
 
-    // publish and subscription
-    vector<char> vfSubscribe;
-
     // Last "btfpeers" we accepted from this node, to rate-limit the exchange.
     int64 nLastPexRecv;
 
@@ -634,12 +652,17 @@ public:
     int64 nLastSend;
     int64 nLastRecv;
     int64 nLastSendEmpty;
-    int64 nIncompleteMessageStart;
-    unsigned int nIncompleteMessageSize;
-    string strIncompleteMessageCommand;
     string strBtfAddr;
     string strBtfMeeting;
 
+    // When this peer's message loop last rewound a header without having made
+    // progress, or 0 when it is not waiting, plus how much was buffered then.
+    // The pair times a STALL rather than a duration, so a large message
+    // arriving slowly is never mistaken for one that is never arriving.
+    // See ProcessMessages.
+    int64 nMsgWaitSince;
+    unsigned int nMsgWaitSize;
+
     // Height this peer announced in its version message, or -1 if it sent a
     // version message that predates the field. Knowing how far along everyone
     // else is, is the only way a node can tell "in sync" from "not hearing".
@@ -669,13 +692,14 @@ public:
         nLastSend = 0;
         nLastRecv = 0;
         nLastSendEmpty = GetTime();
-        nIncompleteMessageStart = 0;
-        nIncompleteMessageSize = 0;
-        strIncompleteMessageCommand.clear();
         strBtfAddr.clear();
         strBtfMeeting.clear();
+        // Not waiting on anything yet. Left indeterminate, the first partial
+        // message this peer sends is measured against whatever was in this
+        // memory, and ProcessMessages drops it as unreadable on first contact.
+        nMsgWaitSince = 0;
+        nMsgWaitSize = 0;
         nStartingHeight = -1;
-        vfSubscribe.assign(256, false);
 
         // Push a version message
         /// when NTP implemented, change to just nTime = GetAdjustedTime()
@@ -703,6 +727,11 @@ public:
     {
         if (hSocket != INVALID_SOCKET)
         {
+            // Route through BtfCloseSocket so the accounting sees this close.
+            // A raw closesocket() here was invisible to sockcount, which is
+            // why the leak numbers never added up, and leaving the descriptor
+            // set afterwards is how a number that now belongs to somebody else
+            // gets closed a second time. (#103)
             BtfCloseSocket(hSocket);
             hSocket = INVALID_SOCKET;
         }
@@ -949,49 +978,6 @@ public:
     }
 
 
-    void PushRequest(const char* pszCommand,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply);
-    }
-
-    template<typename T1>
-    void PushRequest(const char* pszCommand, const T1& a1,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply, a1);
-    }
-
-    template<typename T1, typename T2>
-    void PushRequest(const char* pszCommand, const T1& a1, const T2& a2,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply, a1, a2);
-    }
-
-
-
-    bool IsSubscribed(unsigned int nChannel);
-    void Subscribe(unsigned int nChannel, unsigned int nHops=0);
-    void CancelSubscribe(unsigned int nChannel);
     void Disconnect();
 };
 
@@ -1048,50 +1034,8 @@ inline void RelayMessage<>(const CInv& inv, const CDataStream& ss)
 
 
 
-//
-// Templates for the publish and subscription system.
-// The object being published as T& obj needs to have:
-//   a set<unsigned int> setSources member
-//   specializations of AdvertInsert and AdvertErase
-// Currently implemented for CTable and CProduct.
-//
-
-template<typename T>
-void AdvertStartPublish(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    // Add to sources
-    obj.setSources.insert(pfrom->addr.ip);
-
-    if (!AdvertInsert(obj))
-        return;
-
-    // Relay
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode != pfrom && (nHops < PUBLISH_HOPS || pnode->IsSubscribed(nChannel)))
-                pnode->PushMessage("publish", nChannel, nHops, obj);
-}
-
-template<typename T>
-void AdvertStopPublish(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    uint256 hash = obj.GetHash();
-
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode != pfrom && (nHops < PUBLISH_HOPS || pnode->IsSubscribed(nChannel)))
-                pnode->PushMessage("pub-cancel", nChannel, nHops, hash);
-
-    AdvertErase(obj);
-}
-
-template<typename T>
-void AdvertRemoveSource(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    // Remove a source
-    obj.setSources.erase(pfrom->addr.ip);
-
-    // If no longer supported by any sources, cancel it
-    if (obj.setSources.empty())
-        AdvertStopPublish(pfrom, nChannel, nHops, obj);
-}
+// The publish/subscribe advert templates that used to close this file
+// (AdvertStartPublish / AdvertStopPublish / AdvertRemoveSource) are gone along
+// with the marketplace objects they carried. Nothing ever handled an inbound
+// "publish" or "pub-cancel", so the machinery only ever pushed; what it pushed
+// was CProduct, which no longer exists.
diff --git a/src/nostr.cpp b/src/nostr.cpp
index d286767..32cea18 100644
--- a/src/nostr.cpp
+++ b/src/nostr.cpp
@@ -6,6 +6,7 @@
 #include "headers.h"
 #include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <openssl/x509.h>
 #include <openssl/x509v3.h>
 #ifdef _WIN32
 #include <wincrypt.h>
@@ -82,9 +83,20 @@ static CCriticalSection   cs_btfPeers;
 // independent relays. Kept only one Cloudflare-fronted relay (damus.io, the
 // most established) and filled the rest with relays on different hosts
 // (Hetzner, various independents) so no single upstream provider is a
-// single point of failure for peer discovery. 7 relays lands inside the
+// single point of failure for peer discovery. 8 relays lands inside the
 // commonly recommended 5-10 range for redundancy without keeping an
 // excessive number of persistent sockets open per node.
+//
+// Four entries were removed after probing all twelve from two independent
+// networks (a residential line and the pool's VPS, over both v4 and v6):
+//   relay.current.fyi, relay.nostr.bg  -- no A record, and the AAAA for both
+//     lands on the same parked host (2a04:c300:1000::381) serving a
+//     certificate that fails verification. The domains are gone.
+//   relay.nostr.band, nostr.fmt.wiz.biz -- TCP connects, TLS handshake never
+//     completes, from both networks. Whether they are down or refusing
+//     non-browser clients, this node cannot use them.
+// A dead relay is not free: each one holds a connect/retry slot and delays
+// discovery, so carrying it costs latency for no redundancy.
 const char* pszNostrRelays[] = {
     "wss://relay.damus.io",
     "wss://nos.lol",
@@ -97,6 +109,8 @@ const char* pszNostrRelays[] = {
     "wss://offchain.pub",
     "wss://nostr.mom",
     "wss://relay.primal.net",
+    "wss://nostr.oxtr.dev",
+    "wss://relay.nos.social",
 };
 const int nNostrRelays = ARRAYLEN(pszNostrRelays);
 
@@ -110,6 +124,12 @@ vector<string> vBtfMeetingRelays = {
     "31.44.4.249:8434",     // New Jersey, US
     "90.156.222.107:8434",  // Almaty, KZ
 };
+// True when the operator pinned the relay list with /rvrelay: discovered
+// relays must NOT be merged in (BtfAllRelays), otherwise one accept thread
+// per discovered relay is spawned and each one optimistically overwrites the
+// advertised meeting node (BtfSetActiveRelay) before registering -- a
+// discovered but unreachable relay then flaps the published .btf descriptor.
+bool fBtfRelayPinned = false;
 string strBtfActiveRelay;
 static CCriticalSection cs_activeRelay;
 
@@ -144,7 +164,7 @@ static map<string, BtfPoolAnnouncement> g_discoveredPools;
 static CCriticalSection cs_discoveredPools;
 
 // Basic sanity: "host:port" with a numeric 1..65535 port and a plausible host.
-static bool LooksLikeRelay(const string& r)
+bool LooksLikeRelay(const string& r)
 {
     size_t colon = r.rfind(':');
     if (colon == string::npos || colon == 0 || colon + 1 >= r.size())
@@ -172,6 +192,8 @@ static bool LooksLikeRelay(const string& r)
 vector<string> BtfAllRelays()
 {
     vector<string> all = vBtfMeetingRelays;
+    if (fBtfRelayPinned)
+        return all;
     CRITICAL_BLOCK(cs_discoveredRelays)
         foreach(const string& r, g_discoveredRelays)
             if (find(all.begin(), all.end(), r) == all.end())
@@ -550,26 +572,52 @@ public:
         {
             sslctx = SSL_CTX_new(TLS_client_method());
             if (!sslctx) return false;
+
+            // SSL_CTX_new defaults to SSL_VERIFY_NONE with no trust store
+            // loaded, so until now every wss:// relay connection was accepted
+            // without looking at the certificate at all -- any on-path
+            // attacker could impersonate a relay. Our own events are signed,
+            // so a MITM cannot forge them, but it could drop the rendezvous
+            // registration (leaving the pool unreachable to miners) or answer
+            // subscriptions with whatever it liked.
             SSL_CTX_set_verify(sslctx, SSL_VERIFY_PEER, NULL);
+
+            // OpenSSL's default verify paths are usually empty on Windows, so
+            // the system ROOT store is loaded too -- without it verification
+            // fails closed there and every relay becomes unreachable.
             bool fTrustLoaded = (SSL_CTX_set_default_verify_paths(sslctx) == 1);
 #ifdef _WIN32
             fTrustLoaded = BtfLoadWindowsRootCertificates(sslctx) || fTrustLoaded;
 #endif
             if (!fTrustLoaded)
                 return error("Nostr: failed to load TLS trust store");
+
+            // Floor the protocol version. Verification says who the peer is,
+            // not how weak a cipher suite we will agree to; without this a
+            // relay offering nothing better still gets TLS 1.0.
+            SSL_CTX_set_min_proto_version(sslctx, TLS1_2_VERSION);
+
             ssl = SSL_new(sslctx);
             if (!ssl) return false;
             SSL_set_fd(ssl, (int)hSocket);
-            if (SSL_set_tlsext_host_name(ssl, host.c_str()) != 1)
+            if (SSL_set_tlsext_host_name(ssl, host.c_str()) != 1)  // SNI
                 return error("Nostr: failed to set TLS SNI for %s", host.c_str());
+
+            // Verifying the chain is not enough on its own: without this the
+            // relay could present any certificate a trusted CA ever issued,
+            // for any name. SSL_set1_host binds the check to the host we asked
+            // for.
             if (SSL_set1_host(ssl, host.c_str()) != 1)
                 return error("Nostr: failed to set TLS hostname for %s", host.c_str());
+
             if (SSL_connect(ssl) != 1)
+            {
+                long nVerify = SSL_get_verify_result(ssl);
+                if (nVerify != X509_V_OK)
+                    return error("Nostr: certificate for %s rejected: %s",
+                                 host.c_str(), X509_verify_cert_error_string(nVerify));
                 return error("Nostr: TLS handshake with %s failed", host.c_str());
-            long nVerify = SSL_get_verify_result(ssl);
-            if (nVerify != X509_V_OK)
-                return error("Nostr: TLS certificate verification failed for %s: %s",
-                             host.c_str(), X509_verify_cert_error_string(nVerify));
+            }
         }
 
         // WebSocket handshake (HTTP Upgrade)
@@ -1017,9 +1065,14 @@ static void HandlePoolAnnouncement(const json& ev)
 
 // Resolve a `.btf` address via a relay: fetch the descriptor published by that
 // address's key and verify it self-certifies under the decoded pubkey.
+// fExchangeOk reports whether the relay actually finished the conversation
+// (an EOSE arrived) as opposed to the socket dying mid-read. The caller pools
+// this socket for reuse, and only a completed exchange leaves it in a state
+// the next caller can trust.
 static bool ResolveDescriptor(CWebSocket& ws, void* ctx, const string& btfAddr,
-                              btf::Descriptor& out)
+                              btf::Descriptor& out, bool& fExchangeOk)
 {
+    fExchangeOk = false;
     unsigned char pk[32];
     if (!btf::ParseAddress(btfAddr, pk))
         return false;
@@ -1031,26 +1084,42 @@ static bool ResolveDescriptor(CWebSocket& ws, void* ctx, const string& btfAddr,
     json req = json::array({ "REQ", "btf-resolve", filter });
     if (!ws.SendText(req.dump()))
         return false;
+    bool fFound = false;
     for (;;)
     {
         string msg;
         if (!ws.RecvText(msg))
-            break;
+            return fFound;  // socket died mid-exchange; fExchangeOk stays false
         json j;
         try { j = json::parse(msg); } catch (...) { continue; }
         if (!j.is_array() || j.empty() || !j[0].is_string()) continue;
         string t = j[0].get<string>();
+        // Every relay message names the subscription it belongs to. This socket
+        // is pooled and reused, so a message left over from an earlier exchange
+        // is the ordinary case here, not an exotic one -- and an unmatched EOSE
+        // ends this query before it has begun, which is indistinguishable from
+        // "that descriptor does not exist". Check the id.
+        if (j.size() >= 2 && j[1].is_string() && j[1].get<string>() != "btf-resolve")
+            continue;
         if (t == "EVENT" && j.size() >= 3)
         {
             const json& ev = j[2];
-            if (ev.contains("content") &&
+            if (!fFound && ev.contains("content") &&
                 btf::VerifyDescriptor(ctx, ev["content"].get<string>(), pk, out))
-                return true;
+                fFound = true;
+            // Deliberately keep reading to EOSE rather than returning here.
+            // Returning early leaves the rest of the relay's answer queued on a
+            // socket that goes straight back into the pool, and the next caller
+            // reads our leftovers as its own -- one message out of step, for
+            // the life of the process.
         }
         else if (t == "EOSE")
+        {
+            fExchangeOk = true;  // relay said "that is all": socket is clean
             break;
+        }
     }
-    return false;
+    return fFound;
 }
 
 // Resolve a `.btf` address into its rendezvous coordinates by querying the
@@ -1069,12 +1138,22 @@ bool BtfResolve(const std::string& btfAddr, std::string& meetingHostPort,
             if (!lease.Connected())
                 continue;
             btf::Descriptor d;
-            if (!ResolveDescriptor(lease.Ws(), g_nostrKey.ctx, btfAddr, d))
+            bool fExchangeOk = false;
+            if (!ResolveDescriptor(lease.Ws(), g_nostrKey.ctx, btfAddr, d, fExchangeOk))
             {
-                lease.fOk = true; // exchange completed, just no match
+                // Only keep the pooled socket if the relay actually finished
+                // the conversation. This used to say "exchange completed, just
+                // no match" on every failure -- including a dead socket -- so
+                // ~CRelayLease never closed it and fConnected was never
+                // cleared. A relay connection that died was then pinned in the
+                // pool, reported healthy, and reused for every later lookup,
+                // which is why "no Nostr descriptor found" persisted for a
+                // descriptor that was demonstrably published, and why only a
+                // restart cleared it.
+                lease.fOk = fExchangeOk;
                 continue;
             }
-            lease.fOk = true;
+            lease.fOk = fExchangeOk;
             if (d.meeting_node.empty() || d.meeting_node == "rendezvous-pending")
                 continue; // descriptor predates the owner's relay config
             if (!HexDecode(d.enc, enc_pub, 32))
@@ -1404,7 +1483,7 @@ void ThreadBtfPoolAnnouncer(void*)
     LogPrint("pool", "ThreadBtfPoolAnnouncer started\n");
     while (!fShutdown)
     {
-        if (nMineMode == MINE_OPERATOR && gPoolRunning)
+        if (nMineMode == MINE_OPERATOR && gPoolRunning && !fPoolNoAnnounce)
         {
             BtfPoolAnnouncement ann;
             ann.btfAddress = BtfLocalAddress();
@@ -1736,14 +1815,17 @@ void ThreadNostrSeed(void* parg)
             PublishDescriptor(ws, key);
             Sleep(700); // let the relay store the replaceable event
             btf::Descriptor d;
-            if (ResolveDescriptor(ws, key.ctx, key.BtfAddress(), d))
+            bool fExchangeOk = false;
+            if (ResolveDescriptor(ws, key.ctx, key.BtfAddress(), d, fExchangeOk))
             {
                 LogPrint("nostr", "Nostr: .btf self-resolve OK via %s (meeting_node=%s, enc=%s...)\n",
                        pszNostrRelays[i], d.meeting_node.c_str(), d.enc.substr(0, 16).c_str());
-                lease.fOk = true;
+                lease.fOk = fExchangeOk;
                 break;
             }
-            lease.fOk = true;
+            // Same rule as BtfResolve: a socket only goes back in the pool if
+            // the relay finished the conversation on it.
+            lease.fOk = fExchangeOk;
         }
         CATCH_PRINT_EXCEPTION("btf self-test")
     }
@@ -1775,7 +1857,7 @@ void ThreadNostrSeed(void* parg)
         }
         CATCH_PRINT_EXCEPTION("ConnectDiscoveredBtfPeers")
 
-        if (nMineMode == MINE_OPERATOR && gPoolRunning)
+        if (nMineMode == MINE_OPERATOR && gPoolRunning && !fPoolNoAnnounce)
         {
             BtfPoolAnnouncement ann;
             ann.btfAddress = BtfLocalAddress();
diff --git a/src/nostr.h b/src/nostr.h
index b5eb5e3..827b2f3 100644
--- a/src/nostr.h
+++ b/src/nostr.h
@@ -43,6 +43,14 @@ void BtfSetActiveRelay(const std::string& relay);
 // If set (via /announcerelay=host:port), this node announces that relay on
 // Nostr so other nodes discover it automatically -- no manual seed-list edit.
 extern std::string strBtfAnnounceRelay;
+// True when /rvrelay pinned the meeting relay list: BtfAllRelays then returns
+// ONLY vBtfMeetingRelays, never Nostr-discovered volunteer relays. Without
+// this, a pool that pins one public relay still spawns an accept thread per
+// discovered relay, and each thread's optimistic BtfSetActiveRelay makes the
+// published descriptor flap to relays the pool may not be reachable at.
+extern bool fBtfRelayPinned;
+// Basic sanity check on a "host:port" relay address (numeric port 1..65535).
+bool LooksLikeRelay(const std::string& r);
 // Every relay to try: curated seeds + relays discovered from Nostr announcements.
 std::vector<std::string> BtfAllRelays();
 
diff --git a/src/rpc.cpp b/src/rpc.cpp
index 813f1d1..8af2fbe 100644
--- a/src/rpc.cpp
+++ b/src/rpc.cpp
@@ -6,8 +6,8 @@
 // Architecture:
 //   PoolEventLoop  -- single thread, owns all miner fds, all job/share/payout
 //                     state. No locks needed on any of that data.
-//   AcceptOneFn    -- one thread per relay. Blocks on RvServiceRegister +
-//                     BtfServiceWrap, pushes finished socket to gReadyQueue.
+//   AcceptOneFn    -- one thread per relay. Registers, waits to be paired,
+//                     wraps the tunnel, pushes finished socket to gReadyQueue.
 //   AcceptLoopFn   -- spawns AcceptOneFn threads, re-polls relay list every
 //                     60s so dynamically discovered relays get picked up.
 //
@@ -143,6 +143,75 @@ static bool RebuildJob()
             return false;
         }
 
+        // Don't issue jobs while we are behind the network: mining against a
+        // stale tip produces blocks the network will orphan, and payout
+        // entries that can never be paid (their coinbases never exist on the
+        // main chain). Require at least one peer, and require that no peer
+        // claims a longer chain than ours.
+        if (vNodes.empty()) {
+            LogPrint("pool", "RebuildJob: no peers yet -- not issuing jobs\n");
+            return false;
+        }
+        // This used to compare the tip's timestamp against 30 minutes, which
+        // was wrong in both directions and cost real money.
+        //
+        // It cannot tell "we are not synced" from "the network is slow". A
+        // pool mining its own fork keeps its tip timestamp fresh forever, so
+        // the check passed for the whole of heights 3966-4085 -- 120
+        // consecutive blocks, every one of them orphaned, 5890.50 BTF of
+        // payouts voided. Then, once the pool stopped finding blocks, the
+        // same check refused to issue jobs against a tip that was perfectly
+        // valid and was the network's own best, and the pool -- roughly 90%
+        // of the hashrate -- could not restart the chain it was the majority
+        // of. Stale tip, so no jobs; no jobs, so the tip stays stale.
+        //
+        // The height peers announce in their version message answers the
+        // question the age check was only guessing at. Median, so one peer
+        // claiming an absurd height cannot stall us, and one block of slack
+        // to match WarnIfBehind, because somebody is always mid-relay. A
+        // peer that predates the announcement reports -1 and is ignored; if
+        // nobody has told us anything we mine our best chain, which is what
+        // the node would do without a pool attached.
+        int nPeerHeight = GetPeerMedianHeight();
+        if (nPeerHeight >= 0 && nBestHeight < nPeerHeight - 1) {
+            LogPrint("pool", "RebuildJob: %d blocks behind the network "
+                             "(height %d, peers report %d) -- not issuing jobs\n",
+                     nPeerHeight - nBestHeight, nBestHeight, nPeerHeight);
+            return false;
+        }
+
+        // The comparison above is blind in the one case that matters most.
+        //
+        // When the node goes deaf -- peers still in vNodes, nothing arriving --
+        // no peer announces anything, GetPeerMedianHeight() returns -1, and the
+        // fallback ("nobody has told us anything, so mine our best chain") let
+        // the pool build a private fork for as long as the deafness lasted.
+        // That fallback is right for a node that has simply not been told yet
+        // and wrong for a node that has stopped being able to hear, and a
+        // height nobody sent cannot tell those apart. Time can.
+        //
+        // Deliberately not behind a debug category, and deliberately not a
+        // silent refusal: an operator whose pool has stopped issuing jobs needs
+        // the reason in the log. /poolmineblind is the escape hatch for a node
+        // that really is alone -- without one, a genuinely isolated pool that is
+        // the majority of the hashrate could never restart its own chain, which
+        // is the deadlock the tip-age check used to cause.
+        if (nPeerHeight < 0 && !fPoolMineBlind) {
+            int64 nAge = GetPeerHeightAgeSecs();
+            if (nAge >= BTF_NO_PEER_HEIGHT_MAX_SECS) {
+                static int64 nLastSaid = 0;
+                if (GetTime() - nLastSaid > 60) {
+                    nLastSaid = GetTime();
+                    printf("RebuildJob: no peer has reported a height for %d minutes "
+                           "-- not issuing jobs (our height %d, %d peers connected). "
+                           "This node is deaf; mining now would fork it. "
+                           "Pass /poolmineblind to override.\n",
+                           (int)(nAge / 60), nBestHeight, (int)vNodes.size());
+                }
+                return false;
+            }
+        }
+
         CBlockIndex* pindexPrev = pindexBest;
         unsigned int nBits = GetNextWorkRequired(pindexPrev);
 
@@ -194,7 +263,15 @@ static bool RebuildJob()
                 vector<char> vfAlreadyAdded(mapTransactions.size());
                 bool fFoundSomething = true;
                 unsigned int sz = 0;
-                while (fFoundSomething && sz < MAX_SIZE / 2)
+                // The cap is MAX_BLOCK_SIZE/2, not MAX_SIZE/2. MAX_SIZE is the
+                // 32 MB serialisation ceiling, so half of it is 16 MB -- this
+                // builder would happily assemble a template that its own
+                // CheckBlock() rejects at the 1 MB consensus cap. This is the
+                // pool's job builder, so a block over the cap is not one
+                // wasted solve, it is every miner on the pool working a
+                // template the network will reject. The inner break bounds the
+                // overshoot to a single transaction within a pass.
+                while (fFoundSomething && sz < MAX_BLOCK_SIZE / 2)
                 {
                     fFoundSomething = false;
                     unsigned int n = 0;
@@ -214,6 +291,7 @@ static bool RebuildJob()
                         sz += ::GetSerializeSize(tx, SER_NETWORK);
                         vfAlreadyAdded[n] = true;
                         fFoundSomething = true;
+                        if (sz > MAX_BLOCK_SIZE / 2) break;
                     }
                 }
             }
@@ -251,14 +329,34 @@ static bool RebuildJob()
 // Payouts -- event loop thread only
 // ---------------------------------------------------------------------------
 struct PendingPayout {
-    std::string                  id;
-    int                          blockHeight;
-    int                          matureAtHeight;
+    // The block that funds this payout, identified by hash and not by height
+    // alone. A reorg replaces the block at a height without changing the
+    // height, so a height-keyed obligation outlives the coinbase that was
+    // supposed to pay it: a 280-block reorg once left ~14.4k BTF of debt
+    // owed against blocks that no longer existed, which then drained the
+    // wallet paying fork-era miners out of real-chain coin.
+    //
+    // Upstream keys these on the string "block-<height>". That is the same
+    // bug this fork already paid for, and height keying additionally lets
+    // FindRecordedPoolPayout match the *previous* round's transaction after a
+    // reorg and silently skip a miner, so their `id` is deliberately dropped.
+    int                          blockHeight = 0;
+    // Must be explicitly zeroed: uint256's default constructor is empty
+    // (uint256.h:514), so leaving this unassigned gives every ledger entry
+    // loaded from an older file a garbage hash, which then matches no block
+    // and gets voided as "orphaned". That mistake voided a live payout.
+    uint256                      blockHash = 0;  // zero = entry predates hash keying
+    int                          matureAtHeight = 0;
     std::map<std::string, int64> amounts; // address -> satoshis
+    // From upstream: which recipients already have a transaction. This is what
+    // lets an entry stay on disk until every address in `amounts` is paid,
+    // instead of being erased the moment the batch is handed off.
     std::map<std::string, std::string> paidTxids; // address -> txid
-    int64                        nextAttempt;
-
-    PendingPayout() : blockHeight(0), matureAtHeight(0), nextAttempt(0) {}
+    int                          retries = 0;    // exec-thread only: SendMoney attempts so far
+    int                          deferrals = 0;  // exec-thread only: waits for spendable coin
+    // Upstream's `nextAttempt` is this field under another name; ours is kept
+    // so the retry/deferral policy above stays coherent with it.
+    int64                        retryAfter = 0; // exec-thread only: unix time, 0 = ready now
 };
 static std::vector<PendingPayout> gPendingPayouts;
 static std::mutex                 gPayoutLedgerMutex;
@@ -304,9 +402,25 @@ static std::string PoolRoundsFilePath()
     return GetAppDir() + "/pool_rounds.json";
 }
 
-static std::string PayoutIdForBlock(int blockHeight)
+// Identity of a payout round. Used as the pool-round proof id and, more
+// importantly, as the `pool_payout_id` written into wallet transaction
+// metadata and matched by FindRecordedPoolPayout().
+//
+// Derived from the block HASH, not from its height alone. Upstream uses
+// "block-<height>", which names two different blocks identically across a
+// reorg -- and because this id is what the crash-recovery probe matches on, a
+// height-keyed id lets that probe find the *previous* round's transaction and
+// conclude a miner has already been paid when they have not. The height stays
+// in the string for readability only.
+//
+// A zero hash means the entry predates hash keying; those keep the old form so
+// anything already recorded against them still matches.
+static std::string PayoutIdForBlock(int blockHeight, const uint256& blockHash)
 {
-    return strprintf("block-%d", blockHeight);
+    if (blockHash == 0)
+        return strprintf("block-%d", blockHeight);
+    return strprintf("block-%d-%s", blockHeight,
+                     blockHash.ToString().substr(0, 16).c_str());
 }
 
 static bool PayoutFullyPaid(const PendingPayout& pp)
@@ -317,15 +431,22 @@ static bool PayoutFullyPaid(const PendingPayout& pp)
     return true;
 }
 
-static void SavePendingPayoutsLocked()
+// Serialise the ledger. Caller must hold gPayoutLedgerMutex.
+//
+// Split from the file write so the payout thread can hold the mutex just long
+// enough to read the structure and then do the I/O with it released. Upstream
+// writes the file inside the per-recipient loop with gPayoutLedgerMutex held,
+// while the event loop's FlushMaturePayouts blocks on that same mutex -- one
+// slow fsync per recipient, on the thread the miners' I/O shares.
+static std::string SerializePendingPayoutsLocked()
 {
     nlohmann::json arr = nlohmann::json::array();
     for (const auto& pp : gPendingPayouts) {
         nlohmann::json obj;
-        obj["id"] = pp.id;
-        obj["blockHeight"] = pp.blockHeight;
+        obj["blockHeight"]    = pp.blockHeight;
+        obj["blockHash"]      = pp.blockHash.ToString();
         obj["matureAtHeight"] = pp.matureAtHeight;
-        obj["nextAttempt"] = pp.nextAttempt;
+        obj["retryAfter"]     = pp.retryAfter;
         nlohmann::json amounts = nlohmann::json::object();
         for (const auto& kv : pp.amounts)
             amounts[kv.first] = kv.second;
@@ -336,24 +457,38 @@ static void SavePendingPayoutsLocked()
         obj["paidTxids"] = paid;
         arr.push_back(obj);
     }
+    return arr.dump(2);
+}
+
+// Write the serialised ledger. Holds no lock; safe to call with the mutex
+// released. Atomic tmp+rename so a crash mid-write cannot truncate the record
+// of who is still owed money.
+static void WritePendingPayoutsFile(const std::string& s)
+{
     std::string path = PayoutFilePath();
     std::string tmp = path + ".tmp";
     FILE* f = fopen(tmp.c_str(), "w");
-    if (f) {
-        std::string s = arr.dump(2);
-        fwrite(s.c_str(), 1, s.size(), f);
-        if (fclose(f) != 0) {
-            LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
-            return;
-        }
-#ifdef _WIN32
-        remove(path.c_str());
-#endif
-        if (rename(tmp.c_str(), path.c_str()) != 0)
-            LogPrint("payout", "[payout] WARNING: could not replace %s\n", path.c_str());
-    } else {
+    if (!f) {
         LogPrint("payout", "[payout] WARNING: could not write %s\n", tmp.c_str());
+        return;
+    }
+    fwrite(s.c_str(), 1, s.size(), f);
+    if (fclose(f) != 0) {
+        LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
+        return;
     }
+#ifdef _WIN32
+    remove(path.c_str());
+#endif
+    if (rename(tmp.c_str(), path.c_str()) != 0)
+        LogPrint("payout", "[payout] WARNING: could not replace %s\n", path.c_str());
+}
+
+// Convenience for the cold paths (startup, queueing) where holding the mutex
+// across the write costs nothing. Caller must hold gPayoutLedgerMutex.
+static void SavePendingPayoutsLocked()
+{
+    WritePendingPayoutsFile(SerializePendingPayoutsLocked());
 }
 
 static void LoadPendingPayouts()
@@ -372,17 +507,27 @@ static void LoadPendingPayouts()
         std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
         for (const auto& obj : arr) {
             PendingPayout pp;
-            if (obj.contains("blockHeight"))
-                pp.blockHeight = obj["blockHeight"].get<int>();
             pp.matureAtHeight = obj["matureAtHeight"].get<int>();
-            if (obj.contains("id") && obj["id"].is_string())
-                pp.id = obj["id"].get<std::string>();
-            if (pp.blockHeight == 0)
+            // Entries written before payouts were keyed by hash carry neither
+            // field. Leave blockHash zero and they are grandfathered past the
+            // orphan check rather than voided on a guess.
+            if (obj.contains("blockHash") && obj["blockHash"].is_string())
+                pp.blockHash.SetHex(obj["blockHash"].get<std::string>());
+            if (obj.contains("blockHeight") && obj["blockHeight"].is_number())
+                pp.blockHeight = obj["blockHeight"].get<int>();
+            // Upstream's tolerance for an entry with no usable height, kept
+            // because it costs nothing and an entry that cannot name its block
+            // is worse than one derived from its maturity. COINBASE_MATURITY
+            // and not COINBASE_SPENDABLE_DEPTH: this reverses whatever the
+            // writer of *that* file used, and only files old enough to lack
+            // blockHeight are affected -- they were written when maturity was
+            // still COINBASE_MATURITY.
+            if (pp.blockHeight == 0 && pp.matureAtHeight > COINBASE_MATURITY)
                 pp.blockHeight = pp.matureAtHeight - COINBASE_MATURITY;
-            if (pp.id.empty())
-                pp.id = PayoutIdForBlock(pp.blockHeight);
-            if (obj.contains("nextAttempt"))
-                pp.nextAttempt = obj["nextAttempt"].get<int64>();
+            // Absent in every file written before this merge; default 0 means
+            // "ready now", which is the right answer for a restored entry.
+            if (obj.contains("retryAfter") && obj["retryAfter"].is_number())
+                pp.retryAfter = obj["retryAfter"].get<int64>();
             for (auto it = obj["amounts"].begin(); it != obj["amounts"].end(); ++it)
                 pp.amounts[it.key()] = it.value().get<int64>();
             if (obj.contains("paidTxids") && obj["paidTxids"].is_object())
@@ -398,6 +543,133 @@ static void LoadPendingPayouts()
     }
 }
 
+// A payment in flight: one record per (payout entry, address) pair, which is
+// the granularity SendMoney works at and therefore the granularity at which a
+// payment can be half-done when the process dies.
+//
+// This list is persisted. It used to be a memory-only queue, and matured
+// entries were erased from pending_payouts.json *before* being handed to it,
+// so any restart in between lost those payments with no record that anyone
+// was owed anything: a container restart on 2026-07-30 silently dropped
+// ~1,156 BTF that way. Writing the records before removing the ledger entry,
+// and reconciling against the wallet on startup, is what makes a restart
+// survivable.
+struct PayingRecord {
+    int         blockHeight    = 0;
+    uint256     blockHash      = 0; // zero = predates hash keying, see PendingPayout
+    int         matureAtHeight = 0;
+    std::string address;
+    int64       amount     = 0;
+    int         retries    = 0;
+    int         deferrals  = 0;
+    int64       retryAfter = 0;
+    // Ask the wallet whether this payment already went out, once, before the
+    // first send attempt. Upstream asks on every attempt: FindRecordedPoolPayout
+    // is a linear scan of mapWallet under cs_mapWallet, per recipient, so with
+    // 2000 rotating payout addresses and a retry budget of 1440 that is a
+    // scan per address per minute for a day. The question it answers -- "did a
+    // previous process send this before it died?" -- can only change across a
+    // restart, and every restart re-sets this flag (ReconcilePayouts), so
+    // asking once per record is the whole of the answer.
+    //
+    // Not persisted: a record read back from disk is by definition a restart.
+    bool        fProbeWallet = true;
+};
+static std::vector<PayingRecord> gPaying; // guarded by gPayoutExecMutex
+static std::mutex                gPayoutExecMutex;
+static std::atomic<bool>         gPayoutThreadRunning{false};
+
+static std::string PayingFilePath()
+{
+    return GetAppDir() + "/paying_payouts.json";
+}
+
+// Caller must hold gPayoutExecMutex.
+static void SavePayingLocked()
+{
+    nlohmann::json arr = nlohmann::json::array();
+    for (const auto& r : gPaying) {
+        nlohmann::json obj;
+        obj["blockHeight"]    = r.blockHeight;
+        obj["blockHash"]      = r.blockHash.ToString();
+        obj["matureAtHeight"] = r.matureAtHeight;
+        obj["address"]        = r.address;
+        obj["amount"]         = r.amount;
+        obj["retries"]        = r.retries;
+        obj["deferrals"]      = r.deferrals;
+        arr.push_back(obj);
+    }
+    std::string path = PayingFilePath();
+    // Write to a temporary file and rename, so a crash mid-write cannot leave
+    // a truncated list of who is still owed money.
+    std::string tmp = path + ".tmp";
+    FILE* f = fopen(tmp.c_str(), "w");
+    if (!f) {
+        LogPrint("payout", "[payout] WARNING: could not write %s\n", tmp.c_str());
+        return;
+    }
+    std::string s = arr.dump(2);
+    fwrite(s.c_str(), 1, s.size(), f);
+    // fclose() is where buffered data actually reaches the OS, so a failure
+    // here means the .tmp is short -- renaming it over the real file would
+    // destroy the good copy. Upstream's check, taken because a truncated
+    // list of who is owed money is exactly what this function exists to
+    // prevent. rename() on Windows will not replace an existing file, hence
+    // the remove() first.
+    if (fclose(f) != 0) {
+        LogPrint("payout", "[payout] WARNING: could not close %s\n", tmp.c_str());
+        return;
+    }
+#ifdef _WIN32
+    remove(path.c_str());
+#endif
+    if (rename(tmp.c_str(), path.c_str()) != 0)
+        LogPrint("payout", "[payout] WARNING: could not rename %s -> %s\n",
+                 tmp.c_str(), path.c_str());
+}
+
+static void LoadPaying()
+{
+    std::string path = PayingFilePath();
+    FILE* f = fopen(path.c_str(), "r");
+    if (!f) return;
+    fseek(f, 0, SEEK_END);
+    long sz = ftell(f);
+    fseek(f, 0, SEEK_SET);
+    std::string s(sz, '\0');
+    fread(&s[0], 1, sz, f);
+    fclose(f);
+    try {
+        nlohmann::json arr = nlohmann::json::parse(s);
+        for (const auto& obj : arr) {
+            PayingRecord r;
+            r.address        = obj["address"].get<std::string>();
+            r.amount         = obj["amount"].get<int64>();
+            r.matureAtHeight = obj["matureAtHeight"].get<int>();
+            if (obj.contains("blockHash") && obj["blockHash"].is_string())
+                r.blockHash.SetHex(obj["blockHash"].get<std::string>());
+            if (obj.contains("blockHeight") && obj["blockHeight"].is_number())
+                r.blockHeight = obj["blockHeight"].get<int>();
+            if (obj.contains("retries") && obj["retries"].is_number())
+                r.retries = obj["retries"].get<int>();
+            if (obj.contains("deferrals") && obj["deferrals"].is_number())
+                r.deferrals = obj["deferrals"].get<int>();
+            gPaying.push_back(r);
+        }
+        LogPrint("payout", "[payout] loaded %zu in-flight payment(s) from disk\n",
+                 gPaying.size());
+    } catch (const std::exception& e) {
+        LogPrint("payout", "[payout] WARNING: failed to parse %s: %s\n",
+                 path.c_str(), e.what());
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Pool round proofs (upstream cbdd06d). Disjoint from the in-flight ledger
+// above -- this is the operator's published record of how a round was split,
+// not an obligation to pay. Both sides added code at this offset; both are
+// kept.
+// ---------------------------------------------------------------------------
 static nlohmann::json PoolRoundToJson(const PoolRoundProof& r)
 {
     nlohmann::json j;
@@ -529,6 +801,88 @@ static void LoadPoolRounds()
     }
 }
 
+// Is the block that funds this payout still on the main chain?
+//
+// A zero hash means the entry was written before payouts recorded one, so
+// there is nothing to check and we assume it is good -- voiding those would
+// mean refusing to pay miners on the strength of a missing field.
+static bool PayoutBlockStillOnChain(const uint256& blockHash)
+{
+    if (blockHash == 0)
+        return true;
+    CRITICAL_BLOCK(cs_main)
+    {
+        std::map<uint256, CBlockIndex*>::iterator mi = mapBlockIndex.find(blockHash);
+        if (mi == mapBlockIndex.end() || mi->second == NULL)
+            return false;
+        return mi->second->IsInMainChain();
+    }
+    return false;
+}
+
+static std::string PayoutComment(int blockHeight)
+{
+    return strprintf("Pool payout height %d", blockHeight);
+}
+
+// Startup reconciliation.
+//
+// This used to be the crash-recovery mechanism: it scanned the wallet with
+// WalletAlreadyPaid() and then dropped ledger entries that had already been
+// exploded into in-flight records. Neither job is right any more.
+//
+// The ledger is now authoritative and an entry survives until every recipient
+// has a txid recorded against it (upstream cbdd06d), so dropping ledger
+// entries here would reintroduce exactly the loss this merge is adopting that
+// model to prevent. And the wallet scan is now FindRecordedPoolPayout(), done
+// once per record on its first attempt, which is the same question asked in
+// the one place that can act on the answer. Running both would be two
+// authorities for the same debt.
+//
+// What is left is the useful part: the in-flight list restored from disk may
+// contain records the ledger already shows as paid (we died between the send
+// and the in-flight file being rewritten). The ledger wins.
+static void ReconcilePayouts()
+{
+    std::lock_guard<std::mutex> exec(gPayoutExecMutex);
+    std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
+
+    size_t settled = 0;
+    int64  settledAmount = 0;
+    for (auto it = gPaying.begin(); it != gPaying.end(); ) {
+        bool paid = false;
+        for (const PendingPayout& pp : gPendingPayouts)
+            if (pp.blockHash == it->blockHash && pp.paidTxids.count(it->address)) {
+                paid = true;
+                break;
+            }
+        if (paid) {
+            settledAmount += it->amount;
+            settled++;
+            it = gPaying.erase(it);
+        } else {
+            // Every restored record gets one wallet probe before it is allowed
+            // to send: this is precisely the window where the wallet may hold
+            // a transaction the ledger has not recorded yet.
+            it->fProbeWallet = true;
+            ++it;
+        }
+    }
+    if (settled) {
+        LogPrint("payout", "[payout] %zu in-flight payment(s) totalling %s are"
+                 " already recorded paid in the ledger -- not resending\n",
+                 settled, FormatMoney(settledAmount).c_str());
+    }
+    SavePayingLocked();
+
+    if (!gPaying.empty()) {
+        int64 owed = 0;
+        for (const auto& r : gPaying) owed += r.amount;
+        LogPrint("payout", "[payout] resuming %zu in-flight payment(s) totalling %s\n",
+                 gPaying.size(), FormatMoney(owed).c_str());
+    }
+}
+
 static void RecordPoolRound(const PoolRoundProof& round)
 {
     std::lock_guard<std::mutex> lk(gPoolRoundsMutex);
@@ -559,13 +913,13 @@ static void MarkPoolRoundPaid(const std::string& id,
     }
 }
 
-// Payouts ready to execute are moved here under gPayoutExecMutex.
-// A dedicated thread drains this list so SendMoney (which takes cs_main)
-// never runs on the event loop thread and can't stall miner I/O.
-static std::vector<PendingPayout> gPayoutExecQueue;
-static std::mutex                 gPayoutExecMutex;
-static std::atomic<bool>          gPayoutThreadRunning{false};
-
+// Upstream's gPayoutExecQueue/gPayoutExecMutex/gPayoutThreadRunning are
+// declared above with gPaying: the in-flight list IS the exec queue in this
+// tree, at per-recipient rather than per-round granularity, so a second queue
+// would be a second answer to "who is owed money". Only the dedupe set is new.
+//
+// Ids of rounds currently exploded into gPaying, so a flush cannot queue the
+// same round twice. Guarded by gPayoutExecMutex.
 static std::set<std::string>      gQueuedPayouts;
 
 static bool FindRecordedPoolPayout(const std::string& id,
@@ -595,8 +949,13 @@ static bool FindRecordedPoolPayout(const std::string& id,
     return false;
 }
 
+// blockHash stays a uint256 and not upstream's display string: it is the key
+// this fork's payout ledger is built on, and a key that has been through
+// ToString() is a key that can be compared wrong. It is converted to text only
+// where the round proof needs text. The other three arguments are upstream's,
+// carried for the round-proof data.
 static void QueuePayouts(int blockHeight,
-                         const std::string& blockHash,
+                         const uint256& blockHash,
                          const std::string& coinbaseTxid,
                          int64 coinbaseValue,
                          const std::string& foundBy,
@@ -604,11 +963,11 @@ static void QueuePayouts(int blockHeight,
                          uint64 total)
 {
     PoolRoundProof round;
-    round.id = PayoutIdForBlock(blockHeight);
+    round.id = PayoutIdForBlock(blockHeight, blockHash);
     round.blockHeight = blockHeight;
-    round.matureAtHeight = blockHeight + COINBASE_MATURITY;
+    round.matureAtHeight = blockHeight + COINBASE_SPENDABLE_DEPTH;
     round.createdAt = GetTime();
-    round.blockHash = blockHash;
+    round.blockHash = blockHash.ToString();
     round.coinbaseTxid = coinbaseTxid;
     round.coinbaseValue = coinbaseValue;
     round.foundBy = foundBy;
@@ -639,9 +998,21 @@ static void QueuePayouts(int blockHeight,
     round.operatorReward = operatorCut;
 
     PendingPayout pp;
-    pp.id = round.id;
     pp.blockHeight = blockHeight;
-    pp.matureAtHeight = blockHeight + COINBASE_MATURITY;
+    pp.blockHash   = blockHash;
+    // COINBASE_SPENDABLE_DEPTH, not COINBASE_MATURITY. Paying at depth 100
+    // means the block's own coinbase is still 20 blocks short of spendable, so
+    // the payment has to come out of some *other* mature coin -- the pool runs
+    // a permanent ~19-block float and every payout fails until unrelated coin
+    // matures. The earlier "96% of 934 payments went through at depth 100"
+    // measurement that justified the shorter wait was taken while this node was
+    // alone on a private fork paying itself, so it says nothing about a pool
+    // competing on the real chain. Waiting the extra 20 blocks makes each
+    // payout funded by construction, and puts the maturity gate past the
+    // reorg depth that orphaned 280 blocks of obligations. Upstream uses
+    // COINBASE_MATURITY here; this is a considered disagreement, not an
+    // oversight -- see the merge commit message.
+    pp.matureAtHeight = blockHeight + COINBASE_SPENDABLE_DEPTH;
 
     int skipped = 0;
     int64 burned = 0; // amount owed to miners with bad/empty addresses
@@ -689,37 +1060,222 @@ static void QueuePayouts(int blockHeight,
                         : "");
 }
 
-// Called from event loop: copy matured entries to the exec queue (fast).
-// The ledger entry stays on disk until every recipient has a txid recorded.
-// On restart, FindRecordedPoolPayout() checks wallet metadata before sending,
-// so a crash after SendMoney but before the ledger update does not double-pay.
+// Called from the event loop: explode matured ledger entries into per-recipient
+// in-flight records (fast; no wallet or disk work beyond one small write).
+//
+// The ledger entry SURVIVES here. That is upstream's model and it is the
+// crash-safe one: this fork used to erase the entry as soon as its payments
+// were handed off, so a death in that window left the debt described by
+// nothing at all -- a container restart on 2026-07-30 silently dropped
+// ~1,156 BTF exactly that way. An entry is removed only once every recipient
+// in it has a txid recorded (PayoutFullyPaid), which the payout thread does.
+//
+// gPaying is kept on top of that as the in-flight working set: it carries the
+// per-recipient retry/deferral state that a per-round `nextAttempt` cannot
+// express, and it is what the payout thread iterates. It is a cache of work
+// derived from the ledger, never an independent record of debt -- if it were
+// lost entirely the ledger would rebuild it on the next flush.
 static void FlushMaturePayouts()
 {
+    // Which funding blocks are still on the main chain? Asked with no payout
+    // lock held: PayoutBlockStillOnChain takes cs_main, and cs_main is held by
+    // ProcessBlock and SendMoney for long stretches. Holding the ledger mutex
+    // across it would let the event loop park the payout thread behind a chain
+    // lock it has no interest in. (It is not a deadlock either way -- nothing
+    // takes the ledger mutex while holding cs_main -- but it is exactly the
+    // kind of stall this merge is removing from the ledger path.)
+    std::vector<uint256> orphaned;
+    {
+        std::vector<uint256> hashes;
+        {
+            std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
+            for (const PendingPayout& pp : gPendingPayouts)
+                hashes.push_back(pp.blockHash);
+        }
+        for (const uint256& h : hashes)
+            if (!PayoutBlockStillOnChain(h))
+                orphaned.push_back(h);
+    }
+
     std::vector<PendingPayout> ready;
     {
         std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
-        std::lock_guard<std::mutex> queue(gPayoutExecMutex);
+
+        // Void obligations whose funding block lost a reorg. The coin that was
+        // meant to pay them does not exist, so paying anyway spends real-chain
+        // coin the pool owes to somebody else.
+        bool voided = false;
+        for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ) {
+            if (std::find(orphaned.begin(), orphaned.end(), it->blockHash) == orphaned.end()) {
+                ++it;
+                continue;
+            }
+            int64 total = 0;
+            for (auto& kv : it->amounts) total += kv.second;
+            LogPrint("payout", "[payout] block %d (%s) was orphaned -- voiding %zu"
+                     " payment(s) totalling %s\n",
+                     it->blockHeight, it->blockHash.ToString().substr(0, 14).c_str(),
+                     it->amounts.size(), FormatMoney(total).c_str());
+            it = gPendingPayouts.erase(it);
+            voided = true;
+        }
+        if (voided) SavePendingPayoutsLocked();
+
         int64 now = GetTime();
         for (const PendingPayout& pp : gPendingPayouts) {
             if (nBestHeight < pp.matureAtHeight)
                 continue;
-            if (pp.nextAttempt > now)
+            if (pp.retryAfter > now)
                 continue;
             if (PayoutFullyPaid(pp))
                 continue;
-            if (gQueuedPayouts.count(pp.id))
-                continue;
-            LogPrint("payout", "[payout] block height %d matured -- queuing payout %s (%zu recipients)\n",
-                     pp.matureAtHeight, pp.id.c_str(), pp.amounts.size());
             ready.push_back(pp);
-            gQueuedPayouts.insert(pp.id);
         }
-        for (auto& pp : ready)
-            gPayoutExecQueue.push_back(pp);
     }
+
+    if (ready.empty())
+        return;
+
+    std::lock_guard<std::mutex> queue(gPayoutExecMutex);
+    size_t added = 0;
+    for (const PendingPayout& pp : ready) {
+        const std::string id = PayoutIdForBlock(pp.blockHeight, pp.blockHash);
+        if (gQueuedPayouts.count(id))
+            continue;   // already exploded into gPaying and still in flight
+        size_t n = 0;
+        for (const auto& kv : pp.amounts) {
+            // Upstream's per-recipient dedupe: a recipient already carrying a
+            // txid is done, even though the entry as a whole is not.
+            if (pp.paidTxids.count(kv.first))
+                continue;
+            PayingRecord r;
+            r.blockHeight    = pp.blockHeight;
+            r.blockHash      = pp.blockHash;
+            r.matureAtHeight = pp.matureAtHeight;
+            r.address        = kv.first;
+            r.amount         = kv.second;
+            gPaying.push_back(r);
+            n++;
+        }
+        gQueuedPayouts.insert(id);
+        added += n;
+        LogPrint("payout", "[payout] block height %d matured -- queuing payout %s"
+                 " (%zu of %zu recipients still owed)\n",
+                 pp.matureAtHeight, id.c_str(), n, pp.amounts.size());
+    }
+    if (added) SavePayingLocked();
+}
+
+// Identity of a payment, for finding its record again after SendMoney.
+// amounts is a map keyed by address, so (block, address) is already unique.
+static bool SamePayment(const PayingRecord& a, const PayingRecord& b)
+{
+    return a.matureAtHeight == b.matureAtHeight
+        && a.blockHash      == b.blockHash
+        && a.address        == b.address
+        && a.amount         == b.amount;
+}
+
+// Settle a payment: it is either done or abandoned, either way it stops being
+// in flight. Note this only retires the working record -- whether the miner is
+// still OWED the money is the ledger's business, and the ledger is updated
+// separately by RecordPayoutTxid().
+static void ForgetPayment(const PayingRecord& r)
+{
+    std::lock_guard<std::mutex> lk(gPayoutExecMutex);
+    for (auto it = gPaying.begin(); it != gPaying.end(); ++it)
+        if (SamePayment(*it, r)) { gPaying.erase(it); break; }
+
+    // When the last record for a round is gone the round is no longer in
+    // flight, so a later flush may explode it again if the ledger still shows
+    // recipients owed (a give-up, for instance, leaves the entry standing).
+    bool stillInFlight = false;
+    for (const auto& e : gPaying)
+        if (e.blockHash == r.blockHash) { stillInFlight = true; break; }
+    if (!stillInFlight)
+        gQueuedPayouts.erase(PayoutIdForBlock(r.blockHeight, r.blockHash));
+
+    SavePayingLocked();
+}
+
+// Persist an updated attempt count / backoff for a payment still owed.
+static void ReschedulePayment(const PayingRecord& r)
+{
+    std::lock_guard<std::mutex> lk(gPayoutExecMutex);
+    for (auto& e : gPaying)
+        if (SamePayment(e, r)) {
+            e.retries      = r.retries;
+            e.deferrals    = r.deferrals;
+            e.retryAfter   = r.retryAfter;
+            // Carry the cleared probe flag back, or every retry re-scans the
+            // whole wallet -- the cost this merge is specifically removing.
+            e.fProbeWallet = r.fProbeWallet;
+            break;
+        }
+    SavePayingLocked();
+}
+
+// Record that a recipient has been paid, in the ledger, which is the only
+// durable statement that the debt is settled.
+//
+// The file write happens with gPayoutLedgerMutex RELEASED. Upstream calls
+// SavePendingPayoutsLocked() inside the per-recipient loop with the mutex
+// held, so every recipient costs the event loop a full serialise+fsync it has
+// to wait for in FlushMaturePayouts.
+static void RecordPayoutTxid(const PayingRecord& r, const std::string& txid)
+{
+    std::string blob;
+    bool complete = false;
+    {
+        std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
+        for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ++it) {
+            if (it->blockHash != r.blockHash)
+                continue;
+            it->paidTxids[r.address] = txid;
+            it->retryAfter = 0;
+            if (PayoutFullyPaid(*it)) {
+                LogPrint("payout", "[payout] payout for block %d complete --"
+                         " removing from ledger\n", it->blockHeight);
+                gPendingPayouts.erase(it);
+                complete = true;
+            }
+            break;
+        }
+        blob = SerializePendingPayoutsLocked();
+    }
+    WritePendingPayoutsFile(blob);
+    // The round proof records a txid per address, so this is per recipient and
+    // not only on completion.
+    MarkPoolRoundPaid(PayoutIdForBlock(r.blockHeight, r.blockHash), r.address, txid);
+    if (complete)
+        LogPrint("payout", "[payout] block %d fully settled\n", r.blockHeight);
+}
+
+// Write a recipient off. Only reached after the full retry budget against a
+// block that is still on the main chain with coin available to spend, i.e. a
+// wallet fault rather than a maturity or reorg question.
+//
+// The amount is removed from the entry rather than marked paid, so the money
+// is not reported as sent. Once nothing is left owed the entry retires.
+static void ForfeitPayoutRecipient(const PayingRecord& r)
+{
+    std::string blob;
+    {
+        std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
+        for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ++it) {
+            if (it->blockHash != r.blockHash)
+                continue;
+            it->amounts.erase(r.address);
+            if (it->amounts.empty() || PayoutFullyPaid(*it))
+                gPendingPayouts.erase(it);
+            break;
+        }
+        blob = SerializePendingPayoutsLocked();
+    }
+    WritePendingPayoutsFile(blob);
 }
 
-// Payout execution thread: drains gPayoutExecQueue, calls SendMoney.
+// Payout execution thread: works through gPaying, calls SendMoney.
 // Runs independently of the event loop so slow wallet operations
 // (SendMoney takes cs_main) never stall miner I/O.
 static void PayoutThreadFn(void*)
@@ -728,103 +1284,150 @@ static void PayoutThreadFn(void*)
     LogPrint("payout", "[payout] payout thread started\n");
 
     while (!fShutdown && gPoolRunning) {
-        std::vector<PendingPayout> batch;
+        std::vector<PayingRecord> batch;
         {
             std::lock_guard<std::mutex> lk(gPayoutExecMutex);
-            batch.swap(gPayoutExecQueue);
+            int64 now = GetTime();
+            for (const auto& r : gPaying)
+                if (r.retryAfter <= now)
+                    batch.push_back(r);
         }
 
-        for (auto& ppQueued : batch) {
-            LogPrint("payout", "[payout] executing payments for block matured at %d"
-                     " (%zu miners)\n", ppQueued.matureAtHeight, ppQueued.amounts.size());
-            bool fAbortBatch = false;
-            for (auto& kv : ppQueued.amounts) {
+        for (PayingRecord r : batch) {
+            const std::string id = PayoutIdForBlock(r.blockHeight, r.blockHash);
+
+            // Re-check here and not only at maturity: a payment can sit in this
+            // list for hours across retries, and the reorg that kills its
+            // funding block can land at any point in that window. Upstream has
+            // no equivalent -- it decides once, when the entry matures.
+            if (!PayoutBlockStillOnChain(r.blockHash)) {
+                LogPrint("payout", "[payout] block %d (%s) orphaned while queued"
+                         " -- dropping %s to %s\n",
+                         r.blockHeight, r.blockHash.ToString().substr(0, 14).c_str(),
+                         FormatMoney(r.amount).c_str(), r.address.c_str());
+                ForgetPayment(r);
+                continue;
+            }
+
+            // Upstream's per-recipient dedupe, against the ledger rather than
+            // against the batch: if a txid is already recorded for this
+            // address, the money went out and nothing more is owed.
+            {
                 bool alreadyPaid = false;
                 {
                     std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
                     for (const PendingPayout& pp : gPendingPayouts)
-                        if (pp.id == ppQueued.id && pp.paidTxids.count(kv.first))
+                        if (pp.blockHash == r.blockHash && pp.paidTxids.count(r.address)) {
                             alreadyPaid = true;
+                            break;
+                        }
                 }
-                if (alreadyPaid)
+                if (alreadyPaid) {
+                    ForgetPayment(r);
                     continue;
-
-                uint160 h160;
-                if (!AddressToHash160(kv.first, h160)) {
-                    // Should not happen -- bad addresses are filtered in QueuePayouts
-                    LogPrint("payout", "[payout] SKIPPED bad address '%s'\n",
-                             kv.first.c_str());
-                    continue;
-                }
-                CScript sc;
-                sc << OP_DUP << OP_HASH160 << h160 << OP_EQUALVERIFY << OP_CHECKSIG;
-                CWalletTx wtx;
-                wtx.mapValue["comment"] = strprintf("Pool payout height %d", ppQueued.matureAtHeight);
-                wtx.mapValue["pool_payout_id"] = ppQueued.id;
-                wtx.mapValue["pool_payout_address"] = kv.first;
-                wtx.mapValue["pool_payout_amount"] = strprintf("%lld", kv.second);
-
-                std::string txid;
-                if (FindRecordedPoolPayout(ppQueued.id, kv.first, kv.second, txid))
-                {
-                    LogPrint("payout", "[payout] recovered recorded payout %s to %s"
-                             " from wallet tx %s\n",
-                             FormatMoney(kv.second).c_str(), kv.first.c_str(), txid.c_str());
-                    MarkPoolRoundPaid(ppQueued.id, kv.first, txid);
-                }
-                else if (SendMoney(sc, kv.second, wtx))
-                {
-                    txid = wtx.GetHash().GetHex();
-                    LogPrint("payout", "[payout] paid %s to %s\n",
-                              FormatMoney(kv.second).c_str(), kv.first.c_str());
-                    MarkPoolRoundPaid(ppQueued.id, kv.first, txid);
-                }
-                else
-                {
-                    LogPrint("payout", "[payout] FAILED to pay %s to %s"
-                              " (insufficient funds or wallet locked?)\n",
-                              FormatMoney(kv.second).c_str(), kv.first.c_str());
-                    std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
-                    for (PendingPayout& pp : gPendingPayouts)
-                        if (pp.id == ppQueued.id)
-                            pp.nextAttempt = GetTime() + 60;
-                    SavePendingPayoutsLocked();
-                    fAbortBatch = true;
-                    break;
                 }
+            }
 
-                {
-                    std::lock_guard<std::mutex> lk(gPayoutLedgerMutex);
-                    for (PendingPayout& pp : gPendingPayouts) {
-                        if (pp.id != ppQueued.id)
-                            continue;
-                        pp.paidTxids[kv.first] = txid;
-                        pp.nextAttempt = 0;
-                        SavePendingPayoutsLocked();
-                        break;
-                    }
+            uint160 h160;
+            if (!AddressToHash160(r.address, h160)) {
+                // Should not happen -- bad addresses are filtered in QueuePayouts
+                LogPrint("payout", "[payout] SKIPPED bad address '%s'\n",
+                         r.address.c_str());
+                ForgetPayment(r);
+                continue;
+            }
+            CScript sc;
+            sc << OP_DUP << OP_HASH160 << h160 << OP_EQUALVERIFY << OP_CHECKSIG;
+
+            // Did a previous process send this and die before recording it?
+            // Only asked once per record -- see PayingRecord::fProbeWallet.
+            if (r.fProbeWallet) {
+                std::string recovered;
+                r.fProbeWallet = false;
+                if (FindRecordedPoolPayout(id, r.address, r.amount, recovered)) {
+                    LogPrint("payout", "[payout] recovered recorded payout %s to %s"
+                             " from wallet tx %s -- not resending\n",
+                             FormatMoney(r.amount).c_str(), r.address.c_str(),
+                             recovered.c_str());
+                    RecordPayoutTxid(r, recovered);
+                    ForgetPayment(r);
+                    continue;
                 }
             }
 
-            {
-                std::lock_guard<std::mutex> ledger(gPayoutLedgerMutex);
-                for (auto it = gPendingPayouts.begin(); it != gPendingPayouts.end(); ) {
-                    if (it->id == ppQueued.id && PayoutFullyPaid(*it)) {
-                        LogPrint("payout", "[payout] payout %s complete -- removing from ledger\n",
-                                 it->id.c_str());
-                        it = gPendingPayouts.erase(it);
-                        SavePendingPayoutsLocked();
-                    } else {
-                        ++it;
-                    }
-                }
+            // Waiting for coin to mature is not a failure, so it must not
+            // consume the retry budget. Burning a retry every 60s means a
+            // payment the pool fully intends to honour can hit GIVING UP
+            // 24h later purely because the subsidy funding it had not
+            // matured yet -- the miner is then silently never paid.
+            int64 nSpendable = GetBalance();
+            if (nSpendable < r.amount) {
+                r.deferrals++;
+                r.retryAfter = GetTime() + 60;
+                // Hourly, not every minute: a dry pool would otherwise
+                // write one line per payment per minute forever.
+                if (r.deferrals == 1 || r.deferrals % 60 == 0)
+                    LogPrint("payout", "[payout] deferring %s to %s -- only %s"
+                             " spendable (waiting %d min so far)\n",
+                             FormatMoney(r.amount).c_str(), r.address.c_str(),
+                             FormatMoney(nSpendable).c_str(), r.deferrals);
+                ReschedulePayment(r);
+                continue;
             }
-            {
-                std::lock_guard<std::mutex> lk(gPayoutExecMutex);
-                gQueuedPayouts.erase(ppQueued.id);
+
+            CWalletTx wtx;
+            wtx.mapValue["comment"] = PayoutComment(r.blockHeight);
+            // Upstream's structured metadata. This is what makes the wallet
+            // probe above possible at all -- the old comment-only form could
+            // not distinguish two rounds paying the same address the same
+            // amount. Keyed by the hash-derived id, so a reorg cannot make one
+            // round's transaction answer for another's.
+            wtx.mapValue["pool_payout_id"]      = id;
+            wtx.mapValue["pool_payout_address"] = r.address;
+            wtx.mapValue["pool_payout_amount"]  = strprintf("%lld", r.amount);
+
+            if (SendMoney(sc, r.amount, wtx)) {
+                // The wallet holds the transaction before this returns, so a
+                // crash between here and the ledger write is recoverable: the
+                // probe above finds it by id+address+amount and does not
+                // resend. Ledger first, in-flight record second -- the debt is
+                // described by at least one of them at every instant.
+                RecordPayoutTxid(r, wtx.GetHash().GetHex());
+                ForgetPayment(r);
+                LogPrint("payout", "[payout] paid %s to %s (tx %s)\n",
+                         FormatMoney(r.amount).c_str(), r.address.c_str(),
+                         wtx.GetHash().ToString().substr(0, 12).c_str());
+            } else if (r.retries < 1440) {
+                // Transient failures (reorg, locked wallet) must not silently
+                // burn the payment -- retry with backoff. Insufficient funds
+                // never lands here; it defers above.
+                r.retries++;
+                r.retryAfter = GetTime() + 60;
+                ReschedulePayment(r);
+                LogPrint("payout", "[payout] FAILED to pay %s to %s"
+                         " (%s spendable at the time) -- retry %d/1440 in 60s\n",
+                         FormatMoney(r.amount).c_str(), r.address.c_str(),
+                         FormatMoney(nSpendable).c_str(), r.retries);
+            } else {
+                // Reaching here means 1440 attempts that were NOT
+                // insufficient-funds waits (those defer instead) against a
+                // block still on the main chain -- i.e. a real wallet fault,
+                // not a maturity or reorg question.
+                LogPrint("payout", "[payout] GIVING UP on %s to %s after %d"
+                         " retries -- block %d is still on-chain and %s was"
+                         " spendable, so this is a wallet fault, not maturity"
+                         " -- payment forfeited\n",
+                         FormatMoney(r.amount).c_str(), r.address.c_str(),
+                         r.retries, r.blockHeight,
+                         FormatMoney(nSpendable).c_str());
+                // Write the debt off in the ledger as well as dropping the
+                // in-flight record. Under the survives-until-fully-paid model
+                // the entry would otherwise never complete, and every later
+                // flush would explode it again -- a forfeit that silently
+                // becomes an infinite retry.
+                ForfeitPayoutRecipient(r);
+                ForgetPayment(r);
             }
-            if (fAbortBatch)
-                continue;
         }
 
         Sleep(500); // check for new work every 500ms
@@ -1044,6 +1647,45 @@ static void PushReady(btf_socket_t s)
     gReadyQueue.push_back(s);
 }
 
+// Loopback stratum listener: lets a miner running on the SAME machine reach
+// this pool over plain TCP (127.0.0.1:8334), skipping the .btf rendezvous
+// entirely. The rendezvous relay only allows one service registration per
+// pubkey, so the pool service and the node's own peer-accept fight over the
+// node identity at the relay -- loopback avoids that fight for local miners.
+static void LocalAcceptFn(void*)
+{
+    SOCKET ls = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if (ls == INVALID_SOCKET)
+        return;
+    int yes = 1;
+    setsockopt(ls, SOL_SOCKET, SO_REUSEADDR, (char*)&yes, sizeof(yes));
+    struct sockaddr_in addr;
+    memset(&addr, 0, sizeof(addr));
+    addr.sin_family = AF_INET;
+    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    addr.sin_port = htons(8334);
+    if (bind(ls, (struct sockaddr*)&addr, sizeof(addr)) != 0 || listen(ls, 16) != 0)
+    {
+        LogPrint("pool", "[pool] loopback stratum bind/listen failed on 127.0.0.1:8334\n");
+        closesocket(ls);
+        return;
+    }
+    LogPrint("pool", "[pool] loopback stratum listening on 127.0.0.1:8334\n");
+    while (!fShutdown && gPoolRunning)
+    {
+        SOCKET c = accept(ls, NULL, NULL);
+        if (c == INVALID_SOCKET)
+        {
+            if (fShutdown || !gPoolRunning)
+                break;
+            continue;
+        }
+        LogPrint("pool", "[pool] miner arrived via loopback -- pushing to event loop\n");
+        PushReady((btf_socket_t)c);
+    }
+    closesocket(ls);
+}
+
 // ---------------------------------------------------------------------------
 // I/O helpers -- event loop thread only
 // ---------------------------------------------------------------------------
@@ -1480,7 +2122,11 @@ static bool HandleLine(Miner* m, const std::string& rawLine,
         if (accepted) {
             // Snapshot height before RebuildJob() (which increments it)
             int foundHeight = gCurrentJob.height;
-            QueuePayouts(foundHeight, b.GetHash().GetHex(), b.vtx[0].GetHash().GetHex(),
+            // b is the block we submitted, untouched by ProcessBlock (which
+            // took a copy), so its hash is what the payout must be keyed on.
+            // Passed as a uint256, not hex: the ledger key must stay a real
+            // hash. The remaining arguments are upstream's round-proof data.
+            QueuePayouts(foundHeight, b.GetHash(), b.vtx[0].GetHash().GetHex(),
                          b.vtx[0].vout[0].nValue, m->address,
                          roundShareCount, roundShareTotal);
             // Reset round shares
@@ -1962,7 +2608,11 @@ static void AcceptOneFn(void* arg)
     LogPrint("pool", "[pool] accept thread started for relay %s\n", relay.c_str());
 
     while (!fShutdown && gPoolRunning) {
-        // Blocks until a miner connects to us at this relay
+        // Advertise this relay as the pool's meeting node BEFORE registering,
+        // so that miners which resolve our descriptor find a relay where the
+        // pool (not the node's peer-accept) holds the registration.
+        BtfSetActiveRelay(relay);
+        // Returns as soon as the relay lists us -- registered, not yet paired.
         btf::RvSocket rv = btf::RvServiceRegister(host.c_str(), (unsigned short)port, pk);
 
         if (fShutdown || !gPoolRunning) {
@@ -1976,6 +2626,23 @@ static void AcceptOneFn(void* arg)
             continue;
         }
 
+        // Block for a miner to actually arrive. RvServiceRegister used to do
+        // this itself and returned with the relay's 0x01 pairing byte already
+        // consumed; it no longer does. Without waiting here, BtfServiceWrap
+        // reads that 0x01 as the first byte of the miner's 32-byte ephemeral
+        // key -- every subsequent byte is shifted by one, so the X25519
+        // handshake completes against a garbage shared secret (it has no
+        // confirmation step to catch it), the tunnel is handed to the event
+        // loop, and the miner's mining.subscribe never decrypts into a valid
+        // line. The miner sees the pool close on it; the pool sees a peer that
+        // never authorized.
+        if (!btf::RvServiceWaitPaired(rv)) {
+            btf::RvClose(rv);
+            LogPrint("pool", "[pool] relay %s: dropped us before any miner dialed"
+                     " -- re-registering\n", relay.c_str());
+            continue;
+        }
+
         // Echan handshake -- blocking but fast (local + relay round-trip)
         btf_socket_t fd = btf::BtfServiceWrap(rv, sk);
         if (fd == INVALID_SOCKET) {
@@ -2062,8 +2729,14 @@ void ThreadRPCServer(void*)
 
     LoadPendingPayouts();
     LoadPoolRounds();
+    LoadPaying();
+    // Must run before the payout thread starts, so nothing is resent that the
+    // ledger already shows as sent, and every restored in-flight record is
+    // armed for its one wallet probe before it is allowed to send.
+    ReconcilePayouts();
 
     _beginthread(AcceptLoopFn, 0, NULL);
+    _beginthread(LocalAcceptFn, 0, NULL);
     _beginthread(ThreadBtfPoolAnnouncer, 0, NULL);
     _beginthread(PayoutThreadFn, 0, NULL);
 
diff --git a/src/selftest.cpp b/src/selftest.cpp
index cca5335..eed6779 100644
--- a/src/selftest.cpp
+++ b/src/selftest.cpp
@@ -1109,6 +1109,13 @@ static int RunNetMessageSelfTest()
     int nFail = 0;
     try
     {
+        // A peer that has not yet been kept waiting must not look like one that
+        // has been waiting since the epoch. This is the whole bug: the stall
+        // clock lives in CNode, so only the constructor can start it at zero.
+        CNode opened(INVALID_SOCKET, CAddress("127.0.0.1"));
+        nFail += Check(opened.nMsgWaitSince == 0 && opened.nMsgWaitSize == 0,
+                       "a new peer starts with its stall clock stopped") ? 0 : 1;
+
         CNode complete(INVALID_SOCKET, CAddress("127.0.0.1"));
         complete.nVersion = VERSION;
         complete.vRecv << CMessageHeader("ping", 0);
@@ -1123,20 +1130,38 @@ static int RunNetMessageSelfTest()
         nFail += Check(ProcessMessages(&partial), "an incomplete message returns cleanly") ? 0 : 1;
         nFail += Check(partial.vRecv.size() == nPartialBefore,
                        "an incomplete message keeps one header in the buffer") ? 0 : 1;
-        nFail += Check(partial.nIncompleteMessageStart != 0,
-                       "an incomplete message starts a timeout clock") ? 0 : 1;
+        nFail += Check(partial.nMsgWaitSince != 0,
+                       "an incomplete message starts the stall clock") ? 0 : 1;
+        nFail += Check(partial.nMsgWaitSize == 0,
+                       "the stall clock records how much payload had arrived") ? 0 : 1;
         nFail += Check(!partial.fDisconnect,
                        "a fresh incomplete message does not disconnect immediately") ? 0 : 1;
 
+        // Still arriving, just slowly: more payload is here than when the clock
+        // was started, so the clock restarts however old it was. Timing the
+        // wait instead of the stall would drop this peer.
+        CNode slow(INVALID_SOCKET, CAddress("127.0.0.1"));
+        slow.nVersion = VERSION;
+        slow.vRecv << CMessageHeader("block", 100);
+        slow.vRecv.insert(slow.vRecv.end(), 50, '\0');
+        slow.nMsgWaitSince = GetTime() - BTF_MSG_WAIT_MAX_SECS - 1;
+        slow.nMsgWaitSize = 10;
+        ProcessMessages(&slow);
+        nFail += Check(!slow.fDisconnect,
+                       "a peer still sending payload is not dropped") ? 0 : 1;
+        nFail += Check(slow.nMsgWaitSize == 50,
+                       "progress restarts the stall clock") ? 0 : 1;
+
+        // Nothing more has arrived since the clock started, and the clock is
+        // older than the limit.
         CNode stale(INVALID_SOCKET, CAddress("127.0.0.1"));
         stale.nVersion = VERSION;
         stale.vRecv << CMessageHeader("block", 100);
-        stale.nIncompleteMessageStart = GetTime() - BTF_INCOMPLETE_MESSAGE_TIMEOUT_SECS - 1;
-        stale.nIncompleteMessageSize = 100;
-        stale.strIncompleteMessageCommand = "block";
+        stale.nMsgWaitSince = GetTime() - BTF_MSG_WAIT_MAX_SECS - 1;
+        stale.nMsgWaitSize = 0;
         ProcessMessages(&stale);
         nFail += Check(stale.fDisconnect,
-                       "a stale incomplete message disconnects the peer") ? 0 : 1;
+                       "a stalled incomplete message disconnects the peer") ? 0 : 1;
 
         CNode oversized(INVALID_SOCKET, CAddress("127.0.0.1"));
         oversized.nVersion = VERSION;
diff --git a/src/test_rvaccept.cpp b/src/test_rvaccept.cpp
new file mode 100644
index 0000000..afa9046
--- /dev/null
+++ b/src/test_rvaccept.cpp
@@ -0,0 +1,180 @@
+// Local regression test for the pool's rendezvous accept path.
+//
+// Reproduces the exact failure that took remote miners off the pool: since
+// upstream #30, RvServiceRegister returns as soon as the relay lists the
+// service and no longer consumes the relay's 0x01 pairing byte. A service that
+// goes straight from RvServiceRegister to BtfServiceWrap therefore reads that
+// 0x01 as the first byte of the client's 32-byte ephemeral key, shifting the
+// whole stream by one. X25519 has no confirmation step, so the handshake
+// "succeeds" against a garbage shared secret and the corruption only shows up
+// as a tunnel that never carries a valid byte.
+//
+// Build: g++ -std=gnu++14 -O2 -pthread test_rvaccept.cpp btftunnel.cpp btfrv.cpp \
+//        btfchan.cpp -lsodium -o test_rvaccept
+//
+// Build: g++ -std=gnu++14 -O2 -pthread test_rvaccept.cpp btftunnel.cpp \
+//        btfrv.cpp btfchan.cpp -lsodium -o test_rvaccept
+//
+// Run against a bitflashd relay already listening on 127.0.0.1:<port>.
+//   test_rvaccept broken <port>  -- the pre-fix pool code path, expected to FAIL
+//   test_rvaccept fixed  <port>  -- with RvServiceWaitPaired, expected to PASS
+
+#include "btftunnel.h"
+#include "btfrv.h"
+#include "btfchan.h"
+
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <unistd.h>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <string>
+#include <vector>
+#include <thread>
+#include <chrono>
+
+using namespace btf;
+
+static const char*    HOST = "127.0.0.1";
+static unsigned short PORT = 18446;
+static const char*    MSG  = "mining.subscribe stand-in payload";
+
+static void SetTimeout(int fd, int secs)
+{
+    struct timeval tv;
+    tv.tv_sec  = secs;
+    tv.tv_usec = 0;
+    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
+    setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+}
+
+static bool RecvN(int fd, void* buf, int n)
+{
+    char* p = (char*)buf;
+    int off = 0;
+    while (off < n) {
+        int r = recv(fd, p + off, n - off, 0);
+        if (r <= 0) return false;
+        off += r;
+    }
+    return true;
+}
+
+static bool SendN(int fd, const void* buf, int n)
+{
+    const char* p = (const char*)buf;
+    int off = 0;
+    while (off < n) {
+        int r = send(fd, p + off, n - off, 0);
+        if (r <= 0) return false;
+        off += r;
+    }
+    return true;
+}
+
+static bool  g_serviceEcho = false;
+static std::string g_serviceSaw;
+
+// The pool's AcceptOneFn, in both shapes.
+static void ServiceThread(bool fWaitPaired,
+                          std::vector<unsigned char> id,
+                          std::vector<unsigned char> enc_sk,
+                          int len)
+{
+    RvSocket rv = RvServiceRegister(HOST, PORT, id.data());
+    if (rv == RV_INVALID) { printf("    service: RvServiceRegister failed\n"); return; }
+
+    if (fWaitPaired) {
+        if (!RvServiceWaitPaired(rv)) {
+            printf("    service: RvServiceWaitPaired failed\n");
+            RvClose(rv);
+            return;
+        }
+        printf("    service: paired (0x01 consumed by RvServiceWaitPaired)\n");
+    } else {
+        printf("    service: skipped RvServiceWaitPaired (pre-fix behaviour)\n");
+    }
+
+    btf_socket_t app = BtfServiceWrap(rv, enc_sk.data());
+    if (app == INVALID_SOCKET) { printf("    service: BtfServiceWrap failed\n"); return; }
+    printf("    service: BtfServiceWrap returned a tunnel\n");
+
+    SetTimeout(app, 5);
+    std::vector<char> buf(len);
+    if (!RecvN(app, buf.data(), len)) {
+        printf("    service: never received the client's plaintext\n");
+        close(app);
+        return;
+    }
+    g_serviceSaw.assign(buf.data(), len);
+    g_serviceEcho = SendN(app, buf.data(), len);
+    close(app);
+}
+
+int main(int argc, char* argv[])
+{
+    bool fWaitPaired = (argc >= 2 && strcmp(argv[1], "fixed") == 0);
+    if (argc >= 3) PORT = (unsigned short)atoi(argv[2]);
+
+    if (!TunnelInit()) { printf("TunnelInit failed\n"); return 2; }
+
+    unsigned char enc_pk[32], enc_sk[32];
+    ChanKeypair(enc_pk, enc_sk);
+
+    std::vector<unsigned char> id(32);
+    for (int i = 0; i < 32; i++) id[i] = (unsigned char)(i * 7 + 13);
+
+    const std::string msg(MSG);
+    const int len = (int)msg.size();
+
+    printf("  mode: %s   relay: %s:%u\n", fWaitPaired ? "fixed" : "broken", HOST, PORT);
+
+    std::thread svc(ServiceThread, fWaitPaired, id,
+                    std::vector<unsigned char>(enc_sk, enc_sk + 32), len);
+    std::this_thread::sleep_for(std::chrono::milliseconds(500));
+
+    int nFail = 0;
+
+    btf_socket_t app = BtfClientTunnel(HOST, PORT, id.data(), enc_pk);
+    if (app == INVALID_SOCKET) {
+        printf("    client: BtfClientTunnel failed\n");
+        nFail++;
+    } else {
+        printf("    client: tunnel established\n");
+        SetTimeout(app, 5);
+        if (!SendN(app, msg.data(), len)) { printf("    client: send failed\n"); nFail++; }
+        std::vector<char> echo(len);
+        if (!RecvN(app, echo.data(), len)) {
+            printf("    client: no echo came back\n");
+            nFail++;
+        } else if (std::string(echo.data(), len) != msg) {
+            printf("    client: echo did not match what was sent\n");
+            nFail++;
+        } else {
+            printf("    client: round-tripped the payload intact\n");
+        }
+        close(app);
+    }
+
+    svc.join();
+
+    if (g_serviceSaw != msg) {
+        printf("    service did not see the correct plaintext (saw %d bytes)\n",
+               (int)g_serviceSaw.size());
+        nFail++;
+    }
+    if (!g_serviceEcho) { printf("    service could not echo\n"); nFail++; }
+
+    bool fPassed = (nFail == 0);
+    printf("  RESULT: %s\n", fPassed ? "PASS -- tunnel carries plaintext end to end"
+                                     : "FAIL -- tunnel never carried a valid byte");
+
+    // A broken run is the expected outcome pre-fix, so exit 0 when the
+    // observed behaviour matches the expectation for the mode under test.
+    bool fAsExpected = (fWaitPaired ? fPassed : !fPassed);
+    printf("  EXPECTED %s -> %s\n",
+           fWaitPaired ? "PASS" : "FAIL",
+           fAsExpected ? "as expected" : "UNEXPECTED");
+    return fAsExpected ? 0 : 1;
+}
diff --git a/src/util.h b/src/util.h
index d95d3ae..d72518b 100644
--- a/src/util.h
+++ b/src/util.h
@@ -8,6 +8,13 @@
 #include <cxxabi.h>
 #endif
 
+// For AvailableCoreCount() below: sched_getaffinity on Linux, and
+// hardware_concurrency as the fallback everywhere else.
+#include <thread>
+#ifdef __linux__
+#include <sched.h>
+#endif
+
 #if defined(_MSC_VER) || defined(__BORLANDC__)
 typedef __int64  int64;
 typedef unsigned __int64  uint64;
@@ -144,6 +151,34 @@ int64 GetTime();
 int64 GetAdjustedTime();
 void AddTimeData(unsigned int ip, int64 nTime);
 
+// Cores this process is actually allowed to run on.
+//
+// std::thread::hardware_concurrency() reports the MACHINE's core count, which
+// is not the same number inside a container. With --cpuset-cpus 0-5 on a
+// 12-core host it still answers 12, so every caller that sized a thread pool
+// from it oversubscribed by 2x and then wondered why the box was thrashing:
+// the pool node started 11 miner threads on 6 permitted CPUs, and a burst
+// miner asked for 2 cores filled the ~2 GB RandomX dataset with 12 threads.
+//
+// sched_getaffinity reports what the cpuset permits, which is the number every
+// one of those callers meant. Falls back to hardware_concurrency where the
+// call is unavailable, and never returns 0 -- callers divide by this.
+inline unsigned int AvailableCoreCount()
+{
+#ifdef __linux__
+    cpu_set_t cpuset;
+    CPU_ZERO(&cpuset);
+    if (sched_getaffinity(0, sizeof(cpuset), &cpuset) == 0)
+    {
+        int nAllowed = CPU_COUNT(&cpuset);
+        if (nAllowed > 0)
+            return (unsigned int)nAllowed;
+    }
+#endif
+    unsigned int nCores = std::thread::hardware_concurrency();
+    return nCores > 0 ? nCores : 1;
+}
+