From 89f6d045c8e3dacbfbb369a3ac89c0c33de22b4c Mon Sep 17 00:00:00 2001
From: mtg0001 <106211915+mtg0001@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:56:50 -0300
Subject: Keep HD change recoverable and bound message stalls (#109)

Change from an HD wallet now goes to a newly derived phrase-backed key instead of reusing a spent input's key. Reusing an input key silently moved value back to a key the phrase cannot reproduce; if derivation fails the transaction is refused rather than creating unrecoverable change. Legacy wallets with no seed keep the 0.1.0 behaviour. Restore also scans past the pre-generated key-pool window before treating an empty batch as the end.

The message parser no longer consumes a header it cannot complete: it reads from a copy, so the O(n) reinsert and the 100 ms sleep inside the shared message thread are gone, and a peer that sits on an incomplete payload is disconnected after two minutes. The wire cap drops from 256 MB to MAX_SIZE. New net-message self-test covers complete, incomplete, stale and oversized headers.

Verified here: clean rebuild, all self-tests pass, lock order checked (no path takes cs_keyPool before cs_mapWallet), and a node built from this branch synced from genesis to the chain tip on the live network with zero rejections.
---
 src/Makefile | 1 +
 1 file changed, 1 insertion(+)

(limited to 'src/Makefile')

diff --git a/src/Makefile b/src/Makefile
index 5ded7d6..88dc08f 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -139,3 +139,4 @@ tests: test_bip32 bitflash-node
 	./test_bip32
 	./bitflash-node -selftest=wallet-keypool
 	./bitflash-node -selftest=wallet-hd
+	./bitflash-node -selftest=net-message
-- 
cgit v1.2.3