Bitcoin Core

test: doc: remove `--perf` profiling from functional test framework

This feature was broken for more than a year and no developer apparently
even noticed, so one can conclude that it is largely unused; it seems
thus reasonable to remove it to reduce maintenance burden.

ci: bump MSan fuzz timeout

The MSan fuzz job has little headroom on fork CI when caches miss.

Examples from Sjors/bitcoin:

- PR 116 timed out after 2h30m: https://github.com/Sjors/bitcoin/actions/runs/27465468297/job/81187008305?pr=116

- PR 117 passed in 2h24m47s: https://github.com/Sjors/bitcoin/actions/runs/27465461797/job/81186956747?pr=117

- PR 118 passed in 2h18m22s: https://github.com/Sjors/bitcoin/actions/runs/27465761345/job/81187860567?pr=118

Bump the timeout to 180 minutes to leave room for runner variance.

rpc: tighten setmocktime upper bound to UINT32_MAX

The previous bound (~year 2262) was too permissive: paths that add an offset to the mocked time (e.g. the future-time check in ContextualCheckBlockHeader) can overflow int64_t (caught by UBSan), and paths that assign it to a uint32_t field (e.g. pblock->nTime in miner.cpp) silently truncate it (caught by the integer sanitizer). UINT32_MAX is the natural ceiling since block header nTime is uint32_t, and mocking beyond it is meaningless for anything consensus-related.

Add setmocktime bound checks to the existing _test_y2106 case in rpc_blockchain.py, and remove the negative bound check from rpc_uptime.py.

Revert "build: exclude mptest target from compile commands"

This reverts commit 4731049ba4f8a820cc4aa13a745e41bdfbee284a.

rpc: extend TxDoc() for getblock verbosity 2/3

Add fee, hex, fee_doc, prevout_doc, and vin_item_doc
options to TxDocOptions, and use them to describe
getblock verbosity=2/3 with structured metadata instead
of inline ELISION-based reuse.

Add GetBlockFields() to share the block-level result layout
across verbosity levels.

rpc: extract ListSinceBlockTxFields() helper

Extract the inline listsinceblock transaction field list into a reusable
helper. The removed entry replaces its Type::ELISION placeholder with an empty
string elision.

ToSections() render an empty std::string elision as "...", and suppress
the array continuation marker when the last inner element renders as a
std::string elision.

rpc: extract fee estimate result helpers

Replace inline fee estimation field lists in estimaterawfee with
reusable FeeRateBucketDoc() and FeeEstimateHorizonDoc() helpers.

Use ElideGroup() to keep repeated horizon and bucket sections
compact in human-readable help while preserving explicit result
metadata.

rpc: expand getaddressinfo embedded with explicit fields

Replace the ELISION entry inside getaddressinfo's embedded object
with explicit fields using ElideGroup().

Factor the embedded field list into a helper so the nested layout
can be reused without duplicating the full structure inline.

rpc: remove unused RPCResult::Type::ELISION

RPCResult::Type::ELISION is not used anymore because it is not machine
readable for OpenRPC specs. To prevent future usage, it has been removed.

rpc: extend TxDoc() for getrawtransaction verbosity 2

Add prevout, elision_mode, and vin_inner_elision options
to TxDocOptions, and use them to describe getrawtransaction verbosity=2
with structured metadata instead of raw ELISION entries. Extract
verbosity=1 block fields into a local verbosity_1_block variable so
verbosity=2 can reuse them via ElideGroup.

When vin_inner_elision is set, vin fields are elided while keeping
prevout visible. With elision_mode == ElisionMode::Silent, every other
top level field is hidden, so the only rendered output comes from the
vin not elided.

Loosen elision_has_description() to accept any group with at least one
field that is not SKIP.

rpc: expand decodepsbt output script with explicit fields

Reuse ScriptPubKeyDoc(), which matches what ScriptToUniv() emits here
wrapped in ElideGroup().

test: remove redundant test suite uniqueness lint

Duplicate Boost test suite names are already rejected by CMake when the suites are registered as CTest tests.
Follow-up to https://github.com/bitcoin/bitcoin/pull/35451#discussion_r3403672298.

Co-authored-by: maflcko <6399679+maflcko@users.noreply.github.com>

doc: use signing pubkey instead of aggregate xonly key

guix: add package.sh

Split out packaging code, so that it can be re-used by
build scripts.

undo "ui: Compile boost:signals2 only once"

commit fa5ce27385bc60cdf6d9a4eeb2d32c916c9e07eb was done to gain a 5%
faster compilation. However, this is no longer needed after the slim
btcsignals implementation.

mv btcsignals.h to src/util

This is a low-level utility header

refactor: Make scoped_connection ctor explicit

This ensures that all constructions of scoped connections are explict,
making the intent explicit and review easier. This also follows the
default recommendation from
https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#c46-by-default-declare-single-argument-constructors-explicit

test: Check btcsignals determinism in thread_safety test case

The test only checked that the single atomic value is greater than 3000.
However, by splitting the atomic into two, one can do one exact check,
and also increase the lower bound on the inexact check.

Also, test disconnect races for every second step, instead of only once
at the end (likely when only one thread is running anyway).

Both changes make the test stricter and may catch non-determinism issues
that are not detected by sanitizers alone.

The test added in this commit should also pass when applied on top of
commit 63c68e2a3f98d2466a7e766d861ba3a94e92cd20, which is still using
the boost implementation.

refactor: Properly return from ThreadSafeQuestion signal

Previously, the signal was using btcsignals::optional_last_value<bool>.
However, this only worked by accident:

The return value was influenced by the order in which the connections
were done. The noui callbacks would always overwrite the return value
with false. This makes the code overall brittle, and confusing.

For example, the following patch that changes the order of connections
would break the only and single place where the return value actually
matters:

```diff
diff --git a/src/qt/bitcoin.cpp b/src/qt/bitcoin.cpp
index 0b89c605b9..976549470e 100644
--- a/src/qt/bitcoin.cpp
+++ b/src/qt/bitcoin.cpp
@@ -488,3 +488,2 @@ int GuiMain(int argc, char* argv[])
btcsignals::scoped_connection handler_message_box = ::uiInterface.ThreadSafeMessageBox_connect(noui_ThreadSafeMessageBox);
- btcsignals::scoped_connection handler_question = ::uiInterface.ThreadSafeQuestion_connect(noui_ThreadSafeQuestion);
btcsignals::scoped_connection handler_init_message = ::uiInterface.InitMessage_connect(noui_InitMessage);
@@ -663,2 +662,3 @@ int GuiMain(int argc, char* argv[])
app.createWindow(networkStyle.data());
+ btcsignals::scoped_connection handler_question = ::uiInterface.ThreadSafeQuestion_connect(noui_ThreadSafeQuestion);
// Perform base initialization before spinning up initialization/shutdown thread
```

This can be tested by applying the patch and then calling:

(May have to be started twice to trigger the question)

```
bitcoin-qt -regtest -datadir=/tmp -mocktime=123456789
```

Before the changes in this commit (on current master), pressing `OK`
would not have any effect and would abort the program.

After the changes in this commit, pressing `OK` will correctly trigger a
-reindex and leave the program running.

refactor: Make ThreadSafeMessageBox signal void

The message will always return false (a constant) and the return value
is never used.

Also, annotate ThreadSafeMessageBox in the GUI code as [[nodiscard]],
because it may actually return a value, which is handled for questions
(but not for messages).

refactor: Mark btcsignals operator [[nodiscard]]

This is only relevant in case the result_type is not void, in which case
the caller should either use the return value or mark it unused.

wallet: reject sendtoaddress and sendmany for external signers

The sendtoaddress and sendmany RPCs always go through SendMoney(), which
expects to sign internally. External signer wallets should use the PSBT
flow instead, via the send RPC.

Return a more specific error for external signer wallets and add
functional test coverage for both RPCs.

coins: compact chainstate in background

Full chainstate compaction can take minutes on large databases.
Move `CCoinsViewDB::CompactFull()` to a named `utxocompact` one-shot background thread so validation only schedules the work.

When validation selects compaction after a full flush, the chainstate was just written and another write is less likely to be needed immediately.
The coins view destructor waits for completion, and a mutex prevents compaction from using `m_db` while `ResizeCache()` replaces it.

Co-authored-by: Andrew Toth <andrewstoth@gmail.com>

validation: randomly compact chainstate

Full chainstate flushes are convenient maintenance points for long-term LevelDB cleanup because the chainstate was just written.
Randomize the trigger so nodes that flush near the same height do not compact together.

Add blocking chainstate compaction through `CCoinsViewDB::CompactFull()` and give each post-IBD full flush on the normal chainstate a 1/320 chance to start compaction.
With hourly flushes this averages roughly every two weeks and makes a six-month miss about one in a million.
This keeps the schedule stateless and leaves last-compaction height or timestamp bookkeeping out of chainstate metadata.

Co-authored-by: Andrew Toth <andrewstoth@gmail.com>

doc: add taproot descriptor to getdescriptors example

Wallets import descriptors for all supported address types in a
BIP44/49/84/86 compatible manner, so show the BIP86 tr() descriptor in
the example response as well.