Bitcoin Core

net_processing: fix BIP152 first integer interpretation

argsman: allow duplicate registration between HIDDEN and other categories

The assertion added in #35470 to prevent duplicate option registration
across categories was too strict — it also fired when an option was
registered in OptionsCategory::HIDDEN and then again in a real category
(or vice versa).

This is intentional behavior introduced in #13441: options unavailable
in a given binary (e.g. GUI args in bitcoind) are pre-registered as
hidden so shared bitcoin.conf files don't fail. In bitcoin-qt,
SetupServerArgs registers GUI args as hidden, then SetupUIArgs registers
them properly under OptionsCategory::GUI, triggering the assertion and
crashing on startup.

The fix relaxes the assertion to exclude HIDDEN from the cross-category
duplicate check, preserving the original intent of #13441 while still
catching unintentional duplicates between real categories.

util: Check write failures before renaming settings.json

In WriteSettings(), verify that writing to the stream and closing it
succeeded before returning true. This prevents RenameOver() from replacing
a valid settings.json with a corrupted or zero-byte file when write limits
or a full disk are encountered.

Additionally, update the ReadSettings() parse failure message to mention
power loss, full disk, or storage error as possible causes.

Fixes #35373

ci: updated docs to reflect removal of REPO_USE_WARP_RUNNERS flag

test: add fuzz test for private broadcast

Co-authored-by: Greg Sanders <gsanders87@gmail.com>
Co-authored-by: Vasil Dimov <vd@FreeBSD.org>

private broadcast: enforce sending to unique node ids

Sending more than one transaction to a given node would be a privacy
leak and thus enforce that this is not done. `GetSendStatusByNode()`
assumes unique node ids.

Note that sending more than one transaction to a given address is fine,
if that is done via separate connections, in which case the node ids
would be different.

lint: Require scripted-diff script to succeed

Previous version of commit-script-check.sh would succeed as long as git diff succeeded.

Can be verified through adding a failing scripted diff commit such as:
git commit --allow-empty -m $'scripted-diff: foo\n\n-BEGIN VERIFY SCRIPT-\nadsasd\n-END VERIFY SCRIPT-\n'
...and running...
cargo run --manifest-path ./test/lint/test_runner/Cargo.toml -- --lint=scripted_diff

test: SOCKS5 proxy: expect that connection may be reset during handshake

The client (e.g. `bitcoind`) may open a connection to the proxy and
close it in the middle of the SOCKS5 handshake if it is restarted for
example. Log these as debug messages instead of full blown Python
exception error messages with backtraces.

test: SOCKS5 proxy: expect that connection may be reset when forwarding

The `forward_sockets()` function used by the SOCKS5 proxy forwards data
between two connected sockets. It might happen that one of those sockets
gets closed/reset abruptly, without sending EOF first. This is to be
expected if e.g. `bitcoind` is shutdown and shouldn't result in noisy
harmless messages like:

```
2026-06-03T13:23:56.966859Z TestFramework.socks5 (ERROR): socks5 request handling failed (running True)
Traceback (most recent call last):
File ".../socks5.py", line 199, in handle
forward_sockets(self.conn, conn_to, self.wakeup_socket_pair[1], self.serv)
~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File ".../socks5.py", line 76, in forward_sockets
data = s.recv(4096)
ConnectionResetError: [Errno 104] Connection reset by peer
```

Instead turn this into a debug log message with a nice prefix containing
enough information to identify the two forwarded sockets.

ci: Use GCC consistently in i686 task

According to the comment removed in commit
fae0295a799499268caca9c385ac4d7061543980, clang was only used to avoid
OOM. Using GCC today should be fine.

argsman: Prevent duplicate option registration across categories

Added a validation in AddArg() preventing the same option name from
being registered across different categories, avoiding ambiguous option
resolution and make the distinction between global and command-specific
options explicit.

refactor: centralize SubmitBlock result handling

Move the accepted/new-block/reason consistency check into SubmitBlock()
so submitBlock() and submitSolution() use the same success criteria.

This keeps duplicate and inconclusive handling in one place, removes the
new_block output parameter from the helper, and makes the helper return
whether the submitted block was accepted as a new valid block.

doc: add release note for submitSolution IPC changes

mining: add reason and debug output to submitSolution

Add reason and debug output parameters to submitSolution, matching
submitBlock. This relays the specific failure reason (e.g.
"bad-version(...)", "bad-witness-nonce-size", "duplicate") to callers
instead of just a bool.

Use a new capnp ordinal for the updated method and keep the old @7 method
as a deprecated entry point returning an explicit error, so old clients do
not decode corrupt result fields and are directed to update.

mining: clarify SubmitBlock result handling

Make the submitBlock return value explicit and check that it stays
consistent with the BIP22 reason string, so future changes do not return
success with a reason or failure without one.

Report "inconclusive" when no specific block rejection reason is
available. This covers blocks accepted without being connected, and
processing failures where ProcessNewBlock returns false without an
invalid BlockChecked result, for example when ActivateBestChain fails
after BlockChecked reported a valid block.

Also document why no validation-interface queue drain is needed before
unregistering: BlockChecked is emitted synchronously by ProcessNewBlock,
unlike most validation signals.

test: generalise byte_to_base58 utility function to allow more version types

Passing a version in the byte form is allowed now in addition to the integral
version type. This will be helpful in the next commit.

test: descriptor: bare multisig at TOP level with 3 pubkeys is allowed

index: shorten indexer thread names

`BaseIndex` currently uses the same name for logs, `getindexinfo`, prune locks, and the sync thread.
Linux truncates system thread names to 15 visible bytes after the `b-` prefix, so long indexer names are clipped in system tools.

Pass a separate thread name explicitly at each `BaseIndex` call site and shorten the OS-visible indexer names to `txidx`, `blkfltbscidx`, `coinstatsidx`, and `txospenderidx`.
Add an `Assume` to `ThreadRename()` so future OS-visible thread names keep fitting the same Linux limit.
The public index names, `getindexinfo` keys, command-line options, and on-disk paths stay unchanged.

Co-authored-by: winterrdog <winterrdog@users.noreply.github.com>
Co-authored-by: Hodlinator <172445034+hodlinator@users.noreply.github.com>
Co-authored-by: sedited <seb.kung@gmail.com>
Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>

util: zero-pad thread number suffixes

Thread names with numeric suffixes are easier to scan when the suffixes use a fixed width.
Format `ThreadPool` and script-check worker suffixes as two digits while keeping the compact dotted convention.

Co-authored-by: Hodlinator <172445034+hodlinator@users.noreply.github.com>

util: shorten `ThreadPool` worker names

ThreadPool workers currently format their names as `name_pool_N`.
Linux truncates the system thread name to 15 visible bytes, so `b-http_pool_N` spends much of that space on the suffix.
Use a dotted numeric suffix so HTTP worker names become `b-http.N`, leaving more room for longer pool names.

test: make TestChain100Setup's m_clock timestamp more readable

The timestamp 1598887952 is used as the initial value of the node's
mocked wall-clock in TestChain100Setup. Comment its UTC date to make
the magic number more readable.

net: add options to AttemptToEvictConnection

If the added bool evict_tx_relay_peer_only is set, non-tx-relay
peers will be exempt from disconnection.
Also allow to specify a peer that exempt from eviction.
Both options will be used in later commits.

Co-authored-by: Amiti Uttarwar <amiti@uttarwar.org>

guix: Fix "Ignoring empty string" CMake warning for non-Linux hosts

Using shell parameter expansion ensures that on non-Linux hosts the
build script won't pass an empty string argument to CMake. This resolves
the "Ignoring empty string" warning.

guix: Drop redundant CMake `--verbose` options

CMake's verbose output is already controlled by the `VERBOSE`
environment variable, which has been exported since commit 85f4a4b0822e.

iwyu: Fix warning in `bench/pool.cpp`

This amends bitcoin/bitcoin#35414.