17 files changed, 1534 insertions, 106 deletions

diff --git a/src/Makefile b/src/Makefile
index 1bc3ae8..2c6d304 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -6,7 +6,9 @@ FUZZ_CXX ?= clang++
 
 SECP_INC    ?= /usr/local/include
 SECP_LIB    ?= /usr/local/lib
-RANDOMX_DIR ?= $(HOME)/RandomX
+# The root Makefile exports RANDOMX_DIR (default: <repo>/randomx-build, built
+# by deps-randomx). This fallback only applies when src/ is built standalone.
+RANDOMX_DIR ?= $(abspath $(CURDIR)/..)/randomx-build
 
 IMGUI_DIR = imgui
 
diff --git a/src/btfrv.cpp b/src/btfrv.cpp
index 133eb89..7d705ef 100644
--- a/src/btfrv.cpp
+++ b/src/btfrv.cpp
@@ -40,6 +40,8 @@ typedef int SOCKET;
 #include <thread>
 #include <mutex>
 #include <atomic>
+#include <chrono>
+#include <system_error>
 
 namespace btf
 {
@@ -209,8 +211,28 @@ static void HandleIncoming(SOCKET s)
         bool a = WriteN(svc, &ok, 1);
         bool b = WriteN(s, &ok, 1);
         if (!a || !b) { CLOSESOCK(svc); CLOSESOCK(s); return; }
-        std::thread(Forward, s, svc).detach();
-        std::thread(Forward, svc, s).detach();
+        // One thread pumps s -> svc; this thread pumps svc -> s. Spawning a
+        // thread per direction left no clean way to fail the second spawn:
+        // std::thread throws std::system_error when pthread_create is refused
+        // (NPROC limit, container pids cgroup, memory pressure), the first
+        // pump was already detached, and closing its sockets from here would
+        // race it -- so nothing caught the throw and it reached
+        // std::terminate, killing the relay over one pair it could not serve.
+        // Running one direction on this thread leaves exactly one spawn to
+        // guard, and a failure here has nothing running yet to race.
+        try
+        {
+            std::thread(Forward, s, svc).detach();
+        }
+        catch (const std::system_error& e)
+        {
+            fprintf(stderr, "rendezvous relay: cannot spawn forward thread (%s), pair dropped\n",
+                    e.what());
+            CLOSESOCK(svc);
+            CLOSESOCK(s);
+            return;
+        }
+        Forward(svc, s);
     }
     else
     {
@@ -236,6 +258,7 @@ bool RvRelayRun(unsigned short port)
     if (bind(g_listen, (struct sockaddr*)&addr, sizeof(addr)) != 0) { CLOSESOCK(g_listen); return false; }
     if (listen(g_listen, 16) != 0) { CLOSESOCK(g_listen); return false; }
 
+    int nSpawnFails = 0;
     while (!g_stop)
     {
         struct sockaddr_in cli;
@@ -246,7 +269,27 @@ bool RvRelayRun(unsigned short port)
             if (g_stop) break;
             continue;
         }
-        std::thread(HandleIncoming, s).detach();
+        try
+        {
+            std::thread(HandleIncoming, s).detach();
+            nSpawnFails = 0;
+        }
+        catch (const std::system_error& e)
+        {
+            // A refused pthread_create is backpressure, not a reason to die:
+            // the condition behind it (NPROC, pids cgroup, memory) does not
+            // clear in milliseconds, and the connection count feeding it is
+            // attacker-influenced. Drop this one peer, stop accepting for a
+            // moment -- longer each time, capped -- and keep serving the
+            // connections already established.
+            fprintf(stderr, "rendezvous relay: cannot spawn connection thread (%s), connection dropped\n",
+                    e.what());
+            CLOSESOCK(s);
+            nSpawnFails++;
+            int nWaitMs = nSpawnFails < 5 ? nSpawnFails * 1000 : 5000;
+            for (int i = 0; i < nWaitMs && !g_stop; i += 100)
+                std::this_thread::sleep_for(std::chrono::milliseconds(100));
+        }
     }
     CLOSESOCK(g_listen);
     g_listen = INVALID_SOCKET;
@@ -334,17 +377,29 @@ bool RvServiceWaitPaired(RvSocket s, int nTimeoutSecs)
 }
 
 RvSocket RvClientConnect(const char* relay_host, unsigned short port,
-                         const unsigned char target_pubkey[32])
+                         const unsigned char target_pubkey[32],
+                         RvClientFail* pFail)
 {
+    if (pFail) *pFail = RVC_FAIL_DIAL;
     if (!RvInit()) return RV_INVALID;
     SOCKET s = ConnectTo(relay_host, port);
     if (s == INVALID_SOCKET) return RV_INVALID;
+    if (pFail) *pFail = RVC_FAIL_PAIR;
     unsigned char hdr[33];
     hdr[0] = (unsigned char)'C';
     memcpy(hdr + 1, target_pubkey, 32);
     if (!WriteN(s, hdr, 33)) { CLOSESOCK(s); return RV_INVALID; }
     unsigned char paired = 0;
-    if (!ReadN(s, &paired, 1) || paired != 0x01) { CLOSESOCK(s); return RV_INVALID; }
+    if (!ReadN(s, &paired, 1)) { CLOSESOCK(s); return RV_INVALID; }
+    if (paired != 0x01)
+    {
+        // The relay answered and declined: HandleIncoming writes 0x00 and
+        // closes when no service is parked under this pubkey right now.
+        if (pFail) *pFail = RVC_FAIL_REFUSED;
+        CLOSESOCK(s);
+        return RV_INVALID;
+    }
+    if (pFail) *pFail = RVC_FAIL_NONE;
     return (RvSocket)s;
 }
 
diff --git a/src/btfrv.h b/src/btfrv.h
index 9cd7476..1e85cb0 100644
--- a/src/btfrv.h
+++ b/src/btfrv.h
@@ -57,10 +57,25 @@ RvSocket RvServiceRegister(const char* relay_host, unsigned short port,
 bool RvServiceWaitPaired(RvSocket s, int nTimeoutSecs = 0);
 
 // ---- client side (the node dialing a .btf address) ----
+// Where a failed RvClientConnect stopped. RV_INVALID alone collapses three
+// different situations -- relay unreachable, relay reachable but nobody
+// registered, connection died mid-pairing -- and they point at different
+// components. The caller can only report the right one if this side says
+// which it saw.
+enum RvClientFail
+{
+    RVC_FAIL_NONE = 0,
+    RVC_FAIL_DIAL,    // TCP connect to the relay itself failed
+    RVC_FAIL_REFUSED, // relay answered 0x00: no service registered under this pubkey
+    RVC_FAIL_PAIR,    // relay connection died before pairing completed
+};
+
 // Connect through the relay to the service registered under `target_pubkey`.
-// Returns the paired socket, or RV_INVALID on error.
+// Returns the paired socket, or RV_INVALID on error -- with `pFail`, if
+// given, naming the stage that failed.
 RvSocket RvClientConnect(const char* relay_host, unsigned short port,
-                         const unsigned char target_pubkey[32]);
+                         const unsigned char target_pubkey[32],
+                         RvClientFail* pFail = 0);
 
 // Blocking read/write of exactly n bytes over a rendezvous socket. Return false
 // on error/EOF.
diff --git a/src/btftunnel.cpp b/src/btftunnel.cpp
index 63d178b..4058f6b 100644
--- a/src/btftunnel.cpp
+++ b/src/btftunnel.cpp
@@ -25,8 +25,12 @@ typedef int SOCKET;
 #endif
 #include "sockcount.h"
 #include <cstring>
+#include <cstdio>
+#include <memory>
+#include <new>
 #include <vector>
 #include <thread>
+#include <system_error>
 
 namespace btf
 {
@@ -119,35 +123,155 @@ static void PumpIn(SOCKET pumpEnd, RvSocket rv, std::vector<unsigned char> key)
     shutdown((SOCKET)rv, SD_BOTH);
 }
 
+// The pump end and the rendezvous socket, owned jointly by whoever is still
+// using them. Closed once, by the last reference to go.
+//
+// Joint ownership rather than "the inbound pump owns the cleanup", because
+// either pump can reach its exit first and BOTH touch BOTH descriptors on the
+// way out -- PumpOut ends in shutdown(rv), shutdown(pumpEnd) and PumpIn ends in
+// the mirror image. A single owner therefore has no exit at which the other is
+// guaranteed to be finished. Holding a reference for the whole body of each
+// pump gives it one: the close cannot happen until the last pump has stopped
+// touching the descriptors, so no shutdown() can land on a number that has
+// already been closed and handed back out by the kernel to an unrelated
+// connection.
+struct TunnelEnds
+{
+    SOCKET   pumpEnd;
+    RvSocket rv;
+    TunnelEnds(SOCKET p, RvSocket r) : pumpEnd(p), rv(r) {}
+    ~TunnelEnds() { BtfCloseSocket(pumpEnd); RvClose(rv); }
+private:
+    TunnelEnds(const TunnelEnds&);
+    TunnelEnds& operator=(const TunnelEnds&);
+};
+
 // Start the two pumps and hand back the app-facing socket. When both pumps
 // finish, close the pump end and the rendezvous socket.
+//
+// That sentence used to be a comment describing something the code did not do.
+// The inbound pump closed both descriptors as soon as it exited, without
+// waiting for the outbound pump, which then called shutdown() on both at its
+// own exit. Whether that shutdown hit a live descriptor or a closed one came
+// down to which pump got there first, and the rendezvous socket dying before
+// the app socket -- a relay restart, the far side hanging up -- is precisely
+// the order that puts the inbound pump ahead. Measured over 25 such teardowns
+// against the real code: 29 shutdowns landed on an already-closed descriptor.
+//
+// appEnd is not part of this. It is handed to the caller on success and closed
+// here on every failure path; no pump ever touches it.
+//
+// Every tunnel is two threads, and a tunnel is one peer connection (a .btf
+// dial or accept, a pool miner, a participant's pool session) -- so the
+// thread count scales with peer count, which is attacker-influenced. When
+// pthread_create is refused std::thread throws std::system_error; uncaught it
+// reached std::terminate and took the whole process down over one connection
+// it could not serve. Both spawns are guarded, and the failure paths return
+// INVALID_SOCKET, which every caller already handles by dropping just that
+// connection.
 static btf_socket_t StartTunnel(RvSocket rv, const unsigned char shared[32])
 {
     btf_socket_t appEnd, pumpEnd;
     if (!MakeLocalPair(appEnd, pumpEnd)) { RvClose(rv); return INVALID_SOCKET; }
 
     std::vector<unsigned char> key(shared, shared + 32);
-    std::thread(PumpOut, pumpEnd, rv, key).detach();
-    std::thread([pumpEnd, rv, key]() {
-        PumpIn(pumpEnd, rv, key);
+
+    // make_shared, not shared_ptr(new ...): it allocates before it constructs,
+    // so it either comes back owning both descriptors or throws having taken
+    // ownership of neither. The two-step form can run the deleter and then
+    // throw, which would close both here and again below.
+    std::shared_ptr<TunnelEnds> ends;
+    try
+    {
+        ends = std::make_shared<TunnelEnds>(pumpEnd, rv);
+    }
+    catch (const std::bad_alloc&)
+    {
+        fprintf(stderr, "btf tunnel: out of memory starting tunnel, tunnel dropped\n");
         BtfCloseSocket(pumpEnd);
+        BtfCloseSocket(appEnd);
         RvClose(rv);
-    }).detach();
+        return INVALID_SOCKET;
+    }
+
+    try
+    {
+        std::thread([ends, key]() { PumpIn(ends->pumpEnd, ends->rv, key); }).detach();
+    }
+    catch (const std::system_error& e)
+    {
+        // Nothing is running yet: `ends` is the only reference, and returning
+        // drops it, which is what closes pumpEnd and rv.
+        fprintf(stderr, "btf tunnel: cannot spawn inbound pump (%s), tunnel dropped\n",
+                e.what());
+        BtfCloseSocket(appEnd);
+        return INVALID_SOCKET;
+    }
+
+    try
+    {
+        std::thread([ends, key]() { PumpOut(ends->pumpEnd, ends->rv, key); }).detach();
+    }
+    catch (const std::system_error& e)
+    {
+        // The inbound pump may be parked in RvReadN(rv) or may already have
+        // exited -- when the spawn is refused because the process is loaded,
+        // the rendezvous socket is often dead for the same reason, and then
+        // PumpIn returns on its first length read. Either way this thread
+        // still holds a reference, so both descriptors are still open: the
+        // shutdown wakes the pump if it is parked and is harmless if it is
+        // not. The close belongs to whichever reference goes last.
+        fprintf(stderr, "btf tunnel: cannot spawn outbound pump (%s), tunnel dropped\n",
+                e.what());
+        shutdown((SOCKET)ends->rv, SD_BOTH);
+        shutdown(ends->pumpEnd, SD_BOTH);
+        BtfCloseSocket(appEnd);
+        return INVALID_SOCKET;
+    }
     return appEnd;
 }
 
+const char* TunnelFailText(TunnelFail f)
+{
+    switch (f)
+    {
+    case TUNNEL_FAIL_NONE:      return "no failure";
+    case TUNNEL_FAIL_INIT:      return "local socket/crypto init failed";
+    case TUNNEL_FAIL_DIAL:      return "meeting node unreachable (tcp dial failed)";
+    case TUNNEL_FAIL_REFUSED:   return "relay reachable, but no service registered there for this address";
+    case TUNNEL_FAIL_PAIR:      return "relay connection died before pairing completed";
+    case TUNNEL_FAIL_HANDSHAKE: return "end-to-end handshake failed";
+    case TUNNEL_FAIL_LOCAL:     return "local tunnel setup failed";
+    }
+    return "unknown failure";
+}
+
 btf_socket_t BtfClientTunnel(const char* meeting_host, unsigned short port,
                              const unsigned char target_pubkey[32],
-                             const unsigned char service_enc_pub[32])
+                             const unsigned char service_enc_pub[32],
+                             TunnelFail* pFail)
 {
+    if (pFail) *pFail = TUNNEL_FAIL_INIT;
     if (!TunnelInit()) return INVALID_SOCKET;
-    RvSocket rv = RvClientConnect(meeting_host, port, target_pubkey);
-    if (rv == RV_INVALID) return INVALID_SOCKET;
+    RvClientFail rvFail = RVC_FAIL_NONE;
+    RvSocket rv = RvClientConnect(meeting_host, port, target_pubkey, &rvFail);
+    if (rv == RV_INVALID)
+    {
+        if (pFail)
+            *pFail = rvFail == RVC_FAIL_DIAL    ? TUNNEL_FAIL_DIAL
+                   : rvFail == RVC_FAIL_REFUSED ? TUNNEL_FAIL_REFUSED
+                                                : TUNNEL_FAIL_PAIR;
+        return INVALID_SOCKET;
+    }
 
     unsigned char eph_pub[32], shared[32];
+    if (pFail) *pFail = TUNNEL_FAIL_HANDSHAKE;
     if (!ChanClientHandshake(service_enc_pub, eph_pub, shared)) { RvClose(rv); return INVALID_SOCKET; }
     if (!RvWriteN(rv, eph_pub, 32)) { RvClose(rv); return INVALID_SOCKET; }
-    return StartTunnel(rv, shared);
+    if (pFail) *pFail = TUNNEL_FAIL_LOCAL;
+    btf_socket_t app = StartTunnel(rv, shared);
+    if (app != INVALID_SOCKET && pFail) *pFail = TUNNEL_FAIL_NONE;
+    return app;
 }
 
 btf_socket_t BtfServiceWrap(RvSocket rv, const unsigned char my_enc_sk[32])
diff --git a/src/btftunnel.h b/src/btftunnel.h
index 24a7509..3cc87cd 100644
--- a/src/btftunnel.h
+++ b/src/btftunnel.h
@@ -36,12 +36,33 @@ namespace btf
 // Initialize (sockets + libsodium). Idempotent.
 bool TunnelInit();
 
+// Which stage of BtfClientTunnel failed. INVALID_SOCKET alone says only "no
+// tunnel"; a caller that then guesses at causes in its log line sends whoever
+// reads it to the wrong component (issue #17: "relay unreachable or pool not
+// listening" blamed two healthy parts). The stage is what this side actually
+// knows -- report that.
+enum TunnelFail
+{
+    TUNNEL_FAIL_NONE = 0,
+    TUNNEL_FAIL_INIT,      // local socket/crypto init failed
+    TUNNEL_FAIL_DIAL,      // TCP connect to the meeting node failed
+    TUNNEL_FAIL_REFUSED,   // relay reachable, but no service registered under the pubkey
+    TUNNEL_FAIL_PAIR,      // relay connection died before pairing completed
+    TUNNEL_FAIL_HANDSHAKE, // end-to-end channel handshake failed
+    TUNNEL_FAIL_LOCAL,     // local pump plumbing (socket pair / threads) failed
+};
+
+// Short description of a TunnelFail for log lines.
+const char* TunnelFailText(TunnelFail f);
+
 // Client: dial the service registered under `target_pubkey` at the meeting node
 // (host:port), box to its static x25519 `service_enc_pub`, and return a local
-// plaintext SOCKET tunneled end-to-end to the service. INVALID_SOCKET on error.
+// plaintext SOCKET tunneled end-to-end to the service. INVALID_SOCKET on error
+// -- with `pFail`, if given, naming the stage that failed.
 btf_socket_t BtfClientTunnel(const char* meeting_host, unsigned short port,
                              const unsigned char target_pubkey[32],
-                             const unsigned char service_enc_pub[32]);
+                             const unsigned char service_enc_pub[32],
+                             TunnelFail* pFail = 0);
 
 // Service: wrap an already-paired rendezvous socket (RvServiceRegister followed
 // by RvServiceWaitPaired -- the pairing byte MUST already be consumed) with
diff --git a/src/gui.cpp b/src/gui.cpp
index 8dcb854..9b3802b 100644
--- a/src/gui.cpp
+++ b/src/gui.cpp
@@ -15,6 +15,7 @@
 #include <atomic>
 #include <mutex>
 #include <thread>
+#include <system_error>
 #include "bip32.h"
 #include "walletcmd.h"
 #include "font_roboto.h"
@@ -910,8 +911,16 @@ static void DrawOptionsDialog()
 
             if (nMineMode == MINE_OPERATOR) {
                 if (!gPoolServerRunning) {
-                    gPoolServerRunning = true;
-                    _beginthread(ThreadRPCServer, 0, NULL);
+                    // Claim the server is up only once it is. The flag used to
+                    // be set first and the result never looked at, so a refused
+                    // spawn left an operator with a pool that reports itself
+                    // running, no RPC server for miners to reach, and nothing
+                    // anywhere saying why. The flag also latches: with it set,
+                    // this branch is never retried.
+                    if (_beginthread(ThreadRPCServer, 0, NULL) == (uintptr_t)-1)
+                        printf("Error: _beginthread(ThreadRPCServer) failed -- pool server not started\n");
+                    else
+                        gPoolServerRunning = true;
                 } else if (!gPoolRunning) {
                     gPoolRunning = true;
                 }
@@ -1124,11 +1133,28 @@ static void DrawRestorePhraseDialog()
                 }
                 g_restoreDerived.store(0);
                 g_restoreRecovered.store(0);
+                // Set before the spawn, not after: RestoreThread clears this
+                // flag itself when it finishes, and a short restore can beat
+                // us back here and have its `false` overwritten, leaving the
+                // dialog disabled forever.
                 g_restoreRunning.store(true);
                 // On its own thread: a restore walks the whole chain once per
                 // batch and would otherwise freeze the window for as long as it
-                // takes.
-                std::thread(RestoreThread, std::string(g_restoreInput)).detach();
+                // takes. A refused spawn is one restore that does not happen,
+                // not a reason to take the window down with an uncaught
+                // std::system_error -- and the flag has to come back off, or
+                // the dialog sits greyed out reporting a search nobody is
+                // running.
+                try
+                {
+                    std::thread(RestoreThread, std::string(g_restoreInput)).detach();
+                }
+                catch (const std::system_error& e)
+                {
+                    g_restoreRunning.store(false);
+                    std::lock_guard<std::mutex> lock(g_restoreResultMutex);
+                    g_restoreResult = std::string("Could not start the search: ") + e.what();
+                }
             }
         }
         if (fBusy)
diff --git a/src/main.cpp b/src/main.cpp
index 7b3e555..6b8e0de 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -14,6 +14,7 @@
 #include <atomic>
 #include <mutex>
 #include <thread>
+#include <system_error>
 #include "bip32.h"
 #include "btfaddr.h"
 #include "btftunnel.h"
@@ -64,6 +65,137 @@ CBlockIndex* pindexBest = NULL;
 map<uint256, CBlock*> mapOrphanBlocks;
 multimap<uint256, CBlock*> mapOrphanBlocksByPrev;
 
+// Block bodies we have sent a getdata for and not yet received, so the
+// failover pass in SendMessages can tell "requested and being served" from
+// "requested and gone quiet" and re-issue the request to a different peer
+// (#33). Keyed by block hash; setAsked is the peers already tried since the
+// round last restarted, so the retry rotates instead of hammering the
+// announcer that is not serving. Guarded by cs_main, which both the message
+// handlers and SendMessages already hold.
+//
+// Capped small on purpose. At the tip there is one block in flight; during
+// initial download there are legitimately hundreds outstanding to one peer,
+// and rotating those would duplicate the whole download to every other peer.
+//
+// The cap is a shared resource and nothing on the path from inv to insertion
+// can tell a real block hash from 32 random bytes -- AlreadyHave only asks
+// whether we already hold the block, and there is no header to check work
+// against. So the table does not refuse a new hash when it is full; it makes
+// room. See MakeRoomInBlockFetch for the rule, which is what stops one peer
+// filling all eight slots and switching failover off for everybody.
+//
+// The initialisers matter: the insertion path uses operator[] and then tests
+// nTimeFirstAsked == 0 to detect a fresh entry. That worked on
+// value-initialisation alone, but only for as long as nobody gave this struct
+// a constructor.
+struct CBlockFetch
+{
+    int64 nTimeFirstAsked = 0;  // when the first getdata for this block went out
+    int64 nTimeAsked      = 0;  // when the latest getdata went out
+    CAddress addrAnnounced;     // peer whose announcement put this hash here
+    set<CAddress> setAsked;     // peers tried since the round last restarted
+};
+map<uint256, CBlockFetch> mapBlockFetch;
+static const int BLOCK_FETCH_TRACK_MAX = 8;
+// A block nobody has served for this long is not a fetch problem: the hash may
+// have been announced and never existed. Drop the entry rather than getdata
+// forever; a re-announcement recreates it.
+static const int BLOCK_FETCH_GIVEUP_SECS = 10 * 60;
+
+// Failover firing at all is worth saying out loud: it means peers are
+// announcing blocks they then do not serve, which is the pathology of #33 and
+// the thing nobody could otherwise see. Naming the peer on every re-request is
+// a different matter. A peer can drive that line as often as it likes by
+// announcing hashes it will not serve, and what it prints is a peer address,
+// which is the one thing the .btf transport otherwise takes trouble not to
+// spread around. So the per-peer detail sits behind the net category and the
+// unconditional line is a count over a window no peer can shorten: the first
+// failover after a quiet spell prints at once, because the change from "blocks
+// arrive" to "blocks are announced and not served" is the event worth seeing,
+// and everything after it is summarised once a minute.
+static const int BLOCK_FETCH_REPORT_SECS = 60;
+static int64 nBlockFetchWindowStart = 0;
+static int   nBlockFetchFailovers   = 0;
+
+// How stale our own best block may be before we stop calling this the tip.
+// Blocks target two minutes, so this is thirty intervals: far longer than any
+// stall worth failing over from -- the one in #33 ran sixteen minutes -- and
+// far shorter than catching up, which starts hours or days back.
+static const int BLOCK_FETCH_TIP_AGE_SECS = 60 * 60;
+
+// Whether this node is tracking the tip rather than still catching up.
+//
+// Measured off the age of our own best block, not off any height a peer told
+// us. nStartingHeight is optional in the version message and every node
+// released so far sends the short form, so it is -1 for essentially every
+// peer; and where it is filled in later it is filled in from the height of a
+// block that peer served us, which during catch-up tracks our own height and
+// would report "at the tip" for the whole download. Block timestamps are the
+// one clock here that peers cannot move: CheckBlock refuses anything more than
+// two hours ahead and AcceptBlock refuses anything at or before the previous
+// median, so the only way to make this read "at the tip" falsely is to mine,
+// and all that buys is the 15s spacing this code had unconditionally anyway.
+bool IsBlockFetchNearTip()
+{
+    return pindexBest && (int64)pindexBest->nTime > GetTime() - BLOCK_FETCH_TIP_AGE_SECS;
+}
+
+// Drop one entry so a hash announced by addrNew can be tracked.
+//
+// Refusing the insertion instead was a remote off-switch for the whole
+// feature. An inv carrying eight hashes that never existed filled every slot
+// -- nothing between inv and here can tell those from real blocks -- and no
+// genuinely new block was tracked again until the give-up timer expired ten
+// minutes later, re-armable for one message per ten minutes from a single
+// connection.
+//
+// So evict instead, by occupancy: a peer may only take a slot from a peer
+// holding strictly more slots than itself, and otherwise recycles one of its
+// own. That is what keeps eviction from becoming the same attack in a new
+// shape. A peer that has filled the table is by definition the heaviest
+// holder, so its own entries are the only ones it can displace, while a peer
+// announcing its first block holds nothing and therefore always evicts from
+// the heaviest -- a genuine announcement is never refused a slot, whatever the
+// attacker holds or however many connections it holds it from. The one case
+// that costs a real fetch is eight distinct peers holding one entry each,
+// where a ninth takes the oldest; that is a busy healthy node, not an attack,
+// and losing the oldest of eight beats refusing the ninth.
+static void MakeRoomInBlockFetch(const CAddress& addrNew)
+{
+    if (mapBlockFetch.empty())
+        return;
+
+    map<CAddress, int> mapHeld;
+    for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end(); ++mi)
+        mapHeld[(*mi).second.addrAnnounced]++;
+
+    int nMine = mapHeld.count(addrNew) ? mapHeld[addrNew] : 0;
+
+    int nMax = 0;
+    CAddress addrVictim;
+    for (map<CAddress, int>::iterator mi = mapHeld.begin(); mi != mapHeld.end(); ++mi)
+        if ((*mi).second > nMax)
+        {
+            nMax = (*mi).second;
+            addrVictim = (*mi).first;
+        }
+
+    // Nobody is holding more than this peer, so it recycles its own oldest
+    // rather than taking a slot off an equal.
+    if (nMax <= nMine)
+        addrVictim = addrNew;
+
+    map<uint256, CBlockFetch>::iterator miVictim = mapBlockFetch.end();
+    for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end(); ++mi)
+        if ((*mi).second.addrAnnounced == addrVictim &&
+            (miVictim == mapBlockFetch.end() ||
+             (*mi).second.nTimeFirstAsked < (*miVictim).second.nTimeFirstAsked))
+            miVictim = mi;
+
+    if (miVictim != mapBlockFetch.end())
+        mapBlockFetch.erase(miVictim);
+}
+
 map<uint256, CDataStream*> mapOrphanTransactions;
 multimap<uint256, CDataStream*> mapOrphanTransactionsByPrev;
 
@@ -1712,7 +1844,7 @@ void CWalletTx::RelayWalletTransaction(CTxDB& txdb)
         uint256 hash = GetHash();
         if (!txdb.ContainsTx(hash))
         {
-            if (LogAcceptsCategory("net")) printf("Relaying wtx %s\n", hash.ToString().substr(0,6).c_str());
+            if (LogAcceptsCategory("relay")) printf("Relaying wtx %s\n", hash.ToString().substr(0,6).c_str());
             RelayMessage(CInv(MSG_TX, hash), (CTransaction)*this);
         }
     }
@@ -2678,7 +2810,18 @@ bool LoadBlockIndex(bool fAllowNew)
         //     CTxOut(nValue=50.00000000, scriptPubKey=0x5F1DF16B2B704C8A578D0B)
         //   vMerkleTree: 4a5e1e
 
-        // Bitflash genesis block -- own header (fair launch, 2026 stable relaunch)
+        // Bitflash genesis block -- own header (fair launch)
+        //
+        // Do not change pszTimestamp, the scriptPubKey, nTime or nNonce. They
+        // are the inputs to the genesis hash, and the genesis hash is
+        // consensus. Changing one on its own trips the assert below, which is
+        // loud and reverts cleanly; changing one and regenerating
+        // GENESIS_NONCE and hashGenesisBlock to match -- which is exactly what
+        // the re-mining branch below prints out and invites -- gives a node
+        // that starts without complaint, builds its own chain from height 0,
+        // and rejects every real peer as being on a different chain. That one
+        // fails silently, and the damage scales with how many people run the
+        // "fixed" build.
         char* pszTimestamp = "Bitflash 24/Jul/2026 Fair launch: one CPU one vote, no premine";
         CTransaction txNew;
         txNew.vin.resize(1);
@@ -2691,7 +2834,14 @@ bool LoadBlockIndex(bool fAllowNew)
         block.hashPrevBlock = 0;
         block.hashMerkleRoot = block.BuildMerkleTree();
         block.nVersion = 1;
-        block.nTime    = 1753315200; // 2026-07-24 00:00:00 UTC (stable relaunch)
+        // 1753315200 is 2025-07-24T00:00:00Z. The headline in pszTimestamp
+        // above reads 2026 and does not match it. This is a known discrepancy
+        // and not a typo in the constant: the value is only consensus-critical
+        // as an input to the genesis hash, the block hashes to
+        // hashGenesisBlock with it, and every node on the network agrees. The
+        // mismatch is in the launched chain and cannot be corrected -- see the
+        // warning above before deciding otherwise.
+        block.nTime    = 1753315200;
         block.nBits    = 0x1f0fffff; // = bnProofOfWorkLimit (Bitflash RandomX floor)
         block.nNonce   = GENESIS_NONCE;
 
@@ -2718,6 +2868,11 @@ bool LoadBlockIndex(bool fAllowNew)
             printf("powhash = %s\n", block.GetPoWHash().ToString().c_str());
             printf("hash    = %s\n", block.GetHash().ToString().c_str());
             printf("merkle  = %s\n", block.hashMerkleRoot.ToString().c_str());
+            printf("----------------------------------------\n");
+            printf("These constants bring up a NEW chain. Do not paste them\n");
+            printf("into a build for this network to make an edited nTime or\n");
+            printf("pszTimestamp fit -- a node whose genesis differs starts\n");
+            printf("cleanly on a chain of its own and rejects every real peer.\n");
             printf("========================================\n");
         }
 
@@ -3263,15 +3418,61 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
         vRecv >> *pblock;
 
         //// debug print
-        if (LogAcceptsCategory("net")) { printf("received block:\n"); pblock->print(); }
+        if (LogAcceptsCategory("relay")) { printf("received block:\n"); pblock->print(); }
 
         CInv inv(MSG_BLOCK, pblock->GetHash());
         pfrom->AddInventoryKnown(inv);
 
+        // GetHash() covers the 80-byte header and nothing else, so the hash
+        // coming out right does not make this the block we asked for. Every
+        // peer that saw X announced holds X's header, and can answer our
+        // getdata with that header bolted onto a transaction list of its own
+        // invention -- the reply still hashes to X. hashMerkleRoot is the only
+        // thing binding the header to the body, so check it here, before the
+        // mapBlockFetch entry is touched and before CheckBlock spends a
+        // RandomX hash on a body already known to be forged.
+        //
+        // There is no honest way to arrive here. Peer traffic rides the .btf
+        // channel, which is XChaCha20-Poly1305, so a body that arrives at all
+        // arrived intact: a mismatch is the peer's own construction, not line
+        // noise. Drop the peer and leave the fetch outstanding so the failover
+        // sweep asks somebody else for the real X, rather than recording X as
+        // delivered on the strength of a header anyone could copy.
+        if (pblock->hashMerkleRoot != pblock->BuildMerkleTree())
+        {
+            if (LogAcceptsCategory("net"))
+                printf("peer %s served a forged body for %s\n",
+                       pfrom->addr.ToString().c_str(), inv.ToString().c_str());
+            // One line per connection: ProcessMessages keeps draining the
+            // receive buffer after fDisconnect is set, so a peer that packs
+            // many forged bodies into one buffer must not get one log line
+            // for each of them.
+            if (!pfrom->fDisconnect)
+                printf("block fetch: a peer answered the request for %s with a body that is not "
+                       "that block -- dropping it\n", inv.hash.ToString().substr(0,14).c_str());
+            pfrom->fDisconnect = true;
+            return error("ProcessMessage() : forged block body for %s",
+                         inv.hash.ToString().substr(0,14).c_str());
+        }
+
         if (ProcessBlock(pfrom, pblock.release()))
         {
             mapAlreadyAskedFor.erase(inv);
 
+            // The body arrived and validated, so the fetch really is over:
+            // the block is now in mapBlockIndex, or parked in mapOrphanBlocks,
+            // and either way AlreadyHave answers for it from here on.
+            //
+            // This has to stay inside the success branch, next to the erase
+            // above. When validation rejects a body nothing is stored,
+            // AlreadyHave stays false, and the mapAskFor entry was already
+            // consumed when the getdata went out -- so erasing the tracking
+            // here would leave the block requested from nobody at all until
+            // some peer happened to re-announce it. That is exactly the stall
+            // of #33, and erasing before ProcessBlock made it reachable on
+            // demand.
+            mapBlockFetch.erase(inv.hash);
+
             // A peer that just handed us a block is demonstrably at least at
             // that block's height. Without this, nStartingHeight is a snapshot
             // taken once during the version handshake and never touched again,
@@ -3396,12 +3597,119 @@ bool SendMessages(CNode* pto)
             const CInv& inv = (*pto->mapAskFor.begin()).second;
             if (LogAcceptsCategory("net")) printf("sending getdata: %s\n", inv.ToString().c_str());
             if (!AlreadyHave(txdb, inv))
+            {
                 vAskFor.push_back(inv);
+                // Blocks get their delivery tracked so the failover pass
+                // below can chase the ones that go quiet.
+                if (inv.type == MSG_BLOCK)
+                {
+                    // Full, and this is a hash we are not already tracking:
+                    // make room rather than drop it on the floor, or one peer
+                    // announcing eight hashes turns failover off for everyone.
+                    if (!mapBlockFetch.count(inv.hash) &&
+                        mapBlockFetch.size() >= BLOCK_FETCH_TRACK_MAX)
+                        MakeRoomInBlockFetch(pto->addr);
+
+                    if (mapBlockFetch.count(inv.hash) ||
+                        mapBlockFetch.size() < BLOCK_FETCH_TRACK_MAX)
+                    {
+                        CBlockFetch& fetch = mapBlockFetch[inv.hash];
+                        if (fetch.nTimeFirstAsked == 0)
+                        {
+                            fetch.nTimeFirstAsked = GetTime();
+                            // Who is answerable for this hash existing. Set
+                            // once, on creation: the failover sweep asks other
+                            // peers later, and none of them chose to announce
+                            // it, so none of them should be charged for it.
+                            fetch.addrAnnounced = pto->addr;
+                        }
+                        fetch.nTimeAsked = GetTime();
+                        fetch.setAsked.insert(pto->addr);
+                    }
+                }
+            }
             pto->mapAskFor.erase(pto->mapAskFor.begin());
         }
         if (!vAskFor.empty())
             pto->PushMessage("getdata", vAskFor);
 
+
+        //
+        // Message: getdata (block fetch failover)
+        //
+        // A requested block that has not arrived in BLOCK_FETCH_RETRY_SECS is
+        // not still in transit -- a body is at most 1 MB and somebody
+        // demonstrably has it -- so ask somebody else instead of waiting on
+        // whoever was asked first (#33). Each peer the message handler visits
+        // takes at most one turn per block per round; once every connected
+        // peer has had its turn and a further interval passes with nobody
+        // new to ask, the round restarts. A peer that declared itself a
+        // client cannot serve block bodies and is no use as a target.
+        if (!pto->fClient)
+        {
+            vector<CInv> vFailover;
+            int64 nNowSecs = GetTime();
+            for (map<uint256, CBlockFetch>::iterator mi = mapBlockFetch.begin(); mi != mapBlockFetch.end();)
+            {
+                CBlockFetch& fetch = (*mi).second;
+                CInv inv(MSG_BLOCK, (*mi).first);
+                if (AlreadyHave(txdb, inv))
+                {
+                    // Arrived by some other road -- our own miner, an orphan
+                    // parked in mapOrphanBlocks. Nothing left to chase.
+                    mapBlockFetch.erase(mi++);
+                    continue;
+                }
+                if (nNowSecs - fetch.nTimeFirstAsked > BLOCK_FETCH_GIVEUP_SECS)
+                {
+                    printf("block fetch: giving up on %s -- no peer served it in %d s\n",
+                           inv.ToString().c_str(), (int)(nNowSecs - fetch.nTimeFirstAsked));
+                    mapBlockFetch.erase(mi++);
+                    continue;
+                }
+                if (nNowSecs - fetch.nTimeAsked >= BLOCK_FETCH_RETRY_SECS)
+                {
+                    // The handler loop visits every peer within ~100ms, so a
+                    // request stale by two full intervals means nobody outside
+                    // setAsked was there to ask. Start the round over.
+                    if (nNowSecs - fetch.nTimeAsked >= 2 * BLOCK_FETCH_RETRY_SECS)
+                        fetch.setAsked.clear();
+                    if (!fetch.setAsked.count(pto->addr))
+                    {
+                        // Which block, how long, and which peer we are trying
+                        // next. Behind the category because it names a peer
+                        // and a peer decides how often it is written.
+                        if (LogAcceptsCategory("net"))
+                            printf("block fetch failover: %s unanswered for %d s, re-requesting from %s\n",
+                                   inv.ToString().c_str(), (int)(nNowSecs - fetch.nTimeAsked),
+                                   pto->addr.ToString().c_str());
+
+                        // The unconditional half: no addresses, and at most
+                        // one line per BLOCK_FETCH_REPORT_SECS however hard a
+                        // peer tries. See the counters for the reasoning.
+                        nBlockFetchFailovers++;
+                        if (nNowSecs - nBlockFetchWindowStart >= BLOCK_FETCH_REPORT_SECS)
+                        {
+                            printf("block fetch: %d block request%s went unanswered and %s been "
+                                   "re-asked of other peers (%d tracked)\n",
+                                   nBlockFetchFailovers, nBlockFetchFailovers == 1 ? "" : "s",
+                                   nBlockFetchFailovers == 1 ? "has" : "have",
+                                   (int)mapBlockFetch.size());
+                            nBlockFetchWindowStart = nNowSecs;
+                            nBlockFetchFailovers   = 0;
+                        }
+
+                        vFailover.push_back(inv);
+                        fetch.nTimeAsked = nNowSecs;
+                        fetch.setAsked.insert(pto->addr);
+                    }
+                }
+                ++mi;
+            }
+            if (!vFailover.empty())
+                pto->PushMessage("getdata", vFailover);
+        }
+
     }
     return true;
 }
@@ -3662,6 +3970,14 @@ static void ParticipantHashWorker(ParticipantJobShared* sh, int idx, int nWorker
     RandomXDestroyMinerVM(vm);
 }
 
+// Run one participant session: resolve the pool, open the tunnel, subscribe,
+// hash, submit shares. Returns true only if the pool actually handed out work
+// -- at least one well-formed mining.notify arrived. Everything else is false,
+// including a tunnel that opened and was dropped before any job.
+//
+// The caller's reconnect backoff keys off this return value, so any path added
+// here that leaves the session without work MUST return false. "The session
+// ended tidily" is not the question being asked.
 static bool PoolParticipantMiner()
 {
     // ------------------------------------------------------------------
@@ -3739,6 +4055,33 @@ static bool PoolParticipantMiner()
     }
     LogPrint("worker", "[worker] pool resolved to meeting node %s\n", meetingHostPort.c_str());
 
+    // The descriptor names ONE meeting node, but the pool parks a
+    // registration at every relay it knows (one accept thread per relay,
+    // rpc.cpp:AcceptOneFn), so any seed relay can pair us. Insisting on the
+    // advertised entry forever turns one bad path into a miner that idles
+    // indefinitely while a working path exists (issue #17); after a few
+    // consecutive tunnel failures, rotate the seed relays into the attempts
+    // too. Only ONE participant session runs (StartMinerThreads), so these
+    // statics are single-threaded.
+    static const int TUNNEL_FAILOVER_AFTER = 3;
+    static int nTunnelFails = 0;      // consecutive tunnel failures, this pool
+    static size_t iFailoverRelay = 0; // rotation cursor over vBtfMeetingRelays
+    static std::string strFailPool;   // pool the counters belong to
+    if (strFailPool != strParticipantPool) {
+        strFailPool = strParticipantPool;
+        nTunnelFails = 0;
+        iFailoverRelay = 0;
+    }
+    if (nTunnelFails >= TUNNEL_FAILOVER_AFTER && !vBtfMeetingRelays.empty()) {
+        std::string alt = vBtfMeetingRelays[iFailoverRelay++ % vBtfMeetingRelays.size()];
+        if (alt != meetingHostPort) {
+            LogPrint("worker", "[worker] advertised meeting node %s failed %d"
+                     " times in a row -- trying seed relay %s instead\n",
+                     meetingHostPort.c_str(), nTunnelFails, alt.c_str());
+            meetingHostPort = alt;
+        }
+    }
+
     size_t colon = meetingHostPort.rfind(':');
     if (colon == std::string::npos) {
         LogPrint("worker", "[worker] bad meeting node format '%s'\n", meetingHostPort.c_str());
@@ -3758,15 +4101,18 @@ static bool PoolParticipantMiner()
     // Step 2b: open encrypted tunnel to pool
     // ------------------------------------------------------------------
     SetParticipantMiningStatus("opening tunnel");
+    btf::TunnelFail tunnelFail = btf::TUNNEL_FAIL_NONE;
     s = btf::BtfClientTunnel(host.c_str(), (unsigned short)port,
-                             target_pubkey, service_enc_pub);
+                             target_pubkey, service_enc_pub, &tunnelFail);
     if (s == INVALID_SOCKET) {
-        LogPrint("worker", "[worker] tunnel connect FAILED via %s"
-                 " (relay unreachable or pool not listening)\n",
-                 meetingHostPort.c_str());
-        SetParticipantMiningStatus("tunnel connect failed");
+        nTunnelFails++;
+        LogPrint("worker", "[worker] tunnel connect FAILED via %s: %s\n",
+                 meetingHostPort.c_str(), btf::TunnelFailText(tunnelFail));
+        SetParticipantMiningStatus(std::string("tunnel connect failed: ")
+                                   + btf::TunnelFailText(tunnelFail));
         return false;
     }
+    nTunnelFails = 0;
     LogPrint("worker", "[worker] tunnel open via %s\n", meetingHostPort.c_str());
     SetParticipantMiningStatus("tunnel open");
     }
@@ -3899,9 +4245,32 @@ connected:
     std::vector<ParticipantShareHit> shareHits;
     std::mutex shareHitsMtx;
     std::vector<std::thread> hashThreads;
-    for (int i = 0; i < nWorkers; i++)
-        hashThreads.emplace_back(ParticipantHashWorker, &jobShared, i, nWorkers,
-                                 &shareHits, &shareHitsMtx);
+    try
+    {
+        for (int i = 0; i < nWorkers; i++)
+            hashThreads.emplace_back(ParticipantHashWorker, &jobShared, i, nWorkers,
+                                     &shareHits, &shareHitsMtx);
+    }
+    catch (const std::system_error& e)
+    {
+        // A refused pthread_create used to reach std::terminate here and
+        // kill the worker mid-session -- observed twice on an otherwise
+        // healthy participant. Stop the workers that did start the same way
+        // the disconnect path below does, drop this pool connection, and let
+        // the caller's reconnect loop try again once the pressure clears.
+        LogPrint("worker", "[worker] cannot spawn hash threads (%s)"
+                 " -- dropping pool connection\n", e.what());
+        SetParticipantMiningStatus("hash thread spawn failed");
+        {
+            std::lock_guard<std::mutex> lk(jobShared.mtx);
+            jobShared.stop = true;
+            jobShared.haveJob = false;
+        }
+        for (std::thread& t : hashThreads)
+            t.join();
+        closesocket(s);
+        return false;
+    }
     LogPrint("worker", "[worker] spawned %d hash threads on shared RandomX dataset\n",
              nWorkers);
     const uint64 sessionStartHashes = gParticipantHashes.load();
@@ -3912,8 +4281,17 @@ connected:
     std::string jobId;
     unsigned char header[80] = {};
     uint256 target;
+    // Cached answer to "which block is this job built on", for the
+    // mining.notify handler below -- see the comment there. Session-local, so
+    // a reconnect re-resolves rather than trusting an answer obtained before
+    // a possible change of pool.
+    uint256 hashPrevResolved;           // prevhash the cached answer describes
+    bool fPrevResolved       = false;   // whether that answer exists yet
+    int  nPrevHeight         = -1;      // its height, or -1 == unknown to us
+    int  nBestHeightResolved = -1;      // nBestHeight when we last resolved
     double currentDifficulty = 1.0; // updated by mining.set_difficulty from pool
     bool haveJob         = false;
+    bool gotAnyJob       = false; // any job at all this session -- the return value
     bool gotSubscribeAck = false;
     bool gotAuthorizeAck = false;
     int64 authWaitStart  = 0;
@@ -4030,8 +4408,9 @@ connected:
                                     jobId = newJobId;
                                     memcpy(header, hdrBytes.data(), 80);
                                     memcpy(&target, tgtBytes.data(), 32);
-                                    haveJob = true;
-                                    nNonce  = 1;
+                                    haveJob   = true;
+                                    gotAnyJob = true;
+                                    nNonce    = 1;
                                     {
                                         std::lock_guard<std::mutex> lk(jobShared.mtx);
                                         memcpy(jobShared.header, header, 80);
@@ -4040,8 +4419,64 @@ connected:
                                         jobShared.jobSeq++;
                                         jobShared.haveJob = true;
                                     }
-                                    LogPrint("worker", "[pool->worker] new job %s received\n",
-                                             jobId.c_str());
+                                    // Log the chain position the pool is
+                                    // building on, so a stale or private
+                                    // fork is auditable from worker logs.
+                                    // The prevhash comes from the header we
+                                    // actually hash (== p[2] of the notify);
+                                    // a brief cs_main lookup is safe here --
+                                    // this thread holds no other lock.
+                                    //
+                                    // Resolving it is the expensive half, and
+                                    // this is the socket-reading thread: block
+                                    // validation can hold cs_main for a long
+                                    // time, and every moment spent waiting on
+                                    // it here is a moment set_difficulty and
+                                    // share responses are not being handled.
+                                    // Most notifies in a round are a new job
+                                    // on the SAME tip, so the answer is cached
+                                    // and re-resolved only when it could come
+                                    // out differently: a prevhash we have not
+                                    // resolved, or one we could NOT resolve
+                                    // last time while the chain has since
+                                    // moved (unknown -> known). A block's
+                                    // height is fixed once mapBlockIndex knows
+                                    // it, so a cached "known" never goes
+                                    // stale. nBestHeight is read unlocked on
+                                    // purpose -- it only decides whether to
+                                    // repeat a lookup, never what gets
+                                    // printed, so a stale read costs at most
+                                    // one deferred or one extra lookup.
+                                    // The line still prints in full for every
+                                    // job, cached or not.
+                                    uint256 hashPrev;
+                                    memcpy(&hashPrev, header + 4, 32);
+                                    if (LogAcceptsCategory("worker"))
+                                    {
+                                        int nBestHeightNow = nBestHeight;
+                                        if (!fPrevResolved
+                                            || hashPrev != hashPrevResolved
+                                            || (nPrevHeight < 0 && nBestHeightNow != nBestHeightResolved))
+                                        {
+                                            nPrevHeight = -1;
+                                            CRITICAL_BLOCK(cs_main)
+                                            {
+                                                map<uint256, CBlockIndex*>::iterator mi = mapBlockIndex.find(hashPrev);
+                                                if (mi != mapBlockIndex.end())
+                                                    nPrevHeight = (*mi).second->nHeight;
+                                            }
+                                            hashPrevResolved    = hashPrev;
+                                            nBestHeightResolved = nBestHeightNow;
+                                            fPrevResolved       = true;
+                                        }
+                                        if (nPrevHeight >= 0)
+                                            LogPrint("worker", "[pool->worker] new job %s received, prevhash %s (known, job height %d)\n",
+                                                     jobId.c_str(), hashPrev.GetHex().c_str(),
+                                                     nPrevHeight + 1);
+                                        else
+                                            LogPrint("worker", "[pool->worker] new job %s received, prevhash %s (unknown to our chain)\n",
+                                                     jobId.c_str(), hashPrev.GetHex().c_str());
+                                    }
                                     SetParticipantMiningStatus("hashing job " + jobId);
                                 }
                             }
@@ -4167,7 +4602,11 @@ connected:
              (unsigned long long)hashesSinceSample,
              (unsigned long long)sessionSharesSent,
              (unsigned long long)sessionSharesAccepted);
-    return true;
+    // Not "we got here", which is true of a tunnel the pool accepted and then
+    // dropped without ever sending a job -- exactly the case the caller's
+    // backoff exists for. Reaching the end of the session is not evidence the
+    // session was worth anything; a job is.
+    return gotAnyJob;
 }
 
 // ---------------------------------------------------------------------------
@@ -4364,11 +4803,51 @@ bool BitcoinMiner(int nThreadId)
     // Participant mode: connect to external pool instead of mining solo/operator
     if (nMineMode == MINE_PARTICIPANT)
     {
+        // An attempt that never got work backs off (10s doubling to 120s)
+        // instead of hammering the same path every flat 10s, and a streak
+        // lasting minutes is said at printf level: the identical once-per-10s
+        // LogPrint line is how a worker idled all night unnoticed (issue #17).
+        //
+        // Only a session the pool actually sent a job to resets either. The
+        // weaker test -- "the session returned" -- was gameable: a pool that
+        // completes the tunnel and drops without ever sending work leaves by
+        // the same tidy cleanup path a healthy one does, which would pin the
+        // retry at 10s forever and defeat the backoff in exactly the scenario
+        // it exists for.
+        int   nRetrySecs    = 10;
+        int64 nFailingSince = 0;
         while (fGenerateBitcoins && nMineMode == MINE_PARTICIPANT && !fShutdown) {
-            PoolParticipantMiner();
+            bool fGotWork = PoolParticipantMiner();
             if (fGenerateBitcoins && nMineMode == MINE_PARTICIPANT && !fShutdown) {
-                LogPrint("worker", "PoolParticipantMiner: reconnecting in 10s\n");
-                for (int i = 0; i < 10 && !fShutdown; i++) Sleep(1000);
+                if (fGotWork) {
+                    nRetrySecs    = 10;
+                    nFailingSince = 0;
+                } else {
+                    if (nFailingSince == 0)
+                        nFailingSince = GetTime();
+                    int64 nMins = (GetTime() - nFailingSince) / 60;
+                    if (nMins >= 1)
+                        printf("[worker] connection to pool %s has been failing"
+                               " for %lld minutes\n",
+                               strParticipantPool.c_str(), (long long)nMins);
+                }
+                LogPrint("worker", "PoolParticipantMiner: reconnecting in %ds\n",
+                         nRetrySecs);
+                // Poll everything the enclosing while polls, not just
+                // fShutdown. Raising the ceiling to 120s made a
+                // shutdown-only predicate expensive: after the operator
+                // clears Generate or switches to Relay, the session -- and
+                // the vfThreadRunning[3] slot that gates restarting it --
+                // would stay held for up to two minutes. Measured 119s
+                // before, 1s after.
+                for (int i = 0; i < nRetrySecs && !fShutdown && fGenerateBitcoins
+                                && nMineMode == MINE_PARTICIPANT; i++)
+                    Sleep(1000);
+                if (!fGotWork && nRetrySecs < 120) {
+                    nRetrySecs *= 2;
+                    if (nRetrySecs > 120)
+                        nRetrySecs = 120;
+                }
             }
         }
         return true;
@@ -4555,7 +5034,7 @@ bool BitcoinMiner(int nThreadId)
                     //// debug print
                     if (LogAcceptsCategory("net")) printf("BitcoinMiner:\n");
                     if (LogAcceptsCategory("net")) printf("RandomX proof-of-work found  \n  powhash: %s  \ntarget: %s\n", hash.GetHex().c_str(), hashTarget.GetHex().c_str());
-                    if (LogAcceptsCategory("net")) pblock->print();
+                    if (LogAcceptsCategory("relay")) pblock->print();
 
                 SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_NORMAL);
                 CRITICAL_BLOCK(cs_main)
diff --git a/src/main_gui.cpp b/src/main_gui.cpp
index 211e1e2..0e64985 100644
--- a/src/main_gui.cpp
+++ b/src/main_gui.cpp
@@ -111,6 +111,8 @@ static void PrintUsage()
     printf("  /help, -help, --help, /?\n");
     printf("  /datadir=PATH\n");
     printf("  /debug\n");
+    printf("  /debugrelay                (/debug plus per-message relay chatter and block dumps)\n");
+    printf("  /maxdebugfilesize=N        (roll debug.log at N MB, default 1024; 0 = never)\n");
     printf("  /gen\n");
     printf("  /nogui or /daemon\n");
     printf("  /selftest=wallet-keypool, wallet-hd, wallet-format, wallet-crypto, wallet-encrypt,\n");
@@ -191,6 +193,54 @@ static void ParseStartupArguments(int argc, char* argv[])
     if (arg(argc,argv,"/debug") || arg(argc,argv,"-debug"))
         fDebug = true;
 
+    // /debugrelay -- everything /debug shows, plus the per-message firehose
+    // ("relay" and "nostrdiscovery" categories: sending: tx, Relaying wtx,
+    // raw CBlock dumps, per-peer discovery lines). That traffic was ~90% of
+    // a 13-hour production debug.log (issue #35), so plain /debug leaves it
+    // off; the message text itself is unchanged for anyone grepping it.
+    if (arg(argc,argv,"/debugrelay") || arg(argc,argv,"-debugrelay"))
+    {
+        fDebug = true;
+        fDebugRelay = true;
+    }
+
+    // /maxdebugfilesize=N -- roll debug.log to debug.log.old once it passes
+    // N MB, checked on each write. Default is 1024 (see util.cpp); 0 turns
+    // the check off and leaves rotation entirely to logrotate.
+    string strMaxDebugSize = argval2(argc, argv, "/maxdebugfilesize", "-maxdebugfilesize");
+    if (!strMaxDebugSize.empty())
+    {
+        // Parsed with atoi64() before, which is strtoll() with the endptr
+        // thrown away: it returns 0 for anything it cannot read, so
+        // /maxdebugfilesize=1G and =1024MB both came out as 0 -- "never
+        // roll", identical to asking for that on purpose, with nothing said
+        // to the operator. The old code also multiplied without a range
+        // check, so a big enough N wrapped to a negative cap, which the roll
+        // reads as "off" too. Every rejection is now reported and leaves the
+        // default in place; the value is a plain count of MB, no suffix.
+        const char* psz = strMaxDebugSize.c_str();
+        char* pszEnd = NULL;
+        errno = 0;
+        int64 nMB = strtoll(psz, &pszEnd, 10);
+        // INT64_MAX, without depending on which limits header this tree pulls in.
+        const int64 nMaxMB = (int64)((~(uint64)0) >> 1) / (1024 * 1024);
+        const char* pszWhy = NULL;
+        if (pszEnd == psz)
+            pszWhy = "not a number";
+        else if (*pszEnd != '\0')
+            pszWhy = "trailing characters -- the value is a count of MB, with no unit suffix";
+        else if (errno == ERANGE || nMB < 0)
+            pszWhy = "not a size in MB";
+        else if (nMB > nMaxMB)
+            pszWhy = "larger than a file size can be";
+        if (pszWhy)
+            fprintf(stderr, "Ignoring /maxdebugfilesize=%s: %s (keeping %lld MB)\n",
+                    strMaxDebugSize.c_str(), pszWhy,
+                    (long long)(nMaxDebugFileSize / 1024 / 1024));
+        else
+            nMaxDebugFileSize = nMB * 1024 * 1024;
+    }
+
     if (arg(argc,argv,"/gen") || arg(argc,argv,"-gen"))
     {
         fGenerateBitcoins = 1;
diff --git a/src/net.cpp b/src/net.cpp
index fed6123..16038c8 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -2090,7 +2090,7 @@ bool StartNode(string& strError)
     if (addrIncoming.ip)
         addrLocalHost.ip = addrIncoming.ip;
 
-    _beginthread([](void*) {
+    if (_beginthread([](void*) {
         unsigned int ip = addrLocalHost.ip;
         if (GetMyExternalIP(ip)) {
             addrLocalHost.ip = ip;
@@ -2098,7 +2098,8 @@ bool StartNode(string& strError)
             CWalletDB().WriteSetting("addrIncoming", addrIncoming);
             printf("External IP updated: %s\n", addrLocalHost.ToStringIP().c_str());
         }
-    }, 0, NULL);
+    }, 0, NULL) == (uintptr_t)-1)
+        printf("Error: _beginthread(GetMyExternalIP) failed\n");
 
     // Peers that answered last time, dialled straight away. The relays are the
     // only way to find anyone otherwise, and reaching them plus walking their
diff --git a/src/net.h b/src/net.h
index 9f3c7e4..fc48d0b 100644
--- a/src/net.h
+++ b/src/net.h
@@ -23,6 +23,12 @@ enum
 
 
 
+// Defined in main.cpp. True while this node is tracking the tip rather than
+// still catching up, measured off the age of our own best block -- see there
+// for why that and not a peer-reported height. Declared here because net.h is
+// parsed before main.h and CNode::AskFor needs it.
+bool IsBlockFetchNearTip();
+
 bool GetMyExternalIP(unsigned int& ipRet);
 CNode* ConnectNodeBtf(const string& strBtfAddr);
 CNode* ConnectNodeBtfResolved(const string& strBtfAddr, const string& strMeeting,
@@ -89,6 +95,15 @@ static const int          BTF_RECV_TIMEOUT_SECS    = 30 * 60;
 static const int          BTF_SEND_STALL_SECS      = 10 * 60;
 static const int          BTF_HANDSHAKE_GRACE_SECS = 60;
 
+// How long a requested block gets before it is asked for again, in seconds.
+// Used twice: CNode::AskFor spaces the queued per-announcer block retries this
+// far apart instead of the two minutes transactions get, and the failover
+// sweep in main.cpp re-issues a getdata to a different peer once a sent
+// request has gone unanswered this long. A block body is at most 1 MB and
+// somebody demonstrably has it -- they announced it -- so on this timescale
+// "not here yet" means "not coming from that peer", not "still in transit".
+static const int          BLOCK_FETCH_RETRY_SECS   = 15;
+
 // A serialized object cannot be larger than MAX_SIZE, so no valid network
 // message needs the old 256 MB header allowance. Keep the wire cap aligned with
 // what the deserializer can accept. How long a peer may sit on a partial
@@ -795,13 +810,51 @@ public:
         static int64 nLastTime;
         nLastTime = nNow = max(nNow, ++nLastTime);
 
-        // Each retry is 2 minutes after the last
-        nRequestTime = max(nRequestTime + 2 * 60 * 1000000, nNow);
+        // Each retry is 2 minutes after the last -- and because nRequestTime
+        // is shared across peers, the same spacing is what strings requests
+        // for one inv across its announcers. For transactions that is pacing;
+        // for a new block it was the stall of issue #33: nine peers announce
+        // the block, the first one asked does not serve it, and the ninth
+        // candidate is not even asked until sixteen minutes in, with the pool
+        // mining on the stale tip the whole time.
+        //
+        // Blocks retry on the fetch timescale, but only while we are at the
+        // tip. That is where the stall costs something -- the pool keeps
+        // handing out jobs against a dead tip -- and it is also where the
+        // spacing is nearly free: one block is in flight, and its body has
+        // almost always arrived before the second announcer's turn comes
+        // round, so AlreadyHave drops the duplicate before a getdata is sent.
+        //
+        // While catching up neither half holds. A peer working through a
+        // 500-deep queue can be minutes away from block N without anything
+        // being wrong, so at 15s the second announcer is asked at +15s, the
+        // third at +30s, and the bulk download arrives once per announcer --
+        // up to eight times over. Nothing caps that: the eight-entry cap is on
+        // mapBlockFetch, which is a different mechanism from this spacing.
+        // Two minutes is the right number there, and it is what this line did
+        // before. Failover at the tip does not depend on this being 15s in any
+        // case: mapBlockFetch re-issues a stalled getdata to the next peer on
+        // its own timer, which is what actually fixes #33.
+        bool fFast = (inv.type == MSG_BLOCK && IsBlockFetchNearTip());
+        int64 nRetryUsecs = (fFast ? BLOCK_FETCH_RETRY_SECS : 2 * 60) * 1000000LL;
+        nRequestTime = max(nRequestTime + nRetryUsecs, nNow);
         mapAskFor.insert(make_pair(nRequestTime, inv));
     }
 
 
 
+    // "sending: tx (N bytes)" alone was ~71% of a 13-hour production
+    // debug.log (issue #35), so tx sends are demoted to the /debugrelay-gated
+    // "relay" category; every other command's send trace stays on "net".
+    // The line is emitted in pieces across BeginMessage/EndMessage/
+    // AbortMessage, so all three must agree on the category or orphaned
+    // "(N bytes)" fragments would leak into a plain -debug log.
+    // Valid only mid-message (nPushPos != -1).
+    const char* SendLogCategory() const
+    {
+        return strcmp(GetMessageCommand(), "tx") == 0 ? "relay" : "net";
+    }
+
     void BeginMessage(const char* pszCommand)
     {
         EnterCriticalSection(&cs_vSend);
@@ -809,17 +862,19 @@ public:
             AbortMessage();
         nPushPos = vSend.size();
         vSend << CMessageHeader(pszCommand, 0);
-        if (LogAcceptsCategory("net")) printf("sending: %-12s ", pszCommand);
+        if (LogAcceptsCategory(SendLogCategory())) printf("sending: %-12s ", pszCommand);
     }
 
     void AbortMessage()
     {
         if (nPushPos == -1)
             return;
+        // Capture before nPushPos is cleared; GetMessageCommand() needs it.
+        const char* pszCategory = SendLogCategory();
         vSend.resize(nPushPos);
         nPushPos = -1;
         LeaveCriticalSection(&cs_vSend);
-        if (LogAcceptsCategory("net")) printf("(aborted)\n");
+        if (LogAcceptsCategory(pszCategory)) printf("(aborted)\n");
     }
 
     void EndMessage()
@@ -827,7 +882,11 @@ public:
         extern int nDropMessagesTest;
         if (nDropMessagesTest > 0 && GetRand(nDropMessagesTest) == 0)
         {
-            if (LogAcceptsCategory("net")) printf("dropmessages DROPPING SEND MESSAGE\n");
+            // Same category as the "sending: " this line interrupts, so a tx
+            // does not announce its own drop under "net" having been gated
+            // off under "relay". nPushPos can be -1 here, and then
+            // GetMessageCommand() returns "" and this is "net" as before.
+            if (LogAcceptsCategory(SendLogCategory())) printf("dropmessages DROPPING SEND MESSAGE\n");
             AbortMessage();
             return;
         }
@@ -839,10 +898,10 @@ public:
         unsigned int nSize = vSend.size() - nPushPos - sizeof(CMessageHeader);
         memcpy((char*)&vSend[nPushPos] + offsetof(CMessageHeader, nMessageSize), &nSize, sizeof(nSize));
 
-        if (LogAcceptsCategory("net")) printf("(%d bytes)  ", nSize);
+        if (LogAcceptsCategory(SendLogCategory())) printf("(%d bytes)  ", nSize);
         //for (int i = nPushPos+sizeof(CMessageHeader); i < min(vSend.size(), nPushPos+sizeof(CMessageHeader)+20U); i++)
         //    printf("%02x ", vSend[i] & 0xff);
-        if (LogAcceptsCategory("net")) printf("\n");
+        if (LogAcceptsCategory(SendLogCategory())) printf("\n");
 
         nPushPos = -1;
         LeaveCriticalSection(&cs_vSend);
diff --git a/src/nostr.cpp b/src/nostr.cpp
index e2d839c..f44dc08 100644
--- a/src/nostr.cpp
+++ b/src/nostr.cpp
@@ -151,6 +151,19 @@ string BtfActiveRelay()
 
 void BtfSetActiveRelay(const string& relay)
 {
+    // With /rvrelay set, the descriptor must never name anything but the pin.
+    // No caller can reach here with another relay today -- both registration
+    // paths draw their list from BtfAllRelays(), which returns the pin alone --
+    // but the descriptor is the one thing a miner obeys, so the invariant is
+    // enforced at the sink instead of being retrusted to every future caller.
+    if (fBtfRelayPinned &&
+        find(vBtfMeetingRelays.begin(), vBtfMeetingRelays.end(), relay) == vBtfMeetingRelays.end())
+    {
+        LogPrint("pool", "refusing to advertise meeting relay %s: /rvrelay pins %s\n",
+                 relay.c_str(),
+                 vBtfMeetingRelays.empty() ? "an empty list" : vBtfMeetingRelays[0].c_str());
+        return;
+    }
     CRITICAL_BLOCK(cs_activeRelay)
         strBtfActiveRelay = relay;
 }
@@ -223,6 +236,18 @@ vector<string> BtfAllRelays()
     return all;
 }
 
+// Relays learned from Nostr, whether or not a pin is in force. Reporting only:
+// it exists so the pool can name what /rvrelay is excluding. Anything choosing
+// a relay to register or dial at must keep using BtfAllRelays().
+vector<string> BtfDiscoveredRelays()
+{
+    vector<string> out;
+    CRITICAL_BLOCK(cs_discoveredRelays)
+        foreach(const string& r, g_discoveredRelays)
+            out.push_back(r);
+    return out;
+}
+
 
 //
 // Utilities
@@ -1440,7 +1465,7 @@ static bool SeedFromRelay(CNostrKey& key, const string& relay)
                         else if (createdAt > it->second)  it->second = createdAt; // refresh
                     }
                     if (fNew && fDebug)
-                        LogPrint("nostr", "Nostr: discovered .btf peer %s\n", peerAddr.c_str());
+                        LogPrint("nostrdiscovery", "Nostr: discovered .btf peer %s\n", peerAddr.c_str());
                     if (++nPeers > 500) break;
                 }
                 else if (type == "EOSE")
diff --git a/src/nostr.h b/src/nostr.h
index 6dbbe26..0dd919d 100644
--- a/src/nostr.h
+++ b/src/nostr.h
@@ -60,6 +60,9 @@ extern bool fBtfRelayPinned;
 bool LooksLikeRelay(const std::string& r);
 // Every relay to try: curated seeds + relays discovered from Nostr announcements.
 std::vector<std::string> BtfAllRelays();
+// Relays discovered from Nostr, ignoring the pin. For reporting what a pin
+// excludes -- never for choosing a relay to register or dial at.
+std::vector<std::string> BtfDiscoveredRelays();
 
 struct BtfPoolAnnouncement
 {
diff --git a/src/randomx_pow.cpp b/src/randomx_pow.cpp
index 1d058d4..9c59364 100644
--- a/src/randomx_pow.cpp
+++ b/src/randomx_pow.cpp
@@ -8,6 +8,7 @@
 #include <thread>
 #include <vector>
 #include <mutex>
+#include <system_error>
 
 // Fixed key (seed) that determines the RandomX cache/dataset. Keeping it
 // constant avoids per-epoch "reseed" logic; for the CPU+RAM fairness goal
@@ -101,13 +102,28 @@ bool RandomXInitDataset(int nThreads)
 
     std::vector<std::thread> workers;
     unsigned long per = total / nThreads;
-    for (int i = 0; i < nThreads; i++)
+    try
     {
-        unsigned long start = i * per;
-        unsigned long count = (i == nThreads - 1) ? (total - start) : per;
-        workers.emplace_back([start, count]() {
-            randomx_init_dataset(g_dataset, g_cache, start, count);
-        });
+        for (int i = 0; i < nThreads; i++)
+        {
+            unsigned long start = i * per;
+            unsigned long count = (i == nThreads - 1) ? (total - start) : per;
+            workers.emplace_back([start, count]() {
+                randomx_init_dataset(g_dataset, g_cache, start, count);
+            });
+        }
+    }
+    catch (const std::system_error& e)
+    {
+        // Same refusal as the allocation failure above: light mode is slow
+        // but alive, std::terminate is neither. Join the workers that did
+        // start before releasing the dataset out from under them.
+        for (auto& w : workers) w.join();
+        randomx_release_dataset(g_dataset);
+        g_dataset = NULL;
+        printf("RandomX: cannot spawn dataset init threads (%s), staying in light mode\n",
+               e.what());
+        return false;
     }
     for (auto& w : workers) w.join();
 
diff --git a/src/readme.txt b/src/readme.txt
index 752be66..7490a9a 100644
--- a/src/readme.txt
+++ b/src/readme.txt
@@ -16,7 +16,7 @@ This product includes software developed by the OpenSSL Project.
 Differences from the original Bitcoin
 -------------------------------------
 - Own genesis block (22/Jul/2026 headline, independent chain)
-- Own magic bytes (0xbf 0x1a 0x5c 0xfd) and P2P port 8433
+- Own magic bytes (0xbf 0x20 0x5c 0xfd) and P2P port 8433
 - Addresses start with "B" (ADDRESSVERSION = 25)
 - Consensus fixes applied: value overflow (CVE-2010-5139), duplicate inputs,
   money range checks (MoneyRange)
diff --git a/src/rpc.cpp b/src/rpc.cpp
index be6c80d..1d53fb2 100644
--- a/src/rpc.cpp
+++ b/src/rpc.cpp
@@ -115,15 +115,28 @@ static uint256 ShareTargetFromDifficulty(double difficulty)
 {
     if (difficulty <= 0.0) difficulty = 1.0;
     static const uint256 diff1 = CBigNum(bnProofOfWorkLimit).getuint256();
+    // Representability floor. shareTarget = diff1 / difficulty, and diff1 is
+    // ~uint256(0) >> 12, i.e. a hair under 2^244 -- so the true target stops
+    // fitting in a uint256 once difficulty reaches 2^-12 (= 1/4096), and the
+    // fixed-point divide below breaks even earlier in a second way: the
+    // (uint64)(difficulty * 65536.0) divisor truncates to zero for any
+    // difficulty under 2^-16. Both thresholds sit far below VARDIFF_MIN
+    // (0.001), so live operation never comes near this, but a caller that
+    // bypasses vardiff (or a future VARDIFF_MIN) must not divide by zero or
+    // hand back getuint256()'s low-256-bit truncation of an oversized
+    // quotient -- a wrapped target is not merely wrong, it is arbitrarily
+    // HARDER than difficulty 1. At these difficulties every hash is meant to
+    // be a share, so the honest answer is the easiest representable target.
+    // (This replaces a dead branch that read `if (t < diff1 && difficulty <
+    // 1.0)`: t = diff1/difficulty, so difficulty < 1.0 implies t > diff1 and
+    // the two conditions could never both hold.)
+    if (difficulty < 1.0 / 4096.0) return ~uint256(0);
     // shareTarget = diff1 / difficulty
     CBigNum bn; bn.setuint256(diff1);
     // Multiply by 2^16 to keep precision, divide, shift back
     bn <<= 16;
     bn /= (uint64)(difficulty * 65536.0);
-    uint256 t = bn.getuint256();
-    // Cap at all-ones (maximum, easiest possible)
-    if (t < diff1 && difficulty < 1.0) t = ~uint256(0);
-    return t;
+    return bn.getuint256();
 }
 
 // Expected number of hashes to find one share at a given Stratum difficulty,
@@ -223,6 +236,29 @@ static bool RebuildJob()
         // From the pool, so the template's payout key is in wallet.dat before
         // any miner is handed work against it.
         vector<unsigned char> vchPubKey = GetKeyFromPool();
+        if (vchPubKey.empty()) {
+            // Empty means the wallet could not produce a key: encrypted and
+            // locked, or key generation itself failed. Serialised, an empty
+            // vector is a zero-length push, so the coinbase would become
+            // `<empty> OP_CHECKSIG` -- a script nobody can satisfy. Every
+            // block mined against such a job burns its whole subsidy, while
+            // QueuePayouts still records the full obligation and the miners
+            // are then paid out of coin that block never contributed.
+            // BitcoinMiner refuses to mine in this state; refuse to hand the
+            // pool's miners work in it too. printf and not LogPrint for the
+            // reason given above the deaf-node refusal, and throttled the
+            // same way -- the no-job watchdog retries every few seconds for
+            // as long as the condition lasts.
+            static int64 nLastSaidNoKey = 0;
+            if (GetTime() - nLastSaidNoKey > 60) {
+                nLastSaidNoKey = GetTime();
+                printf("RebuildJob: no wallet key available for the coinbase "
+                       "(wallet locked, or key generation failed -- the "
+                       "GetKeyFromPool line above says which) -- not issuing "
+                       "jobs\n");
+            }
+            return false;
+        }
         static std::atomic<uint32_t> sExtra{0};
         uint32_t extraNonce = ++sExtra;
 
@@ -1832,7 +1868,9 @@ static void FlushMaturePayouts()
             }
             int64 total = 0;
             for (auto& kv : it->amounts) total += kv.second;
-            LogPrint("payout", "[payout] block %d (%s) was orphaned -- voiding %zu"
+            // Always: one line per voided entry, never a collapsed summary.
+            // A reorg voids these in a burst from this one source line.
+            LogPrintAlways("payout", "[payout] block %d (%s) was orphaned -- voiding %zu"
                      " payment(s) totalling %s\n",
                      it->blockHeight, it->blockHash.ToString().substr(0, 14).c_str(),
                      it->amounts.size(), FormatMoney(total).c_str());
@@ -2031,7 +2069,7 @@ static void RecordPayoutTxid(const PayingRecord& r, const std::string& txid)
 // disagreeing.
 static void ForfeitPayoutRecipient(const PayingRecord& r, const std::string& reason)
 {
-    LogPrint("payout", "[payout] writing off %s owed to %s for block %d: %s\n",
+    LogPrintAlways("payout", "[payout] writing off %s owed to %s for block %d: %s\n",
              FormatMoney(r.amount).c_str(), r.address.c_str(), r.blockHeight,
              reason.c_str());
     VersionedBlob blob;
@@ -2136,7 +2174,7 @@ static void PayoutThreadFn(void*)
             // funding block can land at any point in that window. Upstream has
             // no equivalent -- it decides once, when the entry matures.
             if (!PayoutBlockStillOnChain(r.blockHash)) {
-                LogPrint("payout", "[payout] block %d (%s) orphaned while queued"
+                LogPrintAlways("payout", "[payout] block %d (%s) orphaned while queued"
                          " -- dropping %s to %s\n",
                          r.blockHeight, r.blockHash.ToString().substr(0, 14).c_str(),
                          FormatMoney(r.amount).c_str(), r.address.c_str());
@@ -2180,7 +2218,7 @@ static void PayoutThreadFn(void*)
                 const std::string reason =
                     strprintf("'%s' is not a valid address, so no transaction"
                               " can pay it", r.address.c_str());
-                LogPrint("payout", "[payout] SKIPPED bad address '%s' --"
+                LogPrintAlways("payout", "[payout] SKIPPED bad address '%s' --"
                          " %s owed for block %d cannot be paid\n",
                          r.address.c_str(), FormatMoney(r.amount).c_str(),
                          r.blockHeight);
@@ -2316,7 +2354,7 @@ static void PayoutThreadFn(void*)
                 // described by at least one of them at every instant.
                 RecordPayoutTxid(r, wtx.GetHash().GetHex());
                 ForgetPayment(r);
-                LogPrint("payout", "[payout] paid %s to %s (tx %s)\n",
+                LogPrintAlways("payout", "[payout] paid %s to %s (tx %s)\n",
                          FormatMoney(r.amount).c_str(), r.address.c_str(),
                          wtx.GetHash().ToString().substr(0, 12).c_str());
             } else {
@@ -2374,7 +2412,7 @@ static void PayoutThreadFn(void*)
                     // going away must not turn the log into one line a minute
                     // forever, and must not go quiet either.
                     if (r.retries <= 5 || r.retries % 60 == 0)
-                        LogPrint("payout", "[payout] FAILED to pay %s to %s"
+                        LogPrintAlways("payout", "[payout] FAILED to pay %s to %s"
                                  " (%s spendable, wallet unlocked, block %d on"
                                  " the main chain) -- attempt %d, retrying in"
                                  " 60s; this debt stands until it is paid\n",
@@ -2582,6 +2620,31 @@ static const double VARDIFF_MAX               = 1e12;
 static const int64  VARDIFF_STALL_SECS        = 45;  // 3x share target -- reacts faster without false-triggering on normal variance
 static const double VARDIFF_STALL_CUT         = 4.0; // divide difficulty by this much
 
+// #7: m->hashRate is an EWMA sampled only when a share arrives, so a miner
+// that stops hashing keeps its last estimate forever and RefreshStats sums
+// it into the announced pool total for as long as the connection sits open
+// -- the published pool hashrate ran several times over ground truth
+// because of exactly this. MinerReportedHashRate() below applies the
+// policy: a miner gets a grace of HASHRATE_IDLE_MISSES expected share
+// intervals (expected interval = expected hashes per share at its
+// difficulty, divided by the estimate itself) with no share, after which
+// the figure we report falls off with a half-life of one more such
+// interval. The interval is clamped to [HASHRATE_MIN_INTERVAL,
+// HASHRATE_MAX_INTERVAL] so a fast miner at the vardiff floor (expected
+// interval of milliseconds) is not punished for ordinary share-delivery
+// jitter, and a very slow miner's grace does not stretch past the point
+// where its estimate means anything. At the vardiff target of one share
+// per 15s that is a minute of grace, half the rate reported 75s in, and
+// nothing reported after about seventeen minutes of silence.
+static const double HASHRATE_IDLE_MISSES  = 4.0;    // grace, in expected share intervals
+static const double HASHRATE_MIN_INTERVAL = 1.0;    // seconds; floor for the expected interval
+static const double HASHRATE_MAX_INTERVAL = 3600.0; // seconds; ceiling for the expected interval
+// Half-lives past the grace beyond which we report a flat zero. 2^-64 of the
+// original estimate is not a number anyone needs, and stopping here keeps
+// pow() from walking down into the denormals for a miner that has been quiet
+// for hours.
+static const double HASHRATE_DECAY_CUTOFF = 64.0;
+
 struct Miner {
     btf_socket_t fd;
     bool         authorised    = false;
@@ -2609,11 +2672,80 @@ struct Miner {
     int64        lastShareTime  = 0;     // GetTime() of the previous accepted share
     double       hashRate       = 0.0;   // smoothed H/s estimate
 
+    // Replay guard for mining.submit (#8): nonces already credited on this
+    // connection for the job it is currently working. Keyed to the job id in
+    // seenNoncesJob and cleared by SendJob whenever that id changes, so a
+    // resubmission under a NEW job is never turned away, while a replayed
+    // (job_id, nonce) pair under the same job is refused before it can be
+    // credited twice into roundShareCount -- the figure the payout split
+    // divides by.
+    std::set<uint32_t> seenNonces;
+    std::string        seenNoncesJob;
+
     explicit Miner(btf_socket_t f)
         : fd(f), connectTime(GetTime()),
           extranonce2(gNextExtranonce2.fetch_add(1)) {}
 };
 
+// What we publish as a miner's H/s: the last EWMA sample, faded out if shares
+// have stopped arriving (#7, policy at HASHRATE_IDLE_MISSES).
+//
+// This reads m->hashRate and never writes it. That is the whole design. The
+// first attempt decayed the stored estimate in place from the event loop's
+// sweep, which put a running accumulator behind a figure that is only ever
+// displayed, and the accumulator misbehaved in two ways:
+//
+//   - `expected` was recomputed from the already-decayed estimate on every
+//     pass, so each decay raised `expected`, which raised `grace`, which is
+//     the very thing gating the next decay. `grace` simply chased `silent`
+//     upward and the reported rate settled into a 1/t crawl instead of the
+//     half-life curve the comment above promises -- 291x too high at ten
+//     half-lives past the grace. Issue #7 is about the pool over-reporting;
+//     that under-corrected it for hours.
+//   - Once `expected` reached HASHRATE_MAX_INTERVAL it could not rise any
+//     further, the feedback that had been gating each pass was gone, and the
+//     decay began compounding once a second against the total elapsed
+//     silence -- taking a miner from 0.4% of its baseline to 1e-11 of it in
+//     the next hundred seconds, four hours in, for no reason a reader of
+//     either the code or the announced number could see.
+//
+// Computing the value instead of accumulating it removes the failure mode
+// rather than tuning it: with no stored decay state there is nothing for a
+// tick rate, a missed pass or a duplicated pass to perturb, and the answer
+// depends only on how long the miner has actually been quiet. It also keeps
+// the fade out of the estimator -- the EWMA on the share path still blends
+// against the value it last computed, not against a faded copy of it, so a
+// miner that resumes recovers on exactly the curve it would have without any
+// of this.
+//
+// `now` is a parameter rather than a GetTime() call so that one refresh fades
+// every miner to the same instant, and so the policy is directly testable.
+static double MinerReportedHashRate(const Miner* m, int64 now)
+{
+    // Nothing sampled yet: a fresh connection, or one that has found a single
+    // share and so has no interval to have been timed over. Nothing to fade,
+    // and nothing to divide by below.
+    if (m->hashRate <= 0.0 || m->lastShareTime <= 0) return m->hashRate;
+
+    double expected = ExpectedHashesForDifficulty(m->difficulty) / m->hashRate;
+    // Written so that a NaN would land on the floor rather than sail through:
+    // the clamp is what guarantees `expected` is finite and strictly positive
+    // below, whatever the division produced.
+    if (!(expected > HASHRATE_MIN_INTERVAL)) expected = HASHRATE_MIN_INTERVAL;
+    if (expected > HASHRATE_MAX_INTERVAL)    expected = HASHRATE_MAX_INTERVAL;
+
+    double silent = (double)(now - m->lastShareTime);
+    double grace  = HASHRATE_IDLE_MISSES * expected;
+    // grace is at least HASHRATE_IDLE_MISSES seconds, so a clock that has
+    // stepped backwards gives a negative `silent`, takes this branch, and
+    // reports the sample unchanged. Nothing here can scale an estimate up.
+    if (!(silent > grace)) return m->hashRate;
+
+    double halflives = (silent - grace) / expected;
+    if (halflives >= HASHRATE_DECAY_CUTOFF) return 0.0;
+    return m->hashRate * pow(0.5, halflives);
+}
+
 static std::vector<Miner*> gMiners;
 
 struct FoundBlock { int height; int64 ts; std::string addr; };
@@ -2664,6 +2796,18 @@ static void LocalAcceptFn(void*)
                 break;
             continue;
         }
+        // #6: let the OS probe a peer that has gone silent, so a half-open
+        // session eventually errors out of recv and lands in the event
+        // loop's existing reap path instead of sitting in gMiners forever.
+        // This is a backstop, not the mechanism: the default cadence before
+        // the first probe is hours on most stacks, so the idle timeout in
+        // PoolEventLoop fires long before keepalive does. Miners arriving
+        // via a relay ride a loopback socket pair whose remote transport is
+        // the rendezvous socket owned by the tunnel pump threads; keepalive
+        // cannot reach across that, which is part of why the idle timeout
+        // exists.
+        int keepalive = 1;
+        setsockopt(c, SOL_SOCKET, SO_KEEPALIVE, (char*)&keepalive, sizeof(keepalive));
         LogPrint("pool", "[pool] miner arrived via loopback -- pushing to event loop\n");
         PushReady((btf_socket_t)c);
     }
@@ -2707,6 +2851,16 @@ static const int64 POOL_ACTIVE_WINDOW     = 300; // a miner is "active" if it
 static const int64 POOL_UNAUTH_GRACE_SECS = 60;  // a connection still not
                                                  // authorized after this long is
                                                  // idle, not merely starting up
+// #6: a Miner used to leave gMiners only when RecvLine reported a clean
+// disconnect. A half-open session (miner host died, NAT state expired,
+// cable pulled) sends no FIN and reports no error, so it sat in the table
+// forever -- authorize outpaced disconnect 2:1 on the live pool, and the
+// table grew toward MAX_POOL_MINERS, past which real miners are refused.
+// lastSeen is stamped on every complete line received; a miner that has
+// said nothing for this long is gone in every way that matters. Ten
+// minutes is far beyond the vardiff target (a share every 15s) and the
+// stall watchdog (45s), so no miner that is actually hashing comes close.
+static const int64 POOL_IDLE_TIMEOUT_SECS = 600;
 
 // Non-blocking recv: pull whatever bytes are available now into buf, then
 // return one complete line if one is ready. Three outcomes:
@@ -2791,6 +2945,17 @@ static json MakeNotifyParams(const StratumJob& job, const CBlock& b,
 static void SendJob(Miner* m, bool clean)
 {
     if (!gHaveJob) return;
+    // Every path that hands a miner a new job funnels through here, so this
+    // is the one place the replay guard needs to follow the job id: nonces
+    // credited under the previous job mean nothing under the new one. Keying
+    // the clear to the id (rather than clearing unconditionally) keeps a
+    // same-job re-notify -- the vardiff retarget and stall watchdog both
+    // re-send the CURRENT job -- from reopening the duplicate window it
+    // exists to close.
+    if (m->seenNoncesJob != gCurrentJob.jobId) {
+        m->seenNonces.clear();
+        m->seenNoncesJob = gCurrentJob.jobId;
+    }
     CBlock mb = BuildMinerBlock(gCurrentJob, m->extranonce2);
     // Use this miner's own shareTarget (set by vardiff) in the notify params.
     // The participant miner reads p[3] as its share target, and HandleLine
@@ -3049,6 +3214,22 @@ static bool HandleLine(Miner* m, const std::string& rawLine,
         }
         unsigned int nNonce; memcpy(&nNonce, nb.data(), 4);
 
+        // Reject a replayed (job, nonce) before it costs a rebuild and a
+        // RandomX hash: nothing about the work below distinguishes a second
+        // submission of a valid share from the first, so without this check
+        // it passes every test and is credited again -- and roundShareCount
+        // is what the payout split divides by, so each replay multiplies the
+        // address's cut of the round. The set is per-connection and cleared
+        // by SendJob on every job change, so only a same-job repeat is
+        // refused.
+        if (m->seenNonces.count(nNonce)) {
+            LogPrint("worker", "[worker->pool] duplicate share from %s"
+                     " nonce=%u job=%s -- already credited, not counting again\n",
+                     m->address.c_str(), nNonce, submitJobId.c_str());
+            reply(false, "Duplicate share");
+            return true;
+        }
+
         // Rebuild this miner's exact block (unique merkle via extranonce2)
         CBlock b = BuildMinerBlock(gCurrentJob, m->extranonce2);
         b.nNonce = nNonce;
@@ -3076,6 +3257,7 @@ static bool HandleLine(Miner* m, const std::string& rawLine,
         m->roundShares++;
         m->totalShares++;
         m->vardiffShares++;
+        m->seenNonces.insert(nNonce); // replay guard: credit each nonce once per job
         int64 shareTime = GetTime();
         m->lastSeen = shareTime;
         roundShareCount[m->address]++;
@@ -4938,6 +5120,82 @@ int RunPoolStratumSelfTest()
     strPoolRoundsFile = savedRoundsFile;
     gPoolRounds = savedRounds;
 
+    // -- hashrate decay (#7) --------------------------------------------------
+    // The first version of this decayed m->hashRate in place from the event
+    // loop's sweep, which made the reported figure a function of how the loop
+    // happened to run rather than of how long the miner had been quiet. These
+    // pin the properties that fixes: sampling changes nothing, and the answer
+    // depends only on elapsed silence.
+    {
+        // A miner exactly on the vardiff target: 4096 hashes per share at
+        // difficulty 1.0, one share per 15s, so 4096/15 H/s. Its expected
+        // interval is 15s and its grace is 60s.
+        const double base = 4096.0 / 15.0;
+        const int64  t0   = 1766000000; // any plausible non-zero wall clock
+        Miner decayed(INVALID_SOCKET);
+        decayed.difficulty    = 1.0;
+        decayed.hashRate      = base;
+        decayed.lastShareTime = t0;
+
+        check(MinerReportedHashRate(&decayed, t0 + 60) == base,
+              "hashrate decay: a miner inside its grace period reports its full estimate");
+
+        // Sampling must not consume the estimate. Twenty passes is one second
+        // of the event loop's old sweep; a thousand is nearly a minute of it.
+        double once = MinerReportedHashRate(&decayed, t0 + 61);
+        bool idempotent = (decayed.hashRate == base);
+        for (int i = 0; i < 1000 && idempotent; i++)
+            idempotent = (MinerReportedHashRate(&decayed, t0 + 61) == once) &&
+                         (decayed.hashRate == base);
+        check(idempotent,
+              "hashrate decay: repeated sampling returns one value and leaves the estimate alone");
+
+        // One second past a 60s grace is 1/15th of a half-life: ~4.5% off, not
+        // the estimate gone. A miner at the vardiff target overshoots its grace
+        // roughly 1.8% of the time (e^-4) purely by share-timing variance, and
+        // must not be zeroed for it.
+        check(once > 0.94 * base && once < 0.96 * base,
+              "hashrate decay: one second past grace costs a few percent, not the estimate");
+        double three = MinerReportedHashRate(&decayed, t0 + 63);
+        check(three > 0.86 * base && three < 0.88 * base,
+              "hashrate decay: three seconds past grace costs ~13%");
+
+        // One half-life past the grace is exactly half.
+        double half = MinerReportedHashRate(&decayed, t0 + 75);
+        check(half > 0.499 * base && half < 0.501 * base,
+              "hashrate decay: one expected interval past grace halves the estimate");
+
+        // A miner that has genuinely stopped ends up reported as nothing --
+        // the whole point of #7. The old in-place version could not get here:
+        // its decay fed back into its own grace and settled into a 1/t crawl.
+        check(MinerReportedHashRate(&decayed, t0 + 3600) == 0.0,
+              "hashrate decay: a miner silent for an hour is reported as zero");
+
+        // A clock that steps backwards must never inflate what we announce.
+        check(MinerReportedHashRate(&decayed, t0 - 3600) == base,
+              "hashrate decay: a backwards clock reports the estimate unchanged, never higher");
+
+        // Fresh connection, and a connection with one share and so no interval
+        // to have timed: both must report nothing rather than divide by zero.
+        Miner fresh(INVALID_SOCKET);
+        check(MinerReportedHashRate(&fresh, t0) == 0.0,
+              "hashrate decay: a miner that never submitted a share reports zero");
+        Miner single(INVALID_SOCKET);
+        single.lastShareTime = t0;
+        check(MinerReportedHashRate(&single, t0 + 86400) == 0.0,
+              "hashrate decay: a miner with no rate sample yet reports zero");
+
+        // Nothing in the swept range may produce a NaN, an infinity, a negative
+        // rate, or a rate above the estimate it started from.
+        bool finite = true;
+        for (int64 s = -100; s < 200000 && finite; s += 37) {
+            double v = MinerReportedHashRate(&decayed, t0 + s);
+            finite = !std::isnan(v) && !std::isinf(v) && v >= 0.0 && v <= base;
+        }
+        check(finite,
+              "hashrate decay: stays finite, non-negative and non-amplifying across a long silence");
+    }
+
     gCurrentJob = savedJob;
     gHaveJob = savedHaveJob;
 
@@ -4965,6 +5223,10 @@ static void RefreshStats(int blocksFoundThisSession, uint64 roundShareTotal)
             if (m->authorised) gStats.authorizedMiners++;
 
         gWorkerStats.clear();
+        // One timestamp for the whole sweep (#7): every miner is faded to the
+        // same instant, so the per-worker rows and the total they are summed
+        // into describe one moment rather than a smear across the loop.
+        int64 nowStats = GetTime();
         for (Miner* m : gMiners) {
             if (!m->authorised || m->lastSeen <= 0) continue;
             PoolWorkerStatView v;
@@ -4973,9 +5235,11 @@ static void RefreshStats(int blocksFoundThisSession, uint64 roundShareTotal)
             v.roundShares = m->roundShares;
             v.totalShares = m->totalShares;
             v.lastSeen    = m->lastSeen;
-            v.hashRate    = m->hashRate;
+            // Not m->hashRate: a miner that has stopped submitting shares must
+            // not keep contributing its last sample to the announced total.
+            v.hashRate    = MinerReportedHashRate(m, nowStats);
             gWorkerStats.push_back(v);
-            gStats.totalHashRate += m->hashRate;
+            gStats.totalHashRate += v.hashRate;
         }
         std::sort(gWorkerStats.begin(), gWorkerStats.end(),
             [](const PoolWorkerStatView& a, const PoolWorkerStatView& b) {
@@ -5208,6 +5472,35 @@ static void PoolEventLoop()
             }
         }
 
+        // 3.6. Idle reap (#6). Mirror the clean-disconnect path exactly --
+        // log, close, erase from gMiners via std::find, delete -- just with
+        // a different reason. Shares the miner already earned stay in
+        // roundShareCount, exactly as they do when a miner cleanly
+        // disconnects mid-round. connectTime stands in for lastSeen on a
+        // connection that never completed a line. Erasing inside the loop
+        // above would invalidate the iteration, so collect then reap.
+        {
+            int64 now = GetTime();
+            std::vector<Miner*> idle;
+            for (Miner* m : gMiners) {
+                int64 last = (m->lastSeen > 0) ? m->lastSeen : m->connectTime;
+                if (now - last > POOL_IDLE_TIMEOUT_SECS)
+                    idle.push_back(m);
+            }
+            for (Miner* m : idle) {
+                LogPrint("worker", "[pool] dropping idle miner %s -- nothing"
+                         " received in over %llds (session shares: %llu,"
+                         " round shares: %llu)\n",
+                         m->worker.empty() ? "(never authorized)" : m->worker.c_str(),
+                         (long long)POOL_IDLE_TIMEOUT_SECS,
+                         (unsigned long long)m->sessionShares,
+                         (unsigned long long)m->roundShares);
+                sock_close(m->fd);
+                gMiners.erase(std::find(gMiners.begin(), gMiners.end(), m));
+                delete m;
+            }
+        }
+
         // 4. Select over miner sockets
         if (!gMiners.empty()) {
             fd_set fds; FD_ZERO(&fds);
@@ -5230,6 +5523,11 @@ static void PoolEventLoop()
                     // terminate the whole node -- not just the pool. Every
                     // line arrives from an unauthenticated socket.
                     while (RecvLine(m->fd, m->readBuf, line, disc)) {
+                        // Any complete line is proof of life (#6): authorize
+                        // and valid shares already stamp lastSeen themselves,
+                        // but a miner that only ever subscribes (or sends
+                        // unrecognised methods) must count as alive too.
+                        m->lastSeen = GetTime();
                         try {
                             HandleLine(m, line, roundShareCount,
                                        roundShareTotal, blocksFoundThisSession);
@@ -5306,13 +5604,19 @@ static void AcceptOneFn(void* arg)
     std::string host = relay.substr(0, colon);
     int         port = atoi(relay.substr(colon + 1).c_str());
 
-    LogPrint("pool", "[pool] accept thread started for relay %s\n", relay.c_str());
+    LogPrint("pool", "[pool] accept thread started for relay %s%s\n", relay.c_str(),
+             fBtfRelayPinned ? " (/rvrelay pin)" : "");
+
+    // Registration health for this relay. A pin has no fallback, so a pin that
+    // never registers means the pool is simply unreachable -- and that has to
+    // be loud. The 2026-07-30 incident went unnoticed because this loop logged
+    // failures at one flat line and success not at all, so "which relay is this
+    // pool actually registered at" could not be answered from the log.
+    int   nConsecFail     = 0;
+    int64 nFirstFail      = 0;
+    bool  fEverRegistered = false;
 
     while (!fShutdown && gPoolRunning) {
-        // Advertise this relay as the pool's meeting node BEFORE registering,
-        // so that miners which resolve our descriptor find a relay where the
-        // pool (not the node's peer-accept) holds the registration.
-        BtfSetActiveRelay(relay);
         // Returns as soon as the relay lists us -- registered, not yet paired.
         btf::RvSocket rv = btf::RvServiceRegister(host.c_str(), (unsigned short)port, pk);
 
@@ -5321,12 +5625,36 @@ static void AcceptOneFn(void* arg)
             break;
         }
         if (rv == btf::RV_INVALID) {
-            LogPrint("pool", "[pool] relay %s: RvServiceRegister failed"
-                     " -- backing off 30s before retry\n", relay.c_str());
+            nConsecFail++;
+            if (nFirstFail == 0) nFirstFail = GetTime();
+            LogPrint("pool", "[pool] relay %s: registration failed (attempt %d,"
+                     " failing for %llds) -- backing off 30s before retry\n",
+                     relay.c_str(), nConsecFail, (long long)(GetTime() - nFirstFail));
+            if (fBtfRelayPinned && (nConsecFail == 3 || nConsecFail % 10 == 0))
+                LogPrint("pool", "[pool] WARNING: pinned relay %s refused registration"
+                         " %d times running (%llds); /rvrelay leaves no fallback, so"
+                         " miners cannot reach this pool%s\n",
+                         relay.c_str(), nConsecFail, (long long)(GetTime() - nFirstFail),
+                         fEverRegistered ? "" : " -- it has never registered once");
             for (int i = 0; i < 30 && !fShutdown && gPoolRunning; i++) Sleep(1000);
             continue;
         }
 
+        // Advertise THIS relay only now. Setting it before the call published a
+        // meeting node we were not yet listed at, so a miner resolving the
+        // descriptor inside that window burned its dial on a relay holding no
+        // registration for us. net.cpp's peer-accept has always ordered it this
+        // way round; the pool had not.
+        BtfSetActiveRelay(relay);
+        if (!fEverRegistered || nConsecFail > 0)
+            LogPrint("pool", "[pool] registered at relay %s%s%s -- advertising it as"
+                     " the pool's meeting node\n", relay.c_str(),
+                     fBtfRelayPinned ? " (/rvrelay pin)" : "",
+                     nConsecFail > 0 ? ", recovered" : "");
+        fEverRegistered = true;
+        nConsecFail     = 0;
+        nFirstFail      = 0;
+
         // Block for a miner to actually arrive. RvServiceRegister used to do
         // this itself and returned with the relay's 0x01 pairing byte already
         // consumed; it no longer does. Without waiting here, BtfServiceWrap
@@ -5381,9 +5709,21 @@ static void AcceptLoopFn(void*)
     LogPrint("pool", "[pool] .btf identity ready after %ds\n", waitSecs * 2);
 
     std::set<std::string> spawned; // relays we've already started a thread for
+    std::set<std::string> skipped; // discovered relays the pin excluded, logged once each
 
     while (!fShutdown && gPoolRunning) {
+        // BtfAllRelays() already honours the pin: with /rvrelay set it returns
+        // vBtfMeetingRelays alone, so no thread is ever spawned for a
+        // discovered relay. Name the ones it drops -- a pool registering at a
+        // stranger's relay is exactly the thing that should not be silent.
         vector<string> relays = BtfAllRelays();
+        if (fBtfRelayPinned) {
+            for (const string& r : BtfDiscoveredRelays())
+                if (std::find(relays.begin(), relays.end(), r) == relays.end() &&
+                    skipped.insert(r).second)
+                    LogPrint("pool", "[pool] not registering at discovered relay %s"
+                             " -- /rvrelay pins the relay list\n", r.c_str());
+        }
         if (relays.empty()) {
             LogPrint("pool", "[pool] no relays available -- miners cannot connect yet\n");
         } else {
@@ -5399,8 +5739,9 @@ static void AcceptLoopFn(void*)
                              relay.c_str());
                 } else {
                     spawned.insert(relay);
-                    LogPrint("pool", "[pool] accept thread spawned for relay %s"
-                             " (%zu total)\n", relay.c_str(), spawned.size());
+                    LogPrint("pool", "[pool] accept thread spawned for relay %s%s"
+                             " (%zu total)\n", relay.c_str(),
+                             fBtfRelayPinned ? " (/rvrelay pin)" : "", spawned.size());
                 }
             }
         }
@@ -5436,10 +5777,17 @@ void ThreadRPCServer(void*)
     // armed for its one wallet probe before it is allowed to send.
     ReconcilePayouts();
 
-    _beginthread(AcceptLoopFn, 0, NULL);
-    _beginthread(LocalAcceptFn, 0, NULL);
-    _beginthread(ThreadBtfPoolAnnouncer, 0, NULL);
-    _beginthread(PayoutThreadFn, 0, NULL);
+    // _beginthread cannot throw (it reports -1), but an unchecked failure
+    // leaves the pool running deaf: nobody accepts, announces, or pays, and
+    // nothing in the log says why.
+    if (_beginthread(AcceptLoopFn, 0, NULL) == (uintptr_t)-1)
+        LogPrint("pool", "[pool] FATAL: accept loop thread failed to spawn -- miners cannot connect\n");
+    if (_beginthread(LocalAcceptFn, 0, NULL) == (uintptr_t)-1)
+        LogPrint("pool", "[pool] local accept thread failed to spawn\n");
+    if (_beginthread(ThreadBtfPoolAnnouncer, 0, NULL) == (uintptr_t)-1)
+        LogPrint("pool", "[pool] announcer thread failed to spawn -- pool will not be advertised\n");
+    if (_beginthread(PayoutThreadFn, 0, NULL) == (uintptr_t)-1)
+        LogPrint("pool", "[pool] FATAL: payout thread failed to spawn -- no one gets paid\n");
 
     PoolEventLoop(); // blocks until gPoolRunning = false or fShutdown
 
diff --git a/src/util.cpp b/src/util.cpp
index 0cd0133..ab29178 100644
--- a/src/util.cpp
+++ b/src/util.cpp
@@ -7,6 +7,12 @@
 
 
 bool fDebug = false;
+bool fDebugRelay = false;
+
+// In-process cap for debug.log, in bytes. Default matches the 1G trigger of
+// the shipped logrotate policy so a long-running node stays bounded even
+// without it; -maxdebugfilesize=N (MB) tunes it, 0 disables.
+int64 nMaxDebugFileSize = 1024 * 1024 * (int64)1024;
 
 // ---------------------------------------------------------------------------
 // Categorized, burst-collapsing logging -- see the LogPrint doc comment in
@@ -26,10 +32,22 @@ static bool LogCategoryDefaultOn(const char* category)
            strcmp(category, "payout") == 0;
 }
 
+// Categories so noisy they drown out everything else even under -debug:
+// per-message send traces, wallet relay rebroadcasts, raw CBlock dumps and
+// per-address discovery lines made up ~90% of a 13-hour production capture
+// (issue #35). They need /debugrelay, not merely /debug.
+static bool LogCategoryVerboseOnly(const char* category)
+{
+    return strcmp(category, "relay")          == 0 ||
+           strcmp(category, "nostrdiscovery") == 0;
+}
+
 bool LogAcceptsCategory(const char* category)
 {
     if (LogCategoryDefaultOn(category))
         return true;
+    if (LogCategoryVerboseOnly(category))
+        return fDebugRelay;
     return fDebug;
 }
 
@@ -47,6 +65,61 @@ struct LogDedupState {
 static std::map<std::string, LogDedupState> g_logDedup;
 static CCriticalSection cs_logDedup;
 
+// A pending "(N similar)" summary, lifted out of the table while the lock is
+// held and written after it is released.
+struct LogDedupFlush {
+    std::string category;
+    int         suppressed;
+    int64       elapsed;      // how long the window that counted them ran
+    std::string lastMsg;
+};
+
+static int64 g_logDedupLastSweep = 0;
+
+static void EmitDedupSummary(const LogDedupFlush& f)
+{
+    OutputDebugStringF("[%s] (%d similar in %llds, last: %s)\n",
+                       f.category.c_str(), f.suppressed,
+                       (long long)f.elapsed, f.lastMsg.c_str());
+}
+
+// A window is otherwise only closed out when its own call site fires again, so
+// a burst that simply stops -- 100 ledger entries voided in one pass and then
+// silence -- leaves its count sitting in the table and the summary is never
+// written at all. That is how 99 of 100 voids went unreported, with no "(N
+// similar)" line to say anything was missing (issue #3). Sweep every expired
+// window instead, so a finished burst is summarised as soon as anything at all
+// is logged.
+//
+// Expired entries are erased rather than reopened: the window is over, so there
+// is no state left worth keeping, and the next call from that site then takes
+// the "first time" path and prints directly -- exactly what the rollover branch
+// below would have done. It also stops the table growing without bound.
+//
+// Caller holds cs_logDedup; the summaries are written after it is released.
+static void SweepExpiredWindowsLocked(int64 now, std::vector<LogDedupFlush>& out)
+{
+    for (std::map<std::string, LogDedupState>::iterator it = g_logDedup.begin();
+         it != g_logDedup.end(); )
+    {
+        if (now - it->second.windowStart < DEDUP_WINDOW_SECS)
+        {
+            ++it;
+            continue;
+        }
+        if (it->second.suppressed > 0)
+        {
+            LogDedupFlush f;
+            f.category   = it->first.substr(0, it->first.find('|'));
+            f.suppressed = it->second.suppressed;
+            f.elapsed    = now - it->second.windowStart;
+            f.lastMsg    = it->second.lastMsg;
+            out.push_back(f);
+        }
+        g_logDedup.erase(it++);
+    }
+}
+
 void LogPrintDedup(const char* category, const char* file, int line, const std::string& msgIn)
 {
     // Call sites follow the existing printf() convention of ending their
@@ -61,11 +134,19 @@ void LogPrintDedup(const char* category, const char* file, int line, const std::
 
     int64 now = GetTime();
     bool  fEmitNow = false;
-    int   suppressedToFlush = 0;
-    std::string flushedMsg;
+    std::vector<LogDedupFlush> flushes;
 
     CRITICAL_BLOCK(cs_logDedup)
     {
+        // At most once a second. The table holds one entry per call site that
+        // has fired in the last few seconds, so the walk is short, but it must
+        // not run once per line of a burst.
+        if (now != g_logDedupLastSweep)
+        {
+            g_logDedupLastSweep = now;
+            SweepExpiredWindowsLocked(now, flushes);
+        }
+
         std::map<std::string, LogDedupState>::iterator it = g_logDedup.find(key);
         if (it == g_logDedup.end())
         {
@@ -76,10 +157,18 @@ void LogPrintDedup(const char* category, const char* file, int line, const std::
         }
         else if (now - it->second.windowStart >= DEDUP_WINDOW_SECS)
         {
-            // Window rolled over: flush what was suppressed during it (if
-            // anything), then start a new window with this call printed.
-            suppressedToFlush = it->second.suppressed;
-            flushedMsg = it->second.lastMsg;
+            // Window rolled over within the same second as the last sweep:
+            // flush what was suppressed during it (if anything), then start a
+            // new window with this call printed.
+            if (it->second.suppressed > 0)
+            {
+                LogDedupFlush f;
+                f.category   = category;
+                f.suppressed = it->second.suppressed;
+                f.elapsed    = now - it->second.windowStart;
+                f.lastMsg    = it->second.lastMsg;
+                flushes.push_back(f);
+            }
             it->second.windowStart = now;
             it->second.suppressed  = 0;
             it->second.lastMsg     = msg;
@@ -94,13 +183,23 @@ void LogPrintDedup(const char* category, const char* file, int line, const std::
         }
     }
 
-    if (suppressedToFlush > 0)
-        OutputDebugStringF("[%s] (%d similar in %llds, last: %s)\n",
-                            category, suppressedToFlush, (long long)DEDUP_WINDOW_SECS, flushedMsg.c_str());
+    for (size_t i = 0; i < flushes.size(); i++)
+        EmitDedupSummary(flushes[i]);
     if (fEmitNow)
         OutputDebugStringF("[%s] %s\n", category, msg.c_str());
 }
 
+// LogPrintAlways() -- see the doc comment in util.h. No window, no counting,
+// no table entry: every call writes its own line.
+void LogPrintNoCollapse(const char* category, const std::string& msgIn)
+{
+    std::string msg = msgIn;
+    while (!msg.empty() && (msg.back() == '\n' || msg.back() == '\r'))
+        msg.pop_back();
+
+    OutputDebugStringF("[%s] %s\n", category, msg.c_str());
+}
+
 
 
 
@@ -397,13 +496,37 @@ bool FileExists(const char* psz)
 #endif
 }
 
-int GetFilesize(FILE* file)
+#ifndef _WIN32
+// If off_t is 32 bits wide, ftello() truncates exactly like the int this
+// function used to return. Fail the build rather than ship the silent
+// version of the bug (32-bit hosts need -D_FILE_OFFSET_BITS=64).
+static_assert(sizeof(off_t) >= 8, "GetFilesize needs a 64-bit off_t");
+#endif
+
+// Returns the file's size in bytes, or -1 if it cannot be determined.
+//
+// This used to hold ftell()'s long in an int, so a file of 2 GiB or more came
+// back negative. Its only caller is the debug.log roll in util.h, which skips
+// the roll on a negative size -- i.e. rotation switched itself off for good at
+// exactly the size the roll exists to prevent, and any cap of 2048 MB or more
+// could never be exceeded at all. Both failures were silent.
+int64 GetFilesize(FILE* file)
 {
-    int nSavePos = ftell(file);
-    int nFilesize = -1;
-    if (fseek(file, 0, SEEK_END) == 0)
-        nFilesize = ftell(file);
-    fseek(file, nSavePos, SEEK_SET);
+#ifdef _WIN32
+    __int64 nSavePos = _ftelli64(file);
+    int64 nFilesize = -1;
+    if (nSavePos >= 0 && _fseeki64(file, 0, SEEK_END) == 0)
+        nFilesize = _ftelli64(file);
+    if (nSavePos >= 0)
+        _fseeki64(file, nSavePos, SEEK_SET);
+#else
+    off_t nSavePos = ftello(file);
+    int64 nFilesize = -1;
+    if (nSavePos >= 0 && fseeko(file, 0, SEEK_END) == 0)
+        nFilesize = ftello(file);
+    if (nSavePos >= 0)
+        fseeko(file, nSavePos, SEEK_SET);
+#endif
     return nFilesize;
 }
 
diff --git a/src/util.h b/src/util.h
index d72518b..dfe7511 100644
--- a/src/util.h
+++ b/src/util.h
@@ -87,6 +87,15 @@ inline T& REF(const T& val)
 
 extern bool fDebug;
 
+// /debugrelay: the per-message firehose ("relay" and "nostrdiscovery"
+// categories) that even -debug keeps off. See LogAcceptsCategory().
+extern bool fDebugRelay;
+
+// debug.log is rolled to debug.log.old once it grows past this many bytes
+// (set from -maxdebugfilesize, in MB; 0 disables the check). See the roll
+// site in OutputDebugStringF() below.
+extern int64 nMaxDebugFileSize;
+
 // ---------------------------------------------------------------------------
 // Categorized, burst-collapsing logging
 //
@@ -106,15 +115,29 @@ extern bool fDebug;
 //   2. Burst collapse: repeated LogPrint() calls from the *same source line*
 //      only emit one line per DEDUP_WINDOW_SECS; if more calls land inside
 //      that window they're counted instead of reprinted, and the count is
-//      flushed as a single "(xN similar in Ws)" line the moment the window
-//      rolls over. A loop discovering 500 peers by address now produces a
-//      small, bounded number of lines instead of 500 -- log growth is capped
-//      by elapsed time, not by how many similar events happen to fire.
+//      flushed as a single "(xN similar in Ws)" line once the window expires
+//      -- whether or not that call site ever fires again. A loop discovering
+//      500 peers by address now produces a small, bounded number of lines
+//      instead of 500 -- log growth is capped by elapsed time, not by how
+//      many similar events happen to fire.
+//
+// Use LogPrintAlways() instead for anything that reports an irreversible
+// change to money: an obligation voided, a payment sent, a payment that
+// failed. One line standing in for an unknown number of identical events is
+// a tidy report of peer chatter and a false report of a ledger. A reorg
+// voiding 100 entries hits one source line 100 times inside one window;
+// under LogPrint() that read as a single block losing a single 49.49 BTF
+// payment, while 4,950 BTF of obligations were actually destroyed, and the
+// discrepancy was only found by counting entries in pending_payouts.json
+// (issue #3). Bounded log growth is not worth that ambiguity here.
 // ---------------------------------------------------------------------------
 bool LogAcceptsCategory(const char* category);
 void LogPrintDedup(const char* category, const char* file, int line, const std::string& msg);
+void LogPrintNoCollapse(const char* category, const std::string& msg);
 #define LogPrint(category, ...) \
     do { if (LogAcceptsCategory(category)) LogPrintDedup((category), __FILE__, __LINE__, strprintf(__VA_ARGS__)); } while (0)
+#define LogPrintAlways(category, ...) \
+    do { if (LogAcceptsCategory(category)) LogPrintNoCollapse((category), strprintf(__VA_ARGS__)); } while (0)
 
 // Every format string in this project goes through one of the four functions
 // below -- `printf` itself is remapped to OutputDebugStringF just above, and
@@ -145,7 +168,7 @@ void ParseString(const string& str, char c, vector<string>& v);
 string FormatMoney(int64 n, bool fPlus=false);
 bool ParseMoney(const char* pszIn, int64& nRet);
 bool FileExists(const char* psz);
-int GetFilesize(FILE* file);
+int64 GetFilesize(FILE* file);
 uint64 GetRand(uint64 nMax);
 int64 GetTime();
 int64 GetAdjustedTime();
@@ -199,7 +222,7 @@ protected:
 public:
     char* pszFile;
     int nLine;
-    explicit CCriticalSection() { InitializeCriticalSection(&cs); }
+    explicit CCriticalSection() : pszFile(NULL), nLine(0) { InitializeCriticalSection(&cs); }
     ~CCriticalSection() { DeleteCriticalSection(&cs); }
     void Enter() { EnterCriticalSection(&cs); }
     void Leave() { LeaveCriticalSection(&cs); }
@@ -390,7 +413,65 @@ inline int OutputDebugStringF(const char* pszFormat, ...)
             else
                 strDebugFile = "debug.log";
         }
+        // Latched by a failed rename in the roll below, which cannot be
+        // retried usefully and must not be retried endlessly.
+        static bool fRollDisabled = false;
         FILE* fileout = fopen(strDebugFile.c_str(), "a");
+        if (fileout && nMaxDebugFileSize > 0 && !fRollDisabled)
+        {
+            // Roll an overgrown debug.log before adding to it. Nothing in the
+            // tree shrinks this file once the process is running (there is no
+            // ShrinkDebugFile, and even Bitcoin's only ran at startup), so a
+            // node that stays up for months grows the log without bound --
+            // production hit ~2 GiB. The file is opened and closed per line,
+            // so a rename is safe here: the next line simply reopens the
+            // path. One generation is kept as debug.log.old; logrotate
+            // (contrib/logrotate/) handles anything longer-term.
+            int64 nSize = GetFilesize(fileout);
+            if (nSize >= 0 && nSize > nMaxDebugFileSize)
+            {
+                fclose(fileout);
+                string strOldFile = strDebugFile + ".old";
+                remove(strOldFile.c_str()); // rename() won't clobber on Windows
+                bool fRolled = (rename(strDebugFile.c_str(), strOldFile.c_str()) == 0);
+                int nRenameErrno = errno; // before fopen() can overwrite it
+                fileout = fopen(strDebugFile.c_str(), "a");
+                if (fRolled)
+                {
+                    if (fileout)
+                        fprintf(fileout,
+                            "debug.log grew past %lld MB; previous contents moved to debug.log.old (-maxdebugfilesize)\n",
+                            (long long)(nMaxDebugFileSize / 1024 / 1024));
+                }
+                else if (nRenameErrno == ENOENT)
+                {
+                    // The file went away between the size check and the
+                    // rename, so an external rotator (logrotate) got there
+                    // first. Nothing left to roll and nothing wrong: the
+                    // fopen above has already recreated it. Latching on this
+                    // would let a benign race with logrotate switch the cap
+                    // off for the rest of the run.
+                }
+                else
+                {
+                    // The file is still over the cap, so this branch would be
+                    // reached again on the next line and every line after it.
+                    // Unlatched, the complaint about failing to roll becomes
+                    // the runaway growth the roll exists to prevent. Say it
+                    // once and stop trying -- on stderr too, because whatever
+                    // blocked the rename (read-only mount, permissions, EXDEV
+                    // across a bind mount) may equally block the log write.
+                    fRollDisabled = true;
+                    fprintf(stderr,
+                        "cannot roll %s (rename to .old failed: %s); -maxdebugfilesize disabled for this run\n",
+                        strDebugFile.c_str(), strerror(nRenameErrno));
+                    if (fileout)
+                        fprintf(fileout,
+                            "cannot roll debug.log (rename to .old failed: %s); -maxdebugfilesize disabled for this run\n",
+                            strerror(nRenameErrno));
+                }
+            }
+        }
         if (fileout)
         {
             va_list arg_ptr;