Bitcoin Core

refactor: simplify adding SipHash-1-3-UJ

Move the SipHash round, compression, and finalization operations shared by `CSipHasher` and `PresaltedSipHasher` into inline `SipHashState` methods.
This centralizes state mutation, preserves the existing byte-path code generation, and keeps the security-sensitive follow-up focused on its changed block compression, round counts, and finalizer.

Co-authored-by: Pieter Wuille <pieter@wuille.net>

crypto: add generic SipHash-1-3-UJ

Add `SipHasher13UJ`, a block-oriented implementation accepting arbitrarily mixed 64-bit normal blocks and 256-bit jumbo blocks.
For hash-table use, cryptographic hash outputs must make up all but a small bounded number of retained jumbo blocks.

The generic interface serves as the executable specification for the fixed-width overloads added next.

Co-authored-by: Lőrinc <pap.lorinc@gmail.com>
Co-authored-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>

test: add SipHash-1-3-UJ coverage

Add SipHash-1-3-UJ outputs to the shared vectors for sequences of 8- and 32-byte blocks.
Check generic writes and applicable fixed-width `Hash` overloads against those outputs, and fuzz their equivalence including mixed normal/jumbo encodings.

The outputs were generated by an independent implementation that Claude Opus 4.8 produced using only the `SipHasher13UJ` class comment as its prompt.

Co-authored-by: Lőrinc <pap.lorinc@gmail.com>

bench: add fixed-width SipHash benchmarks

Benchmark 32-byte hashes and inputs consisting of a 32-byte hash plus a 32-bit index with SipHash-2-4 and SipHash-1-3-UJ.
The UJ benchmark zero-extends the index into one 64-bit normal block.
Keep all four measurements together after shared correctness coverage and before changing `CCoinsMap`'s hasher.

Co-authored-by: Pieter Wuille <pieter@wuille.net>

crypto: add fixed-width SipHash-1-3-UJ

Add const `SipHasher13UJ::Hash` overloads for one `uint256` jumbo block, optionally followed by one 64-bit normal block.
Reuse the generic hasher's initialized state and define these short paths in the header because the new hasher benefits from inlining.

Co-authored-by: Lőrinc <pap.lorinc@gmail.com>

test: add shared SipHash vectors

Lock SipHash-2-4 behavior into shared vectors before refactoring its round and finalization code.
Store inputs as ordered hex byte blocks so `CSipHasher` and the independent Python implementation hash the same byte sequence, with applicable `PresaltedSipHasher` overloads checked against the same vectors.
Add the 64 official SipHash-2-4 vectors alongside block-partition and empty-block cases for the generic path.
Move randomized generic/fixed comparisons to the integer fuzzer.

SipHash-1-3-UJ coverage can add expected outputs for compatible 8- and 32-byte block sequences.
The Python test reads a build-tree copy so functional-test staging behaves consistently when files are symlinked or copied.

Co-authored-by: Pieter Wuille <pieter@wuille.net>

uint256: Workaround GCC-14 stringop-overread bug in Compare

test: Move cluster_linearize.h contents into cluster_linearize namespace

This change:
1. Avoids Clang's `-Wunused-template` warnings when building the
`bench_bitcoin` or `fuzz` targets.
2. Follows C++ Core Guidelines: "SF.21: Don't use an unnamed (anonymous)
namespace in a header".
3. Drops `[[maybe_unused]]` annotations, which are no longer needed
after changing the linkage from internal to external.

test: wallet: BnB incomplete result on attempt-limit success

BnB can return a valid selection before exhausting
the search tree, then hit TOTAL_TRIES while continuing
to look for a better one. Add a unit test for that path
using a known exhaustion fixture plus an exact-match
coin, and assert the result is marked incomplete via
GetAlgoCompleted() == false.

Co-authored-by: Murch <murch@murch.one>

blockencodings: fix extra transaction count

A short ID collision can invalidate a mempool-sourced transaction after an unrelated transaction was found in extra_txn.

Track each slot's source so extra_count is decremented only when the invalidated slot came from extra_txn. Mark collided slots explicitly so later candidates do not refill them.

test: characterize extra transaction miscount

ipc, refactor: Update mp::SpawnProcess call

Use new SpawnProcess and StartSpawned functions to be compatible with an
upcoming version of libmultiprocess which adds windows support.

bitcoin-util: replace netmagic command with getchainparams command

Co-Authored-By: ekzyis <ramdip.singhgill@gmail.com>

rpc: add OpenRPC discovery alias

OpenRPC service discovery specifies `rpc.discover` as the discovery
method name.

Expose `rpc.discover` as an alias for `getopenrpcinfo`, so clients that
expect the standard OpenRPC discovery method can retrieve the same
generated document without changing the existing Bitcoin Core RPC.

doc: release note for alternate_wtxids in gettransaction

wallet: Show alternate wtxids in gettransaction

If a wallet tranasction has alterate witness versions, list those wtxids
in gettransaction's output.

test: Test for wallet txs with alternate wtxids

test: compat, ensure downgrade preserves tx witness variants

wallet: Replace CWalletTx::SetTx with Update

Instead of replacing the tx when a witness alternative appears, add it
to the set of wtxid alternates.

In order to determine whether the added transaction is the canonical
transaction, Update also needs to know how the state is changing, so it
will also update the state if it is being changed.

wallet: Store all witness variants of a transaction

A transaction can have several valid witnesses that share its txid but
differ in wtxid, e.g. when a taproot output is spent via the key path
in one variant and the script path in another.

CWalletTx now keeps all of them in a map indexed by wtxid (m_txs) and
marks one as canonical (m_canonical_wtxid): a confirmed variant if there
is one, otherwise the one with a witness and the lowest weight. GetTx()
and serialization return the canonical variant, so existing callers
don't need to change.

The other variants are stored in their own wtxvariant records keyed by
(txid, wtxid) and merged back into the CWalletTx at load. The tx record
keeps its old format, holding the canonical transaction, so older soft
versions can still read and rewrite it without dropping those records.

wallet: Remove unused CWalletTx CopyFrom and copy constructor

wallet: Make CWalletTx::tx private and use CWalletTx::GetTx to access

When CWalletTx will have multiple transactions, tx will no longer exist
and accessing the single canonical tx should be done through an getter
function.

wallet: Deserialize directly in CWalletTx's ctor

When loading a transaction, instead of constructing a CWalletTx with no
transaction, pass the DataStream into the constructor so that the
CWalletTx is RAII. This allows us to ensure that the transaction is
never a nullptr so that dereferences, especially once multiple txs are
stored, will not cause a segfault.

fuzz, refactor: Remove `Serialize` overload

Serialization parameters should be embedded into the object being
serialized rather than passed as a separate argument. This works here
because only serialization is performed and no new object needs to be
constructed.

fuzz: Remove unused `DeserializeFromFuzzingInput` params overload

This overload has been unused since it was added in fac81affb527132945773a5315bd27fec61ec52f.