Merge bitcoin/bitcoin#32143: Fix 11-year-old mis-categorized error code in OP_IF evaluation

diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000..c5f3028c
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,26 @@
+# This is the top-most EditorConfig file.
+root = true
+
+# For all files.
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# Source code files
+[*.{h,cpp,rs,py,sh}]
+indent_size = 4
+
+# .cirrus.yml, etc.
+[*.yml]
+indent_size = 2
+
+# Makefiles (only relevant for depends build)
+[Makefile]
+indent_style = tab
+
+# CMake files
+[{CMakeLists.txt,*.cmake,*.cmake.in}]
+indent_size = 2
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..c9cf4a7d
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+src/clientversion.cpp export-subst
diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml
new file mode 100644
index 00000000..7c894ab7
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug.yml
@@ -0,0 +1,92 @@
+name: Bug report
+description: Submit a new bug report.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## This issue tracker is only for technical issues related to Bitcoin Core.
+
+        * General bitcoin questions and/or support requests should use Bitcoin StackExchange at https://bitcoin.stackexchange.com.
+        * For reporting security issues, please read instructions at https://bitcoincore.org/en/contact/.
+        * If the node is "stuck" during sync or giving "block checksum mismatch" errors, please ensure your hardware is stable by running `memtest` and observe CPU temperature with a load-test tool such as `linpack` before creating an issue.
+
+        ----
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue already exists for the bug you encountered.
+      options:
+      - label: I have searched the existing issues
+        required: true
+  - type: textarea
+    id: current-behaviour
+    attributes:
+      label: Current behaviour
+      description: Tell us what went wrong
+    validations:
+      required: true
+  - type: textarea
+    id: expected-behaviour
+    attributes:
+      label: Expected behaviour
+      description: Tell us what you expected to happen
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction-steps
+    attributes:
+      label: Steps to reproduce
+      description: |
+        Tell us how to reproduce your bug. Please attach related screenshots if necessary.
+        * Run-time or compile-time configuration options
+        * Actions taken
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: |
+        Please copy and paste any relevant log output or attach a debug log file.
+
+        You can find the debug.log in your [data dir.](https://github.com/bitcoin/bitcoin/blob/master/doc/files.md#data-directory-location)
+
+        Please be aware that the debug log might contain personally identifying information.
+    validations:
+      required: false
+  - type: dropdown
+    attributes:
+      label: How did you obtain Bitcoin Core
+      multiple: false
+      options:
+        - Compiled from source
+        - Pre-built binaries
+        - Package manager
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: core-version
+    attributes:
+      label: What version of Bitcoin Core are you using?
+      description: Run `bitcoind --version` or in Bitcoin-QT use `Help > About Bitcoin Core`
+      placeholder: e.g. v24.0.1 or master@e1bf547
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Operating system and version
+      placeholder: e.g. "MacOS 26.0" or "Ubuntu 26.04 LTS"
+    validations:
+      required: true
+  - type: textarea
+    id: machine-specs
+    attributes:
+      label: Machine specifications
+      description: |
+        What are the specifications of the host machine?
+        e.g. OS/CPU and disk type, network connectivity
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 00000000..40370284
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Bitcoin Core Security Policy
+    url: https://github.com/bitcoin/bitcoin/blob/master/SECURITY.md
+    about: View security policy
+  - name: Bitcoin Core Developers
+    url: https://bitcoincore.org
+    about: Bitcoin Core homepage
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 00000000..4622fd98
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,36 @@
+name: Feature Request
+description: Suggest an idea for this project.
+labels: [Feature]
+body:
+  - type: textarea
+    id: feature
+    attributes:
+      label: Please describe the feature you'd like to see added.
+      description: Attach screenshots or logs if applicable.
+    validations:
+      required: true
+  - type: textarea
+    id: related-problem
+    attributes:
+      label: Is your feature related to a problem, if so please describe it.
+      description: Attach screenshots or logs if applicable.
+    validations:
+      required: false
+  - type: textarea
+    id: solution
+    attributes:
+      label: Describe the solution you'd like
+    validations:
+      required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Describe any alternatives you've considered
+    validations:
+      required: false
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Please leave any additional context
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/good_first_issue.yml b/.github/ISSUE_TEMPLATE/good_first_issue.yml
new file mode 100644
index 00000000..2a486b3f
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/good_first_issue.yml
@@ -0,0 +1,44 @@
+name: Good First Issue
+description: (Regular devs only) Suggest a new good first issue
+labels: [good first issue]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Please add the label "good first issue" manually before or after opening
+
+        A good first issue is an uncontroversial issue, that has a relatively unique and obvious solution
+
+        Motivate the issue and explain the solution briefly
+  - type: textarea
+    id: motivation
+    attributes:
+      label: Motivation
+      description: Motivate the issue
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Possible solution
+      description: Describe a possible solution
+    validations:
+      required: false
+  - type: textarea
+    id: useful-skills
+    attributes:
+      label: Useful Skills
+      description: For example, “`std::thread`”, “Qt6 GUI and async GUI design” or “basic understanding of Bitcoin mining and the Bitcoin Core RPC interface”.
+      value: |
+        * Compiling Bitcoin Core from source
+        * Running the C++ unit tests and the Python functional tests
+        * ...
+  - type: textarea
+    attributes:
+      label: Guidance for new contributors
+      description: Please leave this to automatically add the footer for new contributors
+      value: |
+        Want to work on this issue?
+
+        For guidance on contributing, please read [CONTRIBUTING.md](https://github.com/bitcoin/bitcoin/blob/master/CONTRIBUTING.md) before opening your pull request.
+
diff --git a/.github/ISSUE_TEMPLATE/gui_issue.yml b/.github/ISSUE_TEMPLATE/gui_issue.yml
new file mode 100644
index 00000000..4fe578e9
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/gui_issue.yml
@@ -0,0 +1,18 @@
+name: Issue or feature request related to the GUI
+description: Any report, issue or feature request related to the GUI
+labels: [GUI]
+body:
+- type: checkboxes
+  id: acknowledgement
+  attributes:
+    label: Issues, reports or feature requests related to the GUI should be opened directly on the GUI repo
+    description: https://github.com/bitcoin-core/gui/issues/
+    options:
+      - label: I still think this issue should be opened here
+        required: true
+- type: textarea
+  id: gui-request
+  attributes:
+    label: Report
+  validations:
+    required: true
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 00000000..ae92fc78
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,43 @@
+<!--
+*** Please remove the following help text before submitting: ***
+
+Pull requests without a rationale and clear improvement may be closed
+immediately.
+
+GUI-related pull requests should be opened against
+https://github.com/bitcoin-core/gui
+first. See CONTRIBUTING.md
+-->
+
+<!--
+Please provide clear motivation for your patch and explain how it improves
+Bitcoin Core user experience or Bitcoin Core developer experience
+significantly:
+
+* Any test improvements or new tests that improve coverage are always welcome.
+* All other changes should have accompanying unit tests (see `src/test/`) or
+  functional tests (see `test/`). Contributors should note which tests cover
+  modified code. If no tests exist for a region of modified code, new tests
+  should accompany the change.
+* Bug fixes are most welcome when they come with steps to reproduce or an
+  explanation of the potential issue as well as reasoning for the way the bug
+  was fixed.
+* Features are welcome, but might be rejected due to design or scope issues.
+  If a feature is based on a lot of dependencies, contributors should first
+  consider building the system outside of Bitcoin Core, if possible.
+* Refactoring changes are only accepted if they are required for a feature or
+  bug fix or otherwise improve developer experience significantly. For example,
+  most "code style" refactoring changes require a thorough explanation why they
+  are useful, what downsides they have and why they *significantly* improve
+  developer experience or avoid serious programming bugs. Note that code style
+  is often a subjective matter. Unless they are explicitly mentioned to be
+  preferred in the [developer notes](/doc/developer-notes.md), stylistic code
+  changes are usually rejected.
+-->
+
+<!--
+Bitcoin Core has a thorough review process and even the most trivial change
+needs to pass a lot of eyes and requires non-zero or even substantial time
+effort to review. There is a huge lack of active reviewers on the project, so
+patches often sit for a long time.
+-->
diff --git a/.github/actions/clear-files/action.yml b/.github/actions/clear-files/action.yml
new file mode 100644
index 00000000..0008f825
--- /dev/null
+++ b/.github/actions/clear-files/action.yml
@@ -0,0 +1,12 @@
+name: 'Clear unnecessary files'
+description: 'Clear out unnecessary files to make space on the VM'
+runs:
+  using: 'composite'
+  steps:
+    - name: Clear unnecessary files
+      shell: bash
+      env:
+        DEBIAN_FRONTEND: noninteractive
+      run: |
+        set +o errexit
+        sudo bash -c '(ionice -c 3 nice -n 19 rm -rf /usr/share/dotnet/ /usr/local/graalvm/ /usr/local/.ghcup/ /usr/local/share/powershell /usr/local/share/chromium /usr/local/lib/android /usr/local/lib/node_modules)&'
diff --git a/.github/actions/configure-docker/action.yml b/.github/actions/configure-docker/action.yml
new file mode 100644
index 00000000..5c9531d3
--- /dev/null
+++ b/.github/actions/configure-docker/action.yml
@@ -0,0 +1,63 @@
+name: 'Configure Docker'
+description: 'Set up Docker build driver and configure build cache args'
+inputs:
+  cache-provider:
+    description: 'gha or cirrus cache provider'
+    required: true
+runs:
+  using: 'composite'
+  steps:
+    - name: Check inputs
+      shell: python
+      run: |
+        # We expect only gha or cirrus as inputs to cache-provider
+        if "${{ inputs.cache-provider }}" not in ("gha", "cirrus"):
+          print("::warning title=Unknown input to configure docker action::Provided value was ${{ inputs.cache-provider }}")
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        # Use host network to allow access to cirrus gha cache running on the host
+        driver-opts: |
+          network=host
+
+    # This is required to allow buildkit to access the actions cache
+    - name: Expose actions cache variables
+      uses: actions/github-script@v6
+      with:
+        script: |
+          Object.keys(process.env).forEach(function (key) {
+            if (key.startsWith('ACTIONS_')) {
+              core.info(`Exporting ${key}`);
+              core.exportVariable(key, process.env[key]);
+            }
+          });
+
+    - name: Construct docker build cache args
+      shell: bash
+      run: |
+        # Configure docker build cache backend
+        #
+        # On forks the gha cache will work but will use Github's cache backend.
+        # Docker will check for variables $ACTIONS_CACHE_URL, $ACTIONS_RESULTS_URL and $ACTIONS_RUNTIME_TOKEN
+        # which are set automatically when running on GitHub infra: https://docs.docker.com/build/cache/backends/gha/#synopsis
+
+        # Use cirrus cache host
+        if [[ ${{ inputs.cache-provider }} == 'cirrus' ]]; then
+          url_args="url=${CIRRUS_CACHE_HOST},url_v2=${CIRRUS_CACHE_HOST}"
+        else
+          url_args=""
+        fi
+
+        # Always optimistically --cache‑from in case a cache blob exists
+        args=(--cache-from "type=gha${url_args:+,${url_args}},scope=${CONTAINER_NAME}")
+
+        # Only add --cache-to when using the Cirrus cache provider and pushing to the default branch.
+        if [[ ${{ inputs.cache-provider }} == 'cirrus' && ${{ github.event_name }} == "push" && ${{ github.ref_name }} == ${{ github.event.repository.default_branch }} ]]; then
+          args+=(--cache-to "type=gha${url_args:+,${url_args}},mode=max,ignore-error=true,scope=${CONTAINER_NAME}")
+        fi
+
+        # Always `--load` into docker images (needed when using the `docker-container` build driver).
+        args+=(--load)
+
+        echo "DOCKER_BUILD_CACHE_ARG=${args[*]}" >> $GITHUB_ENV
diff --git a/.github/actions/configure-environment/action.yml b/.github/actions/configure-environment/action.yml
new file mode 100644
index 00000000..e2a26b71
--- /dev/null
+++ b/.github/actions/configure-environment/action.yml
@@ -0,0 +1,27 @@
+name: 'Configure environment'
+description: 'Configure CI, cache and container name environment variables'
+runs:
+  using: 'composite'
+  steps:
+    - name: Set CI and cache directories
+      shell: bash
+      run: |
+        echo "BASE_ROOT_DIR=${{ runner.temp }}" >> "$GITHUB_ENV"
+        echo "BASE_BUILD_DIR=${{ runner.temp }}/build" >> "$GITHUB_ENV"
+        echo "CCACHE_DIR=${{ runner.temp }}/ccache_dir" >> $GITHUB_ENV
+        echo "DEPENDS_DIR=${{ runner.temp }}/depends" >> "$GITHUB_ENV"
+        echo "BASE_CACHE=${{ runner.temp }}/depends/built" >> $GITHUB_ENV
+        echo "SOURCES_PATH=${{ runner.temp }}/depends/sources" >> $GITHUB_ENV
+        echo "PREVIOUS_RELEASES_DIR=${{ runner.temp }}/previous_releases" >> $GITHUB_ENV
+
+    - name: Set cache hashes
+      shell: bash
+      run: |
+        echo "DEPENDS_HASH=$(git ls-tree HEAD depends "$FILE_ENV" | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
+        echo "PREVIOUS_RELEASES_HASH=$(git ls-tree HEAD test/get_previous_releases.py | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
+
+    - name: Get container name
+      shell: bash
+      run: |
+        source $FILE_ENV
+        echo "CONTAINER_NAME=$CONTAINER_NAME" >> "$GITHUB_ENV"
diff --git a/.github/actions/restore-caches/action.yml b/.github/actions/restore-caches/action.yml
new file mode 100644
index 00000000..8dc35d49
--- /dev/null
+++ b/.github/actions/restore-caches/action.yml
@@ -0,0 +1,47 @@
+name: 'Restore Caches'
+description: 'Restore ccache, depends sources, and built depends caches'
+runs:
+  using: 'composite'
+  steps:
+    - name: Restore Ccache cache
+      id: ccache-cache
+      uses: cirruslabs/cache/restore@v4
+      with:
+        path: ${{ env.CCACHE_DIR }}
+        key: ccache-${{ env.CONTAINER_NAME }}-${{ github.run_id }}
+        restore-keys: |
+          ccache-${{ env.CONTAINER_NAME }}-
+
+    - name: Restore depends sources cache
+      id: depends-sources
+      uses: cirruslabs/cache/restore@v4
+      with:
+        path: ${{ env.SOURCES_PATH }}
+        key: depends-sources-${{ env.CONTAINER_NAME }}-${{ env.DEPENDS_HASH }}
+        restore-keys: |
+          depends-sources-${{ env.CONTAINER_NAME }}-
+
+    - name: Restore built depends cache
+      id: depends-built
+      uses: cirruslabs/cache/restore@v4
+      with:
+        path: ${{ env.BASE_CACHE }}
+        key: depends-built-${{ env.CONTAINER_NAME }}-${{ env.DEPENDS_HASH }}
+        restore-keys: |
+          depends-built-${{ env.CONTAINER_NAME }}-
+
+    - name: Restore previous releases cache
+      id: previous-releases
+      uses: cirruslabs/cache/restore@v4
+      with:
+        path: ${{ env.PREVIOUS_RELEASES_DIR }}
+        key: previous-releases-${{ env.CONTAINER_NAME }}-${{ env.PREVIOUS_RELEASES_HASH }}
+        restore-keys: |
+          previous-releases-${{ env.CONTAINER_NAME }}-
+
+    - name: export cache hits
+      shell: bash
+      run: |
+        echo "depends-sources-cache-hit=${{ steps.depends-sources.outputs.cache-hit }}" >> $GITHUB_ENV
+        echo "depends-built-cache-hit=${{ steps.depends-built.outputs.cache-hit }}" >> $GITHUB_ENV
+        echo "previous-releases-cache-hit=${{ steps.previous-releases.outputs.cache-hit }}" >> $GITHUB_ENV
diff --git a/.github/actions/save-caches/action.yml b/.github/actions/save-caches/action.yml
new file mode 100644
index 00000000..0e3b3124
--- /dev/null
+++ b/.github/actions/save-caches/action.yml
@@ -0,0 +1,39 @@
+name: 'Save Caches'
+description: 'Save ccache, depends sources, and built depends caches'
+runs:
+  using: 'composite'
+  steps:
+    - name: debug cache hit inputs
+      shell: bash
+      run: |
+        echo "depends sources direct cache hit to primary key: ${{ env.depends-sources-cache-hit }}"
+        echo "depends built direct cache hit to primary key: ${{ env.depends-built-cache-hit }}"
+        echo "previous releases direct cache hit to primary key: ${{ env.previous-releases-cache-hit }}"
+
+    - name: Save Ccache cache
+      uses: cirruslabs/cache/save@v4
+      if: ${{ (github.event_name == 'push') && (github.ref_name == github.event.repository.default_branch) }}
+      with:
+        path: ${{ env.CCACHE_DIR }}
+        key: ccache-${{ env.CONTAINER_NAME }}-${{ github.run_id }}
+
+    - name: Save depends sources cache
+      uses: cirruslabs/cache/save@v4
+      if: ${{ (github.event_name == 'push') && (github.ref_name == github.event.repository.default_branch) && (env.depends-sources-cache-hit != 'true') }}
+      with:
+        path: ${{ env.SOURCES_PATH }}
+        key: depends-sources-${{ env.CONTAINER_NAME }}-${{ env.DEPENDS_HASH }}
+
+    - name: Save built depends cache
+      uses: cirruslabs/cache/save@v4
+      if: ${{ (github.event_name == 'push') && (github.ref_name == github.event.repository.default_branch) && (env.depends-built-cache-hit != 'true' )}}
+      with:
+        path: ${{ env.BASE_CACHE }}
+        key: depends-built-${{ env.CONTAINER_NAME }}-${{ env.DEPENDS_HASH }}
+
+    - name: Save previous releases cache
+      uses: cirruslabs/cache/save@v4
+      if: ${{ (github.event_name == 'push') && (github.ref_name == github.event.repository.default_branch) && (env.previous-releases-cache-hit != 'true' )}}
+      with:
+        path: ${{ env.PREVIOUS_RELEASES_DIR }}
+        key: previous-releases-${{ env.CONTAINER_NAME }}-${{ env.PREVIOUS_RELEASES_HASH }}
diff --git a/.github/ci-lint-exec.py b/.github/ci-lint-exec.py
new file mode 100755
index 00000000..73749acc
--- /dev/null
+++ b/.github/ci-lint-exec.py
@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+# Copyright (c) The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit.
+
+import os
+import shlex
+import subprocess
+import sys
+import time
+
+
+def run(cmd, **kwargs):
+    print("+ " + shlex.join(cmd), flush=True)
+    kwargs.setdefault("check", True)
+    try:
+        return subprocess.run(cmd, **kwargs)
+    except Exception as e:
+        sys.exit(e)
+
+
+def main():
+    CONTAINER_NAME = os.environ["CONTAINER_NAME"]
+
+    build_cmd = [
+        "docker", "buildx", "build",
+        f"--tag={CONTAINER_NAME}",
+        *shlex.split(os.getenv("DOCKER_BUILD_CACHE_ARG", "")),
+        "--file=./ci/lint_imagefile",
+        "."
+    ]
+
+    if run(build_cmd, check=False).returncode != 0:
+        print("Retry building image tag after failure")
+        time.sleep(3)
+        run(build_cmd)
+
+    extra_env = []
+    if os.environ["GITHUB_EVENT_NAME"] == "pull_request":
+        extra_env = ["--env", "LINT_CI_IS_PR=1"]
+    if os.environ["GITHUB_EVENT_NAME"] != "pull_request" and os.environ["GITHUB_REPOSITORY"] == "bitcoin/bitcoin":
+        extra_env = ["--env", "LINT_CI_SANITY_CHECK_COMMIT_SIG=1"]
+
+    run([
+        "docker",
+        "run",
+        "--rm",
+        *extra_env,
+        f"--volume={os.getcwd()}:/bitcoin",
+        CONTAINER_NAME,
+    ])
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/ci-test-each-commit-exec.py b/.github/ci-test-each-commit-exec.py
new file mode 100755
index 00000000..b81241bc
--- /dev/null
+++ b/.github/ci-test-each-commit-exec.py
@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+# Copyright (c) The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+import subprocess
+import sys
+import shlex
+
+
+def run(cmd, **kwargs):
+    print("+ " + shlex.join(cmd), flush=True)
+    try:
+        return subprocess.run(cmd, check=True, **kwargs)
+    except Exception as e:
+        sys.exit(e)
+
+
+def main():
+    print("Running tests on commit ...")
+    run(["git", "log", "-1"])
+
+    num_procs = int(run(["nproc"], stdout=subprocess.PIPE).stdout)
+    build_dir = "ci_build"
+
+    run([
+        "cmake",
+        "-B",
+        build_dir,
+        "-Werror=dev",
+        # Use clang++, because it is a bit faster and uses less memory than g++
+        "-DCMAKE_C_COMPILER=clang",
+        "-DCMAKE_CXX_COMPILER=clang++",
+        # Use mold, because it is faster than the default linker
+        "-DCMAKE_EXE_LINKER_FLAGS=-fuse-ld=mold",
+        # Use Debug build type for more debug checks, but enable optimizations
+        "-DAPPEND_CXXFLAGS='-O3 -g2'",
+        "-DAPPEND_CFLAGS='-O3 -g2'",
+        "-DCMAKE_BUILD_TYPE=Debug",
+        "-DWERROR=ON",
+        "--preset=dev-mode",
+        # Tolerate unused member functions in intermediate commits in a pull request
+        "-DCMAKE_CXX_FLAGS=-Wno-error=unused-member-function",
+    ])
+    run(["cmake", "--build", build_dir, "-j", str(num_procs)])
+    run([
+        "ctest",
+        "--output-on-failure",
+        "--stop-on-failure",
+        "--test-dir",
+        build_dir,
+        "-j",
+        str(num_procs),
+    ])
+    run([
+        sys.executable,
+        f"./{build_dir}/test/functional/test_runner.py",
+        "-j",
+        str(num_procs * 2),
+        "--combinedlogslen=99999999",
+    ])
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..daeefddc
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,684 @@
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit.
+
+name: CI
+on:
+  # See: https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request.
+  pull_request:
+  # See: https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#push.
+  push:
+    branches:
+      - '**'
+    tags-ignore:
+      - '**'
+
+concurrency:
+  group: ${{ github.event_name != 'pull_request' && github.run_id || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CI_FAILFAST_TEST_LEAVE_DANGLING: 1  # GHA does not care about dangling processes and setting this variable avoids killing the CI script itself on error
+  CIRRUS_CACHE_HOST: http://127.0.0.1:12321/ # When using Cirrus Runners this host can be used by the docker `gha` build cache type.
+  REPO_USE_CIRRUS_RUNNERS: 'bitcoin/bitcoin' # Use cirrus runners and cache for this repo, instead of falling back to the slow GHA runners
+
+defaults:
+  run:
+    # Enforce fail-fast behavior for all platforms.
+    # See: https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
+    shell: bash
+
+jobs:
+  runners:
+    name: '[meta] determine runners'
+    runs-on: ubuntu-latest
+    outputs:
+      provider: ${{ steps.runners.outputs.provider }}
+    steps:
+      - &ANNOTATION_PR_NUMBER
+        name: Annotate with pull request number
+        # This annotation is machine-readable and can be used to assign a check
+        # run to its corresponding pull request. Running in all check runs is
+        # required, because check re-runs discard the annotations of other
+        # tasks in the test suite.
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "::notice title=debug_pull_request_number_str::${{ github.event.number }}"
+          fi
+      - id: runners
+        run: |
+          if [[ "${REPO_USE_CIRRUS_RUNNERS}" == "${{ github.repository }}" ]]; then
+            echo "provider=cirrus" >> "$GITHUB_OUTPUT"
+            echo "::notice title=Runner Selection::Using Cirrus Runners"
+          else
+            echo "provider=gha" >> "$GITHUB_OUTPUT"
+            echo "::notice title=Runner Selection::Using GitHub-hosted runners"
+          fi
+
+  test-each-commit:
+    name: 'test max 6 ancestor commits'
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' && github.event.pull_request.commits != 1
+    timeout-minutes: 360  # Use maximum time, see https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idtimeout-minutes. Assuming a worst case time of 1 hour per commit, this leads to a --max-count=6 below.
+    env:
+      MAX_COUNT: 6  # Keep in sync with name above
+    steps:
+      - name: Determine fetch depth
+        run: echo "FETCH_DEPTH=$((${{ github.event.pull_request.commits }} + 2))" >> "$GITHUB_ENV"
+      - *ANNOTATION_PR_NUMBER
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: ${{ env.FETCH_DEPTH }}
+      - name: Determine commit range
+        run: |
+          # Checkout HEAD~ and find the test base commit
+          # Checkout HEAD~ because it would be wasteful to rerun tests on the PR
+          # head commit that are already run by other jobs.
+          git checkout HEAD~
+          # Figure out test base commit by listing ancestors of HEAD, excluding
+          # ancestors of the most recent merge commit, limiting the list to the
+          # newest MAX_COUNT ancestors, ordering it from oldest to newest, and
+          # taking the first one.
+          #
+          # If the branch contains up to MAX_COUNT ancestor commits after the
+          # most recent merge commit, all of those commits will be tested. If it
+          # contains more, only the most recent MAX_COUNT commits will be
+          # tested.
+          #
+          # In the command below, the ^@ suffix is used to refer to all parents
+          # of the merge commit as described in:
+          # https://git-scm.com/docs/git-rev-parse#_other_rev_parent_shorthand_notations
+          # and the ^ prefix is used to exclude these parents and all their
+          # ancestors from the rev-list output as described in:
+          # https://git-scm.com/docs/git-rev-list
+          MERGE_BASE=$(git rev-list -n1 --merges HEAD)
+          EXCLUDE_MERGE_BASE_ANCESTORS=
+          # MERGE_BASE can be empty due to limited fetch-depth
+          if test -n "$MERGE_BASE"; then
+            EXCLUDE_MERGE_BASE_ANCESTORS=^${MERGE_BASE}^@
+          fi
+          echo "TEST_BASE=$(git rev-list -n$((${{ env.MAX_COUNT }} + 1)) --reverse HEAD $EXCLUDE_MERGE_BASE_ANCESTORS | head -1)" >> "$GITHUB_ENV"
+      - run: |
+          git fetch origin "${GITHUB_BASE_REF}"
+          git config user.email "ci@example.com"
+          git config user.name "CI"
+      - run: |
+          sudo apt-get update
+          sudo apt-get install clang mold ccache build-essential cmake ninja-build pkgconf python3-zmq libevent-dev libboost-dev libsqlite3-dev systemtap-sdt-dev libzmq3-dev qt6-base-dev qt6-tools-dev qt6-l10n-tools libqrencode-dev capnproto libcapnp-dev -y
+          sudo pip3 install --break-system-packages pycapnp
+      - name: Compile and run tests
+        run: |
+          # Run tests on commits after the last merge commit and before the PR head commit
+          git rebase --exec "git merge --no-commit origin/${GITHUB_BASE_REF} && python3 ./.github/ci-test-each-commit-exec.py && git reset --hard" ${{ env.TEST_BASE }}
+
+  macos-native-arm64:
+    name: ${{ matrix.job-name }}
+    # Use any image to support the xcode-select below, but hardcode version to avoid silent upgrades (and breaks).
+    # See: https://github.com/actions/runner-images#available-images.
+    runs-on: macos-15
+
+    # When a contributor maintains a fork of the repo, any pull request they make
+    # to their own fork, or to the main repository, will trigger two CI runs:
+    # one for the branch push and one for the pull request.
+    # This can be avoided by setting SKIP_BRANCH_PUSH=true as a custom env variable
+    # in Github repository settings.
+    if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}
+
+    timeout-minutes: 120
+
+    strategy:
+      fail-fast: false
+      matrix:
+        job-type: [standard, fuzz]
+        include:
+          - job-type: standard
+            file-env: './ci/test/00_setup_env_mac_native.sh'
+            job-name: 'macOS native'
+          - job-type: fuzz
+            file-env: './ci/test/00_setup_env_mac_native_fuzz.sh'
+            job-name: 'macOS native, fuzz'
+
+    env:
+      DANGER_RUN_CI_ON_HOST: 1
+      BASE_ROOT_DIR: ${{ github.workspace }}/repo_archive
+
+    steps:
+      - *ANNOTATION_PR_NUMBER
+
+      - &CHECKOUT
+        name: Checkout
+        uses: actions/checkout@v6
+        with:
+          # Ensure the latest merged pull request state is used, even on re-runs.
+          ref: &CHECKOUT_REF_TMPL ${{ github.event_name == 'pull_request' && github.ref || '' }}
+
+      - name: Clang version
+        run: |
+          # Use the latest Xcode supported by the version of macOS denoted in
+          # doc/release-notes-empty-template.md and providing at least the
+          # minimum clang version denoted in doc/dependencies.md.
+          # See: https://developer.apple.com/documentation/xcode-release-notes/xcode-16_2-release-notes
+          sudo xcode-select --switch /Applications/Xcode_16.2.app
+          clang --version
+
+      - name: Install Homebrew packages
+        env:
+          HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: 1
+        run: |
+          # A workaround for "The `brew link` step did not complete successfully" error.
+          brew install --quiet python@3 || brew link --overwrite python@3
+          brew install --quiet coreutils ninja pkgconf gnu-getopt ccache boost libevent zeromq qt@6 qrencode capnp
+
+      - name: Set Ccache directory
+        run: echo "CCACHE_DIR=${RUNNER_TEMP}/ccache_dir" >> "$GITHUB_ENV"
+
+      - name: Restore Ccache cache
+        id: ccache-cache
+        uses: actions/cache/restore@v4
+        with:
+          path: ${{ env.CCACHE_DIR }}
+          key: ${{ github.job }}-${{ matrix.job-type }}-ccache-${{ github.run_id }}
+          restore-keys: ${{ github.job }}-${{ matrix.job-type }}-ccache-
+
+      - name: Create git archive
+        run: |
+          git log -1
+          git archive --format=tar --prefix=repo_archive/ --output=repo.tar HEAD
+          tar -xf repo.tar
+
+      - name: CI script
+        run: |
+          cd repo_archive
+          ./ci/test_run_all.sh
+        env:
+          FILE_ENV: ${{ matrix.file-env }}
+
+      - name: Save Ccache cache
+        uses: actions/cache/save@v4
+        if: github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch && steps.ccache-cache.outputs.cache-hit != 'true'
+        with:
+          path: ${{ env.CCACHE_DIR }}
+          # https://github.com/actions/cache/blob/main/tips-and-workarounds.md#update-a-cache
+          key: ${{ github.job }}-${{ matrix.job-type }}-ccache-${{ github.run_id }}
+
+  windows-native-dll:
+    name: ${{ matrix.job-name }}
+    runs-on: windows-2022
+
+    if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}
+
+    env:
+      PYTHONUTF8: 1
+      TEST_RUNNER_TIMEOUT_FACTOR: 40
+
+    strategy:
+      fail-fast: false
+      matrix:
+        job-type: [standard, fuzz]
+        include:
+          - job-type: standard
+            generate-options: '-DBUILD_BENCH=ON -DBUILD_KERNEL_LIB=ON -DBUILD_UTIL_CHAINSTATE=ON -DWERROR=ON'
+            job-name: 'Windows native, VS 2022'
+          - job-type: fuzz
+            generate-options: '-DVCPKG_MANIFEST_NO_DEFAULT_FEATURES=ON -DVCPKG_MANIFEST_FEATURES="wallet" -DBUILD_GUI=OFF -DWITH_ZMQ=OFF -DBUILD_FOR_FUZZING=ON -DWERROR=ON'
+            job-name: 'Windows native, fuzz, VS 2022'
+
+    steps:
+      - *ANNOTATION_PR_NUMBER
+
+      - *CHECKOUT
+
+      - &SET_UP_VS
+        name: Set up VS Developer Prompt
+        shell: pwsh -Command "$PSVersionTable; $PSNativeCommandUseErrorActionPreference = $true; $ErrorActionPreference = 'Stop'; & '{0}'"
+        run: |
+          $vswherePath = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+          $installationPath = & $vswherePath -latest -property installationPath
+          & "${env:COMSPEC}" /s /c "`"$installationPath\Common7\Tools\vsdevcmd.bat`" -arch=x64 -no_logo && set" | foreach-object {
+            $name, $value = $_ -split '=', 2
+            echo "$name=$value" >> $env:GITHUB_ENV
+          }
+
+      - name: Get tool information
+        shell: pwsh
+        run: |
+          cmake -version | Tee-Object -FilePath "cmake_version"
+          Write-Output "---"
+          msbuild -version | Tee-Object -FilePath "msbuild_version"
+          $env:VCToolsVersion | Tee-Object -FilePath "toolset_version"
+          py -3 --version
+          Write-Host "PowerShell version $($PSVersionTable.PSVersion.ToString())"
+          bash --version
+
+      - name: Using vcpkg with MSBuild
+        run: |
+          echo "set(VCPKG_BUILD_TYPE release)" >> "${VCPKG_INSTALLATION_ROOT}/triplets/x64-windows.cmake"
+          # Workaround for libevent, which requires CMake 3.1 but is incompatible with CMake >= 4.0.
+          sed -i '1s/^/set(ENV{CMAKE_POLICY_VERSION_MINIMUM} 3.5)\n/' "${VCPKG_INSTALLATION_ROOT}/scripts/ports.cmake"
+
+      - name: vcpkg tools cache
+        uses: actions/cache@v4
+        with:
+          path: C:/vcpkg/downloads/tools
+          key: ${{ github.job }}-vcpkg-tools
+
+      - name: Restore vcpkg binary cache
+        uses: actions/cache/restore@v4
+        id: vcpkg-binary-cache
+        with:
+          path: ~/AppData/Local/vcpkg/archives
+          key: ${{ github.job }}-vcpkg-binary-${{ hashFiles('cmake_version', 'msbuild_version', 'toolset_version', 'vcpkg.json') }}
+
+      - name: Generate build system
+        run: |
+          cmake -B build -Werror=dev --preset vs2022 -DCMAKE_TOOLCHAIN_FILE="${VCPKG_INSTALLATION_ROOT}/scripts/buildsystems/vcpkg.cmake" ${{ matrix.generate-options }}
+
+      - name: Save vcpkg binary cache
+        uses: actions/cache/save@v4
+        if: github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch && steps.vcpkg-binary-cache.outputs.cache-hit != 'true' && matrix.job-type == 'standard'
+        with:
+          path: ~/AppData/Local/vcpkg/archives
+          key: ${{ github.job }}-vcpkg-binary-${{ hashFiles('cmake_version', 'msbuild_version', 'toolset_version', 'vcpkg.json') }}
+
+      - name: Build
+        working-directory: build
+        run: |
+          cmake --build . -j $NUMBER_OF_PROCESSORS --config Release
+
+      - name: Check executable manifests
+        if: matrix.job-type == 'standard'
+        working-directory: build
+        shell: pwsh -Command "$PSVersionTable; $PSNativeCommandUseErrorActionPreference = $true; $ErrorActionPreference = 'Stop'; & '{0}'"
+        run: |
+          mt.exe -nologo -inputresource:bin\Release\bitcoind.exe -out:bitcoind.manifest
+          Get-Content bitcoind.manifest
+
+          Get-ChildItem -Filter "bin\Release\*.exe" | ForEach-Object {
+            $exeName = $_.Name
+
+            # Skip as they currently do not have manifests
+            if ($exeName -eq "fuzz.exe" -or $exeName -eq "bench_bitcoin.exe" -or $exeName -eq "test_bitcoin-qt.exe" -or $exeName -eq "test_kernel.exe" -or $exeName -eq "bitcoin-chainstate.exe") {
+              Write-Host "Skipping $exeName (no manifest present)"
+              return
+            }
+
+            Write-Host "Checking $exeName"
+            & mt.exe -nologo -inputresource:$_.FullName -validate_manifest
+          }
+
+      - name: Run test suite
+        if: matrix.job-type == 'standard'
+        working-directory: build
+        run: |
+          ctest --output-on-failure --stop-on-failure -j $NUMBER_OF_PROCESSORS -C Release
+
+      - name: Run functional tests
+        if: matrix.job-type == 'standard'
+        working-directory: build
+        env:
+          BITCOIN_BIN: '${{ github.workspace }}\build\bin\Release\bitcoin.exe'
+          BITCOIND: '${{ github.workspace }}\build\bin\Release\bitcoind.exe'
+          BITCOINCLI: '${{ github.workspace }}\build\bin\Release\bitcoin-cli.exe'
+          BITCOIN_BENCH: '${{ github.workspace }}\build\bin\Release\bench_bitcoin.exe'
+          BITCOINTX: '${{ github.workspace }}\build\bin\Release\bitcoin-tx.exe'
+          BITCOINUTIL: '${{ github.workspace }}\build\bin\Release\bitcoin-util.exe'
+          BITCOINWALLET: '${{ github.workspace }}\build\bin\Release\bitcoin-wallet.exe'
+          BITCOINCHAINSTATE: '${{ github.workspace }}\build\bin\Release\bitcoin-chainstate.exe'
+          TEST_RUNNER_EXTRA: ${{ github.event_name != 'pull_request' && '--extended' || '' }}
+        run: |
+          py -3 -m pip install pyzmq
+          py -3 test/functional/test_runner.py --jobs $NUMBER_OF_PROCESSORS --quiet --tmpdirprefix="${RUNNER_TEMP}" --combinedlogslen=99999999 --timeout-factor=${TEST_RUNNER_TIMEOUT_FACTOR} ${TEST_RUNNER_EXTRA}
+
+      - name: Clone corpora
+        if: matrix.job-type == 'fuzz'
+        run: |
+          git clone --depth=1 https://github.com/bitcoin-core/qa-assets "${RUNNER_TEMP}/qa-assets"
+          cd "${RUNNER_TEMP}/qa-assets"
+          echo "Using qa-assets repo from commit ..."
+          git log -1
+
+      - name: Run fuzz tests
+        if: matrix.job-type == 'fuzz'
+        working-directory: build
+        env:
+          BITCOINFUZZ: '${{ github.workspace }}\build\bin\Release\fuzz.exe'
+        run: |
+          py -3 test/fuzz/test_runner.py --par $NUMBER_OF_PROCESSORS --loglevel DEBUG "${RUNNER_TEMP}/qa-assets/fuzz_corpora"
+
+  record-frozen-commit:
+    # Record frozen commit, so that the native tests on cross-builds can run on
+    # the exact same commit id of the build.
+    name: '[meta] record frozen commit'
+    runs-on: ubuntu-latest
+    outputs:
+      commit: ${{ steps.record-commit.outputs.commit }}
+    steps:
+      - *ANNOTATION_PR_NUMBER
+      - *CHECKOUT
+      - name: Record commit
+        id: record-commit
+        run: echo "commit=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  windows-cross:
+    name: 'Windows-cross to x86_64, ${{ matrix.crt }}'
+    needs: [runners, record-frozen-commit]
+    runs-on: ${{ needs.runners.outputs.provider == 'cirrus' && 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-sm' || 'ubuntu-24.04' }}
+    if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        crt: [msvcrt, ucrt]
+        include:
+          - crt: msvcrt
+            file-env: './ci/test/00_setup_env_win64_msvcrt.sh'
+            artifact-name: 'x86_64-w64-mingw32-executables'
+          - crt: ucrt
+            file-env: './ci/test/00_setup_env_win64.sh'
+            artifact-name: 'x86_64-w64-mingw32ucrt-executables'
+
+    env:
+      FILE_ENV: ${{ matrix.file-env }}
+      DANGER_CI_ON_HOST_FOLDERS: 1
+
+    steps:
+      - *ANNOTATION_PR_NUMBER
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.record-frozen-commit.outputs.commit }}
+
+      - name: Configure environment
+        uses: ./.github/actions/configure-environment
+
+      - name: Restore caches
+        id: restore-cache
+        uses: ./.github/actions/restore-caches
+
+      - name: Configure Docker
+        uses: ./.github/actions/configure-docker
+        with:
+          cache-provider: ${{ needs.runners.outputs.provider }}
+
+      - name: CI script
+        run: ./ci/test_run_all.sh
+
+      - name: Save caches
+        uses: ./.github/actions/save-caches
+
+      - name: Upload built executables
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact-name }}-${{ github.run_id }}
+          path: |
+            ${{ env.BASE_BUILD_DIR }}/bin/*.dll
+            ${{ env.BASE_BUILD_DIR }}/bin/*.exe
+            ${{ env.BASE_BUILD_DIR }}/src/secp256k1/bin/*.exe
+            ${{ env.BASE_BUILD_DIR }}/src/univalue/*.exe
+            ${{ env.BASE_BUILD_DIR }}/test/config.ini
+
+  windows-native-test:
+    name: 'Windows, ${{ matrix.crt }}, test cross-built'
+    runs-on: windows-2022
+    needs: [windows-cross, record-frozen-commit]
+
+    strategy:
+      fail-fast: false
+      matrix:
+        crt: [msvcrt, ucrt]
+        include:
+          - crt: msvcrt
+            artifact-name: 'x86_64-w64-mingw32-executables'
+          - crt: ucrt
+            artifact-name: 'x86_64-w64-mingw32ucrt-executables'
+
+    env:
+      PYTHONUTF8: 1
+      TEST_RUNNER_TIMEOUT_FACTOR: 40
+
+    steps:
+      - *ANNOTATION_PR_NUMBER
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.record-frozen-commit.outputs.commit }}
+
+      - name: Download built executables
+        uses: actions/download-artifact@v5
+        with:
+          name: ${{ matrix.artifact-name }}-${{ github.run_id }}
+
+      - name: Run bitcoind.exe
+        run: ./bin/bitcoind.exe -version
+
+      - *SET_UP_VS
+
+      - name: Check executable manifests
+        shell: pwsh -Command "$PSVersionTable; $PSNativeCommandUseErrorActionPreference = $true; $ErrorActionPreference = 'Stop'; & '{0}'"
+        run: |
+          mt.exe -nologo -inputresource:bin\bitcoind.exe -out:bitcoind.manifest
+          Get-Content bitcoind.manifest
+
+          Get-ChildItem -Filter "bin\*.exe" | ForEach-Object {
+            $exeName = $_.Name
+
+            # Skip as they currently do not have manifests
+            if ($exeName -eq "fuzz.exe" -or $exeName -eq "bench_bitcoin.exe" -or $exeName -eq "test_kernel.exe") {
+              Write-Host "Skipping $exeName (no manifest present)"
+              return
+            }
+
+            Write-Host "Checking $exeName"
+            & mt.exe -nologo -inputresource:$_.FullName -validate_manifest
+          }
+
+      - name: Run unit tests
+        # Can't use ctest here like other jobs as we don't have a CMake build tree.
+        run: |
+          ./bin/test_bitcoin-qt.exe
+          ./bin/test_bitcoin.exe -l test_suite  # Intentionally run sequentially here, to catch test case failures caused by dirty global state from prior test cases.
+          ./src/secp256k1/bin/exhaustive_tests.exe
+          ./src/secp256k1/bin/noverify_tests.exe
+          ./src/secp256k1/bin/tests.exe
+          ./src/univalue/object.exe
+          ./src/univalue/unitester.exe
+
+      - name: Adjust paths in test/config.ini
+        shell: pwsh
+        run: |
+          (Get-Content "test/config.ini") -replace '(?<=^SRCDIR=).*', '${{ github.workspace }}' -replace '(?<=^BUILDDIR=).*', '${{ github.workspace }}' -replace '(?<=^RPCAUTH=).*', '${{ github.workspace }}/share/rpcauth/rpcauth.py' | Set-Content "test/config.ini"
+          Get-Content "test/config.ini"
+
+      - name: Set previous release directory
+        run: |
+          echo "PREVIOUS_RELEASES_DIR=${{ runner.temp }}/previous_releases" >> "$GITHUB_ENV"
+
+      - name: Get previous releases
+        run: ./test/get_previous_releases.py --target-dir $PREVIOUS_RELEASES_DIR
+
+      - name: Run functional tests
+        env:
+          TEST_RUNNER_EXTRA: ${{ github.event_name != 'pull_request' && '--extended' || '' }}
+        run: |
+          py -3 -m pip install pyzmq
+          py -3 test/functional/test_runner.py --jobs $NUMBER_OF_PROCESSORS --quiet --tmpdirprefix="$RUNNER_TEMP" --combinedlogslen=99999999 --timeout-factor=$TEST_RUNNER_TIMEOUT_FACTOR $TEST_RUNNER_EXTRA \
+            `# feature_unsupported_utxo_db.py fails on Windows because of emojis in the test data directory.` \
+            --exclude feature_unsupported_utxo_db.py \
+            `# See https://github.com/bitcoin/bitcoin/issues/31409.` \
+            --exclude wallet_multiwallet.py
+          # Run feature_unsupported_utxo_db sequentially in ASCII-only tmp dir,
+          # because it is excluded above due to lack of UTF-8 support in the
+          # ancient release.
+          py -3 test/functional/feature_unsupported_utxo_db.py --previous-releases --tmpdir="${RUNNER_TEMP}/test_feature_unsupported_utxo_db"
+
+  ci-matrix:
+    name: ${{ matrix.name }}
+    needs: runners
+    runs-on: ${{ needs.runners.outputs.provider == 'cirrus' && matrix.cirrus-runner || matrix.fallback-runner }}
+    if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}
+    timeout-minutes: ${{ matrix.timeout-minutes }}
+
+    env:
+      DANGER_CI_ON_HOST_FOLDERS: 1
+      FILE_ENV: ${{ matrix.file-env }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: 'iwyu'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_native_iwyu.sh'
+
+          - name: '32 bit ARM'
+            cirrus-runner: 'ubuntu-24.04-arm' # Cirrus' Arm runners are Apple (with virtual Linux aarch64), which doesn't support 32-bit mode
+            fallback-runner: 'ubuntu-24.04-arm'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_arm.sh'
+            provider: 'gha'
+
+          - name: 'ASan + LSan + UBSan + integer'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md' # has to match container in ci/test/00_setup_env_native_asan.sh for tracing tools
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_native_asan.sh'
+
+          - name: 'macOS-cross to arm64'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-sm'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_mac_cross.sh'
+
+          - name: 'macOS-cross to x86_64'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-sm'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_mac_cross_intel.sh'
+
+          - name: 'No wallet'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-sm'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_native_nowallet.sh'
+
+          - name: 'i686, no IPC'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_i686_no_ipc.sh'
+
+          - name: 'fuzzer,address,undefined,integer'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 240
+            file-env: './ci/test/00_setup_env_native_fuzz.sh'
+
+          - name: 'Valgrind, fuzz'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 240
+            file-env: './ci/test/00_setup_env_native_fuzz_with_valgrind.sh'
+
+          - name: 'previous releases'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_native_previous_releases.sh'
+
+          - name: 'Alpine (musl)'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_native_alpine_musl.sh'
+
+          - name: 'tidy'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_native_tidy.sh'
+
+          - name: 'TSan'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_native_tsan.sh'
+
+          - name: 'MSan, fuzz'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-md'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 150
+            file-env: './ci/test/00_setup_env_native_fuzz_with_msan.sh'
+
+          - name: 'MSan'
+            cirrus-runner: 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg'
+            fallback-runner: 'ubuntu-24.04'
+            timeout-minutes: 120
+            file-env: './ci/test/00_setup_env_native_msan.sh'
+
+    steps:
+      - *ANNOTATION_PR_NUMBER
+
+      - *CHECKOUT
+
+      - name: Configure environment
+        uses: ./.github/actions/configure-environment
+
+      - name: Restore caches
+        id: restore-cache
+        uses: ./.github/actions/restore-caches
+
+      - name: Configure Docker
+        uses: ./.github/actions/configure-docker
+        with:
+          cache-provider: ${{ matrix.provider || needs.runners.outputs.provider }}
+
+      - name: Clear unnecessary files
+        if: ${{ needs.runners.outputs.provider == 'gha' && true || false }} # Only needed on GHA runners
+        uses: ./.github/actions/clear-files
+
+      - name: Enable bpfcc script
+        if: ${{ env.CONTAINER_NAME == 'ci_native_asan' }}
+        # In the image build step, no external environment variables are available,
+        # so any settings will need to be written to the settings env file:
+        run: sed -i "s|\${INSTALL_BCC_TRACING_TOOLS}|true|g" ./ci/test/00_setup_env_native_asan.sh
+
+      - name: Set mmap_rnd_bits
+        if: ${{ env.CONTAINER_NAME == 'ci_native_tsan' || env.CONTAINER_NAME == 'ci_native_msan' || env.CONTAINER_NAME == 'ci_native_fuzz_msan' }}
+        # Prevents crashes due to high ASLR entropy
+        run: sudo sysctl -w vm.mmap_rnd_bits=28
+
+      - name: CI script
+        run: ./ci/test_run_all.sh
+
+      - name: Save caches
+        uses: ./.github/actions/save-caches
+
+  lint:
+    name: 'lint'
+    needs: runners
+    runs-on: ${{ needs.runners.outputs.provider == 'cirrus' && 'ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-xs' || 'ubuntu-24.04' }}
+    if: ${{ vars.SKIP_BRANCH_PUSH != 'true' || github.event_name == 'pull_request' }}
+    timeout-minutes: 20
+    env:
+      CONTAINER_NAME: "bitcoin-linter"
+    steps:
+      - *ANNOTATION_PR_NUMBER
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: *CHECKOUT_REF_TMPL
+          fetch-depth: 0
+
+      - name: Configure Docker
+        uses: ./.github/actions/configure-docker
+        with:
+          cache-provider: ${{ needs.runners.outputs.provider }}
+
+      - name: CI script
+        run: python .github/ci-lint-exec.py
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..b92988f6
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,29 @@
+# Patterns that are specific to a text editor, IDE, operating system, or user
+# environment are not added here. They should be added to your local gitignore
+# file instead:
+# https://docs.github.com/en/get-started/git-basics/ignoring-files#configuring-ignored-files-for-all-repositories-on-your-computer
+
+# Build subdirectories.
+/*build*
+!/build-aux
+!/build_msvc
+
+*.pyc
+
+# Only ignore unexpected patches
+*.patch
+!ci/test/*.patch
+!contrib/guix/patches/*.patch
+!depends/patches/**/*.patch
+
+/CMakeUserPresets.json
+
+# Previous releases
+/releases
+
+# cargo default target dir
+target/
+
+/guix-build-*
+
+/ci/scratch/
diff --git a/.python-version b/.python-version
new file mode 100644
index 00000000..1445aee8
--- /dev/null
+++ b/.python-version
@@ -0,0 +1 @@
+3.10.14
diff --git a/.style.yapf b/.style.yapf
new file mode 100644
index 00000000..350ac638
--- /dev/null
+++ b/.style.yapf
@@ -0,0 +1,261 @@
+[style]
+# Align closing bracket with visual indentation.
+align_closing_bracket_with_visual_indent=True
+
+# Allow dictionary keys to exist on multiple lines. For example:
+#
+#   x = {
+#       ('this is the first element of a tuple',
+#        'this is the second element of a tuple'):
+#            value,
+#   }
+allow_multiline_dictionary_keys=False
+
+# Allow lambdas to be formatted on more than one line.
+allow_multiline_lambdas=False
+
+# Allow splits before the dictionary value.
+allow_split_before_dict_value=True
+
+# Number of blank lines surrounding top-level function and class
+# definitions.
+blank_lines_around_top_level_definition=2
+
+# Insert a blank line before a class-level docstring.
+blank_line_before_class_docstring=False
+
+# Insert a blank line before a module docstring.
+blank_line_before_module_docstring=False
+
+# Insert a blank line before a 'def' or 'class' immediately nested
+# within another 'def' or 'class'. For example:
+#
+#   class Foo:
+#                      # <------ this blank line
+#     def method():
+#       ...
+blank_line_before_nested_class_or_def=False
+
+# Do not split consecutive brackets. Only relevant when
+# dedent_closing_brackets is set. For example:
+#
+#    call_func_that_takes_a_dict(
+#        {
+#            'key1': 'value1',
+#            'key2': 'value2',
+#        }
+#    )
+#
+# would reformat to:
+#
+#    call_func_that_takes_a_dict({
+#        'key1': 'value1',
+#        'key2': 'value2',
+#    })
+coalesce_brackets=False
+
+# The column limit.
+column_limit=160
+
+# The style for continuation alignment. Possible values are:
+#
+# - SPACE: Use spaces for continuation alignment. This is default behavior.
+# - FIXED: Use fixed number (CONTINUATION_INDENT_WIDTH) of columns
+#   (ie: CONTINUATION_INDENT_WIDTH/INDENT_WIDTH tabs) for continuation
+#   alignment.
+# - LESS: Slightly left if cannot vertically align continuation lines with
+#   indent characters.
+# - VALIGN-RIGHT: Vertically align continuation lines with indent
+#   characters. Slightly right (one more indent character) if cannot
+#   vertically align continuation lines with indent characters.
+#
+# For options FIXED, and VALIGN-RIGHT are only available when USE_TABS is
+# enabled.
+continuation_align_style=SPACE
+
+# Indent width used for line continuations.
+continuation_indent_width=4
+
+# Put closing brackets on a separate line, dedented, if the bracketed
+# expression can't fit in a single line. Applies to all kinds of brackets,
+# including function definitions and calls. For example:
+#
+#   config = {
+#       'key1': 'value1',
+#       'key2': 'value2',
+#   }        # <--- this bracket is dedented and on a separate line
+#
+#   time_series = self.remote_client.query_entity_counters(
+#       entity='dev3246.region1',
+#       key='dns.query_latency_tcp',
+#       transform=Transformation.AVERAGE(window=timedelta(seconds=60)),
+#       start_ts=now()-timedelta(days=3),
+#       end_ts=now(),
+#   )        # <--- this bracket is dedented and on a separate line
+dedent_closing_brackets=False
+
+# Disable the heuristic which places each list element on a separate line
+# if the list is comma-terminated.
+disable_ending_comma_heuristic=False
+
+# Place each dictionary entry onto its own line.
+each_dict_entry_on_separate_line=True
+
+# The regex for an i18n comment. The presence of this comment stops
+# reformatting of that line, because the comments are required to be
+# next to the string they translate.
+i18n_comment=
+
+# The i18n function call names. The presence of this function stops
+# reformatting on that line, because the string it has cannot be moved
+# away from the i18n comment.
+i18n_function_call=
+
+# Indent the dictionary value if it cannot fit on the same line as the
+# dictionary key. For example:
+#
+#   config = {
+#       'key1':
+#           'value1',
+#       'key2': value1 +
+#               value2,
+#   }
+indent_dictionary_value=False
+
+# The number of columns to use for indentation.
+indent_width=4
+
+# Join short lines into one line. E.g., single line 'if' statements.
+join_multiple_lines=True
+
+# Do not include spaces around selected binary operators. For example:
+#
+#   1 + 2 * 3 - 4 / 5
+#
+# will be formatted as follows when configured with "*,/":
+#
+#   1 + 2*3 - 4/5
+#
+no_spaces_around_selected_binary_operators=
+
+# Use spaces around default or named assigns.
+spaces_around_default_or_named_assign=False
+
+# Use spaces around the power operator.
+spaces_around_power_operator=False
+
+# The number of spaces required before a trailing comment.
+spaces_before_comment=2
+
+# Insert a space between the ending comma and closing bracket of a list,
+# etc.
+space_between_ending_comma_and_closing_bracket=True
+
+# Split before arguments
+split_all_comma_separated_values=False
+
+# Split before arguments if the argument list is terminated by a
+# comma.
+split_arguments_when_comma_terminated=False
+
+# Set to True to prefer splitting before '&', '|' or '^' rather than
+# after.
+split_before_bitwise_operator=True
+
+# Split before the closing bracket if a list or dict literal doesn't fit on
+# a single line.
+split_before_closing_bracket=True
+
+# Split before a dictionary or set generator (comp_for). For example, note
+# the split before the 'for':
+#
+#   foo = {
+#       variable: 'Hello world, have a nice day!'
+#       for variable in bar if variable != 42
+#   }
+split_before_dict_set_generator=True
+
+# Split before the '.' if we need to split a longer expression:
+#
+#   foo = ('This is a really long string: {}, {}, {}, {}'.format(a, b, c, d))
+#
+# would reformat to something like:
+#
+#   foo = ('This is a really long string: {}, {}, {}, {}'
+#          .format(a, b, c, d))
+split_before_dot=False
+
+# Split after the opening paren which surrounds an expression if it doesn't
+# fit on a single line.
+split_before_expression_after_opening_paren=False
+
+# If an argument / parameter list is going to be split, then split before
+# the first argument.
+split_before_first_argument=False
+
+# Set to True to prefer splitting before 'and' or 'or' rather than
+# after.
+split_before_logical_operator=True
+
+# Split named assignments onto individual lines.
+split_before_named_assigns=True
+
+# Set to True to split list comprehensions and generators that have
+# non-trivial expressions and multiple clauses before each of these
+# clauses. For example:
+#
+#   result = [
+#       a_long_var + 100 for a_long_var in xrange(1000)
+#       if a_long_var % 10]
+#
+# would reformat to something like:
+#
+#   result = [
+#       a_long_var + 100
+#       for a_long_var in xrange(1000)
+#       if a_long_var % 10]
+split_complex_comprehension=False
+
+# The penalty for splitting right after the opening bracket.
+split_penalty_after_opening_bracket=30
+
+# The penalty for splitting the line after a unary operator.
+split_penalty_after_unary_operator=10000
+
+# The penalty for splitting right before an if expression.
+split_penalty_before_if_expr=0
+
+# The penalty of splitting the line around the '&', '|', and '^'
+# operators.
+split_penalty_bitwise_operator=300
+
+# The penalty for splitting a list comprehension or generator
+# expression.
+split_penalty_comprehension=80
+
+# The penalty for characters over the column limit.
+split_penalty_excess_character=7000
+
+# The penalty incurred by adding a line split to the unwrapped line. The
+# more line splits added the higher the penalty.
+split_penalty_for_added_line_split=30
+
+# The penalty of splitting a list of "import as" names. For example:
+#
+#   from a_very_long_or_indented_module_name_yada_yad import (long_argument_1,
+#                                                             long_argument_2,
+#                                                             long_argument_3)
+#
+# would reformat to something like:
+#
+#   from a_very_long_or_indented_module_name_yada_yad import (
+#       long_argument_1, long_argument_2, long_argument_3)
+split_penalty_import_names=0
+
+# The penalty of splitting the line around the 'and' and 'or'
+# operators.
+split_penalty_logical_operator=300
+
+# Use the Tab character for indentation.
+use_tabs=False
+
diff --git a/.tx/config b/.tx/config
new file mode 100644
index 00000000..a7550d08
--- /dev/null
+++ b/.tx/config
@@ -0,0 +1,7 @@
+[main]
+host = https://www.transifex.com
+
+[o:bitcoin:p:bitcoin:r:qt-translation-030x]
+file_filter = src/qt/locale/bitcoin_<lang>.xlf
+source_file = src/qt/locale/bitcoin_en.xlf
+source_lang = en
diff --git a/CMakeLists.txt b/CMakeLists.txt
new file mode 100644
index 00000000..1b1df77b
--- /dev/null
+++ b/CMakeLists.txt
@@ -0,0 +1,706 @@
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+# Ubuntu 22.04 LTS Jammy Jellyfish, https://wiki.ubuntu.com/Releases, EOSS in June 2027:
+#  - CMake 3.22.1, https://packages.ubuntu.com/jammy/cmake
+#
+# Centos Stream 9, https://www.centos.org/cl-vs-cs/#end-of-life, EOL in May 2027:
+#  - CMake 3.26.5, https://mirror.stream.centos.org/9-stream/AppStream/x86_64/os/Packages/
+cmake_minimum_required(VERSION 3.22)
+
+if(CMAKE_SOURCE_DIR STREQUAL CMAKE_BINARY_DIR)
+  message(FATAL_ERROR "In-source builds are not allowed.")
+endif()
+
+if(POLICY CMP0171)
+  # `codegen` is a reserved target name.
+  # See: https://cmake.org/cmake/help/latest/policy/CMP0171.html
+  cmake_policy(SET CMP0171 NEW)
+endif()
+
+# When adjusting CMake flag variables, we must not override those explicitly
+# set by the user. These are a subset of the CACHE_VARIABLES property.
+get_directory_property(precious_variables CACHE_VARIABLES)
+
+#=============================
+# Project / Package metadata
+#=============================
+set(CLIENT_NAME "Bitcoin Core")
+set(CLIENT_VERSION_MAJOR 30)
+set(CLIENT_VERSION_MINOR 99)
+set(CLIENT_VERSION_BUILD 0)
+set(CLIENT_VERSION_RC 0)
+set(CLIENT_VERSION_IS_RELEASE "false")
+set(COPYRIGHT_YEAR "2026")
+
+# During the enabling of the CXX and CXXOBJ languages, we modify
+# CMake's compiler/linker invocation strings by appending the content
+# of the user-defined `APPEND_*` variables, which allows overriding
+# any flag. We also ensure that the APPEND_* flags are considered
+# during CMake's tests, which use the `try_compile()` command.
+#
+# CMake's docs state that the `CMAKE_TRY_COMPILE_PLATFORM_VARIABLES`
+# variable "is meant to be set by CMake's platform information modules
+# for the current toolchain, or by a toolchain file." We do our best
+# to set it before the `project()` command.
+set(CMAKE_TRY_COMPILE_PLATFORM_VARIABLES
+  CMAKE_CXX_COMPILE_OBJECT
+  CMAKE_OBJCXX_COMPILE_OBJECT
+  CMAKE_CXX_LINK_EXECUTABLE
+)
+
+project(BitcoinCore
+  VERSION ${CLIENT_VERSION_MAJOR}.${CLIENT_VERSION_MINOR}.${CLIENT_VERSION_BUILD}
+  DESCRIPTION "Bitcoin client software"
+  HOMEPAGE_URL "https://bitcoincore.org/"
+  LANGUAGES NONE
+)
+
+set(CLIENT_VERSION_STRING ${PROJECT_VERSION})
+if(CLIENT_VERSION_RC GREATER 0)
+  string(APPEND CLIENT_VERSION_STRING "rc${CLIENT_VERSION_RC}")
+endif()
+
+set(COPYRIGHT_HOLDERS "The %s developers")
+set(COPYRIGHT_HOLDERS_FINAL "The ${CLIENT_NAME} developers")
+set(CLIENT_BUGREPORT "https://github.com/bitcoin/bitcoin/issues")
+
+#=============================
+# Language setup
+#=============================
+if(CMAKE_SYSTEM_NAME STREQUAL "Darwin" AND NOT CMAKE_HOST_APPLE)
+  # We do not use the install_name_tool when cross-compiling for macOS.
+  # So disable this tool check in further enable_language() commands.
+  set(CMAKE_PLATFORM_HAS_INSTALLNAME FALSE)
+endif()
+enable_language(CXX)
+set(CMAKE_CXX_STANDARD 20)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+
+list(APPEND CMAKE_MODULE_PATH ${PROJECT_SOURCE_DIR}/cmake/module)
+include(ProcessConfigurations)
+
+# Flatten static lib dependencies.
+# Without this, if libfoo.a depends on libbar.a, libfoo's objects can't begin
+# to be compiled until libbar.a has been created.
+if (NOT DEFINED CMAKE_OPTIMIZE_DEPENDENCIES)
+  set(CMAKE_OPTIMIZE_DEPENDENCIES TRUE)
+endif()
+
+#=============================
+# Configurable options
+#=============================
+include(CMakeDependentOption)
+# When adding a new option, end the <help_text> with a full stop for consistency.
+option(BUILD_BITCOIN_BIN "Build bitcoin executable." ON)
+option(BUILD_DAEMON "Build bitcoind executable." ON)
+option(BUILD_GUI "Build bitcoin-qt executable." OFF)
+option(BUILD_CLI "Build bitcoin-cli executable." ON)
+
+option(BUILD_TESTS "Build test_bitcoin and other unit test executables." ON)
+option(BUILD_TX "Build bitcoin-tx executable." ${BUILD_TESTS})
+option(BUILD_UTIL "Build bitcoin-util executable." ${BUILD_TESTS})
+
+option(BUILD_UTIL_CHAINSTATE "Build experimental bitcoin-chainstate executable." OFF)
+option(BUILD_KERNEL_LIB "Build experimental bitcoinkernel library." ${BUILD_UTIL_CHAINSTATE})
+cmake_dependent_option(BUILD_KERNEL_TEST "Build tests for the experimental bitcoinkernel library." ON "BUILD_KERNEL_LIB" OFF)
+
+option(ENABLE_WALLET "Enable wallet." ON)
+if(ENABLE_WALLET)
+  if(VCPKG_TARGET_TRIPLET)
+    # Use of the `unofficial::` namespace is a vcpkg package manager convention.
+    find_package(unofficial-sqlite3 CONFIG REQUIRED)
+  else()
+    find_package(SQLite3 3.7.17 REQUIRED)
+  endif()
+endif()
+cmake_dependent_option(BUILD_WALLET_TOOL "Build bitcoin-wallet tool." ${BUILD_TESTS} "ENABLE_WALLET" OFF)
+
+option(REDUCE_EXPORTS "Attempt to reduce exported symbols in the resulting executables." OFF)
+option(WERROR "Treat compiler warnings as errors." OFF)
+option(WITH_CCACHE "Attempt to use ccache for compiling." ON)
+
+option(WITH_ZMQ "Enable ZMQ notifications." OFF)
+if(WITH_ZMQ)
+  find_package(ZeroMQ 4.0.0 MODULE REQUIRED)
+endif()
+
+option(WITH_USDT "Enable tracepoints for Userspace, Statically Defined Tracing." OFF)
+if(WITH_USDT)
+  find_package(USDT MODULE REQUIRED)
+endif()
+
+option(ENABLE_EXTERNAL_SIGNER "Enable external signer support." ON)
+
+cmake_dependent_option(WITH_QRENCODE "Enable QR code support." ON "BUILD_GUI" OFF)
+if(WITH_QRENCODE)
+  find_package(QRencode MODULE REQUIRED)
+  set(USE_QRCODE TRUE)
+endif()
+
+cmake_dependent_option(WITH_DBUS "Enable DBus support." ON "NOT CMAKE_SYSTEM_NAME MATCHES \"(Windows|Darwin)\" AND BUILD_GUI" OFF)
+
+cmake_dependent_option(ENABLE_IPC "Build multiprocess bitcoin-node and bitcoin-gui executables in addition to monolithic bitcoind and bitcoin-qt executables." ON "NOT WIN32" OFF)
+cmake_dependent_option(WITH_EXTERNAL_LIBMULTIPROCESS "Build with external libmultiprocess library instead of with local git subtree when ENABLE_IPC is enabled. This is not normally recommended, but can be useful for developing libmultiprocess itself." OFF "ENABLE_IPC" OFF)
+if(ENABLE_IPC AND WITH_EXTERNAL_LIBMULTIPROCESS)
+  find_package(Libmultiprocess REQUIRED COMPONENTS Lib)
+  find_package(LibmultiprocessNative REQUIRED COMPONENTS Bin
+    NAMES Libmultiprocess
+  )
+endif()
+
+cmake_dependent_option(BUILD_GUI_TESTS "Build test_bitcoin-qt executable." ON "BUILD_GUI;BUILD_TESTS" OFF)
+if(BUILD_GUI)
+  set(qt_components Core Gui Widgets LinguistTools)
+  if(ENABLE_WALLET)
+    list(APPEND qt_components Network)
+  endif()
+  if(WITH_DBUS)
+    list(APPEND qt_components DBus)
+    set(USE_DBUS TRUE)
+  endif()
+  if(BUILD_GUI_TESTS)
+    list(APPEND qt_components Test)
+  endif()
+  find_package(Qt 6.2 MODULE REQUIRED
+    COMPONENTS ${qt_components}
+  )
+  unset(qt_components)
+endif()
+
+option(BUILD_BENCH "Build bench_bitcoin executable." OFF)
+option(BUILD_FUZZ_BINARY "Build fuzz binary." OFF)
+option(BUILD_FOR_FUZZING "Build for fuzzing. Enabling this will disable all other targets and override BUILD_FUZZ_BINARY." OFF)
+
+option(INSTALL_MAN "Install man pages." ON)
+
+set(APPEND_CPPFLAGS "" CACHE STRING "Preprocessor flags that are appended to the command line after all other flags added by the build system. This variable is intended for debugging and special builds.")
+set(APPEND_CFLAGS "" CACHE STRING "C compiler flags that are appended to the command line after all other flags added by the build system. This variable is intended for debugging and special builds.")
+set(APPEND_CXXFLAGS "" CACHE STRING "(Objective) C++ compiler flags that are appended to the command line after all other flags added by the build system. This variable is intended for debugging and special builds.")
+set(APPEND_LDFLAGS "" CACHE STRING "Linker flags that are appended to the command line after all other flags added by the build system. This variable is intended for debugging and special builds.")
+# Appending to this low-level rule variables is the only way to
+# guarantee that the flags appear at the end of the command line.
+string(APPEND CMAKE_CXX_COMPILE_OBJECT " ${APPEND_CPPFLAGS} ${APPEND_CXXFLAGS}")
+string(APPEND CMAKE_CXX_CREATE_SHARED_LIBRARY " ${APPEND_LDFLAGS}")
+string(APPEND CMAKE_CXX_LINK_EXECUTABLE " ${APPEND_LDFLAGS}")
+
+set(configure_warnings)
+
+include(CheckLinkerSupportsPIE)
+check_linker_supports_pie(configure_warnings)
+
+# The core_interface library aims to encapsulate common build flags.
+# It is a usage requirement for all targets except for secp256k1, which
+# gets its flags by other means.
+add_library(core_interface INTERFACE)
+add_library(core_interface_relwithdebinfo INTERFACE)
+add_library(core_interface_debug INTERFACE)
+target_link_libraries(core_interface INTERFACE
+  $<$<CONFIG:RelWithDebInfo>:core_interface_relwithdebinfo>
+  $<$<CONFIG:Debug>:core_interface_debug>
+)
+
+if(BUILD_FOR_FUZZING)
+  message(WARNING "BUILD_FOR_FUZZING=ON will disable all other targets and force BUILD_FUZZ_BINARY=ON.")
+  set(BUILD_BITCOIN_BIN OFF)
+  set(BUILD_DAEMON OFF)
+  set(BUILD_CLI OFF)
+  set(BUILD_TX OFF)
+  set(BUILD_UTIL OFF)
+  set(BUILD_UTIL_CHAINSTATE OFF)
+  set(BUILD_KERNEL_LIB OFF)
+  set(BUILD_KERNEL_TEST OFF)
+  set(BUILD_WALLET_TOOL OFF)
+  set(BUILD_GUI OFF)
+  set(ENABLE_EXTERNAL_SIGNER OFF)
+  set(WITH_ZMQ OFF)
+  set(BUILD_TESTS OFF)
+  set(BUILD_GUI_TESTS OFF)
+  set(BUILD_BENCH OFF)
+  set(ENABLE_IPC OFF)
+  set(BUILD_FUZZ_BINARY ON)
+
+  target_compile_definitions(core_interface INTERFACE
+    FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+  )
+endif()
+
+include(TryAppendCXXFlags)
+include(TryAppendLinkerFlag)
+
+# Redefine/adjust per-configuration flags.
+target_compile_definitions(core_interface_debug INTERFACE
+  DEBUG
+  DEBUG_LOCKORDER
+  DEBUG_LOCKCONTENTION
+  RPC_DOC_CHECK
+  ABORT_ON_FAILED_ASSUME
+)
+
+if(WIN32)
+  #[=[
+  This build system supports two ways to build binaries for Windows.
+
+  1. Building on Windows using MSVC.
+  Implementation notes:
+  - /DWIN32 and /D_WINDOWS definitions are included into the CMAKE_CXX_FLAGS_INIT
+    and CMAKE_CXX_FLAGS_INIT variables by default.
+  - A run-time library is selected using the CMAKE_MSVC_RUNTIME_LIBRARY variable.
+  - MSVC-specific options, for example, /Zc:__cplusplus, are additionally required.
+
+  2. Cross-compiling using MinGW.
+  Implementation notes:
+  - WIN32 and _WINDOWS definitions must be provided explicitly.
+  - A run-time library must be specified explicitly using _MT definition.
+  ]=]
+
+  target_compile_definitions(core_interface INTERFACE
+    _WIN32_WINNT=0x0A00
+    _WIN32_IE=0x0A00
+    WIN32_LEAN_AND_MEAN
+    NOMINMAX
+  )
+
+  if(MSVC)
+    if(VCPKG_TARGET_TRIPLET MATCHES "-static")
+      set(msvc_library_linkage "")
+    else()
+      set(msvc_library_linkage "DLL")
+    endif()
+    set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>${msvc_library_linkage}")
+    unset(msvc_library_linkage)
+
+    target_compile_definitions(core_interface INTERFACE
+      _UNICODE;UNICODE
+    )
+    target_compile_options(core_interface INTERFACE
+      /utf-8
+      /Zc:preprocessor
+      /Zc:__cplusplus
+      /sdl
+    )
+    target_link_options(core_interface INTERFACE
+      # We embed our own manifests.
+      /MANIFEST:NO
+    )
+    # Improve parallelism in MSBuild.
+    # See: https://devblogs.microsoft.com/cppblog/improved-parallelism-in-msbuild/.
+    list(APPEND CMAKE_VS_GLOBALS "UseMultiToolTask=true")
+  endif()
+
+  if(MINGW)
+    target_compile_definitions(core_interface INTERFACE
+      WIN32
+      _WINDOWS
+      _MT
+    )
+    # Avoid the use of aligned vector instructions when building for Windows.
+    # See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=54412.
+    try_append_cxx_flags("-Wa,-muse-unaligned-vector-move" TARGET core_interface SKIP_LINK)
+    try_append_linker_flag("-static" TARGET core_interface)
+    # We support Windows 10+, however it's not possible to set these values accordingly,
+    # due to a bug in mingw-w64. See https://sourceforge.net/p/mingw-w64/bugs/968/.
+    # As a best effort, target Windows 8.
+    try_append_linker_flag("-Wl,--major-subsystem-version,6" TARGET core_interface)
+    try_append_linker_flag("-Wl,--minor-subsystem-version,2" TARGET core_interface)
+  endif()
+
+  # Workaround producing large object files, which cannot be handled by the assembler.
+  # More likely to happen with no, or lower levels of optimisation.
+  # See discussion in https://github.com/bitcoin/bitcoin/issues/28109.
+  if(CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
+    try_append_cxx_flags("/bigobj" TARGET core_interface_debug SKIP_LINK)
+  else()
+    try_append_cxx_flags("-Wa,-mbig-obj" TARGET core_interface_debug SKIP_LINK)
+  endif()
+endif()
+
+# Use 64-bit off_t on 32-bit Linux.
+if (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SIZEOF_VOID_P EQUAL 4)
+  # Ensure 64-bit offsets are used for filesystem accesses for 32-bit compilation.
+  target_compile_definitions(core_interface INTERFACE
+    _FILE_OFFSET_BITS=64
+  )
+endif()
+
+if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
+  target_compile_definitions(core_interface INTERFACE OBJC_OLD_DISPATCH_PROTOTYPES=0)
+  # These flags are specific to ld64, and may cause issues with other linkers.
+  # For example: GNU ld will interpret -dead_strip as -de and then try and use
+  # "ad_strip" as the symbol for the entry point.
+  try_append_linker_flag("-Wl,-dead_strip" TARGET core_interface)
+  try_append_linker_flag("-Wl,-dead_strip_dylibs" TARGET core_interface)
+  if(CMAKE_HOST_APPLE)
+    try_append_linker_flag("-Wl,-headerpad_max_install_names" TARGET core_interface)
+  endif()
+endif()
+
+set(THREADS_PREFER_PTHREAD_FLAG ON)
+find_package(Threads REQUIRED)
+target_link_libraries(core_interface INTERFACE
+  Threads::Threads
+)
+
+# Define sanitize_interface with -fsanitize flags intended to apply to all
+# libraries and executables.
+add_library(sanitize_interface INTERFACE)
+target_link_libraries(core_interface INTERFACE sanitize_interface)
+if(SANITIZERS)
+  # Transform list of sanitizers into -fsanitize flags, replacing "fuzzer" with
+  # "fuzzer-no-link" in sanitize_interface flags, and moving "fuzzer" to
+  # fuzzer_interface flags. If -DSANITIZERS=fuzzer is specified, the fuzz test
+  # binary should be built with -fsanitize=fuzzer (so it can use libFuzzer's
+  # main function), but libraries should be built with -fsanitize=fuzzer-no-link
+  # (so they can be linked into other executables that have their own main
+  # functions).
+  string(REGEX REPLACE "(^|,)fuzzer($|,)" "\\1fuzzer-no-link\\2" sanitize_opts "${SANITIZERS}")
+  set(fuzz_flag "")
+  if(NOT sanitize_opts STREQUAL SANITIZERS)
+    set(fuzz_flag "-fsanitize=fuzzer")
+  endif()
+
+  # First check if the compiler accepts flags. If an incompatible pair like
+  # -fsanitize=address,thread is used here, this check will fail. This will also
+  # fail if a bad argument is passed, e.g. -fsanitize=undfeined
+  try_append_cxx_flags("-fsanitize=${sanitize_opts}" TARGET sanitize_interface
+    RESULT_VAR cxx_supports_sanitizers
+    SKIP_LINK
+  )
+  if(NOT cxx_supports_sanitizers)
+    message(FATAL_ERROR "Compiler did not accept requested flags.")
+  endif()
+
+  # Some compilers (e.g. GCC) require additional libraries like libasan,
+  # libtsan, libubsan, etc. Make sure linking still works with the sanitize
+  # flag. This is a separate check so we can give a better error message when
+  # the sanitize flags are supported by the compiler but the actual sanitizer
+  # libs are missing.
+  try_append_linker_flag("-fsanitize=${sanitize_opts}" VAR SANITIZER_LDFLAGS
+    SOURCE "
+      #include <cstdint>
+      #include <cstddef>
+      extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { return 0; }
+      int main() { return 0; }
+    "
+    RESULT_VAR linker_supports_sanitizers
+    NO_CACHE_IF_FAILED
+  )
+  if(NOT linker_supports_sanitizers)
+    message(FATAL_ERROR "Linker did not accept requested flags, you are missing required libraries.")
+  endif()
+endif()
+target_link_options(sanitize_interface INTERFACE ${SANITIZER_LDFLAGS})
+
+# Define fuzzer_interface with flags intended to apply to the fuzz test binary,
+# and perform a test compilation to determine correct value of
+# FUZZ_BINARY_LINKS_WITHOUT_MAIN_FUNCTION.
+if(BUILD_FUZZ_BINARY)
+  include(CheckSourceCompilesWithFlags)
+  check_cxx_source_compiles_with_flags("
+      #include <cstdint>
+      #include <cstddef>
+      extern \"C\" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { return 0; }
+      // No main() function.
+    " FUZZ_BINARY_LINKS_WITHOUT_MAIN_FUNCTION
+    LDFLAGS ${SANITIZER_LDFLAGS} ${fuzz_flag}
+    LINK_LIBRARIES ${FUZZ_LIBS}
+  )
+  add_library(fuzzer_interface INTERFACE)
+  target_link_options(fuzzer_interface INTERFACE ${fuzz_flag})
+  target_link_libraries(fuzzer_interface INTERFACE ${FUZZ_LIBS})
+endif()
+
+include(AddBoostIfNeeded)
+add_boost_if_needed()
+
+if(BUILD_DAEMON OR BUILD_GUI OR BUILD_CLI OR BUILD_TESTS OR BUILD_BENCH OR BUILD_FUZZ_BINARY)
+  find_package(Libevent 2.1.8 MODULE REQUIRED)
+endif()
+
+include(cmake/introspection.cmake)
+
+include(cmake/ccache.cmake)
+
+add_library(warn_interface INTERFACE)
+target_link_libraries(core_interface INTERFACE warn_interface)
+if(MSVC)
+  try_append_cxx_flags("/W3" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("/wd4018" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("/wd4146" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("/wd4244" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("/wd4267" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("/wd4715" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("/wd4805" TARGET warn_interface SKIP_LINK)
+  target_compile_definitions(warn_interface INTERFACE
+    _CRT_SECURE_NO_WARNINGS
+    _SILENCE_CXX17_CODECVT_HEADER_DEPRECATION_WARNING
+  )
+else()
+  try_append_cxx_flags("-Wall" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wextra" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wgnu" TARGET warn_interface SKIP_LINK)
+  # Some compilers will ignore -Wformat-security without -Wformat, so just combine the two here.
+  try_append_cxx_flags("-Wformat -Wformat-security" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wvla" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wshadow-field" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wthread-safety" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wthread-safety-pointer" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wloop-analysis" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wredundant-decls" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wunused-member-function" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wdate-time" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wconditional-uninitialized" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wduplicated-branches" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wduplicated-cond" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wlogical-op" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Woverloaded-virtual" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wsuggest-override" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wimplicit-fallthrough" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wunreachable-code" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wdocumentation" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wself-assign" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wbidi-chars=any" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wundef" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wleading-whitespace=spaces" TARGET warn_interface SKIP_LINK)
+  try_append_cxx_flags("-Wtrailing-whitespace=any" TARGET warn_interface SKIP_LINK)
+
+  # Some compilers (gcc) ignore unknown -Wno-* options, but warn about all
+  # unknown options if any other warning is produced. Test the -Wfoo case, and
+  # set the -Wno-foo case if it works.
+  try_append_cxx_flags("-Wunused-parameter" TARGET warn_interface SKIP_LINK
+    IF_CHECK_PASSED "-Wno-unused-parameter"
+  )
+endif()
+
+configure_file(cmake/script/Coverage.cmake Coverage.cmake USE_SOURCE_PERMISSIONS COPYONLY)
+configure_file(cmake/script/CoverageFuzz.cmake CoverageFuzz.cmake USE_SOURCE_PERMISSIONS COPYONLY)
+configure_file(cmake/script/CoverageInclude.cmake.in CoverageInclude.cmake USE_SOURCE_PERMISSIONS @ONLY)
+configure_file(cmake/script/cov_tool_wrapper.sh.in cov_tool_wrapper.sh.in USE_SOURCE_PERMISSIONS COPYONLY)
+configure_file(contrib/filter-lcov.py filter-lcov.py USE_SOURCE_PERMISSIONS COPYONLY)
+
+# Don't allow extended (non-ASCII) symbols in identifiers. This is easier for code review.
+try_append_cxx_flags("-fno-extended-identifiers" TARGET core_interface SKIP_LINK)
+
+# Avoiding the `-ffile-prefix-map` compiler option because it implies
+# `-fcoverage-prefix-map` on Clang or `-fprofile-prefix-map` on GCC,
+# which can cause issues with coverage builds, particularly when using
+# Clang in the OSS-Fuzz environment due to its use of other options
+# and a third party script, or with GCC.
+try_append_cxx_flags("-fdebug-prefix-map=A=B" TARGET core_interface SKIP_LINK
+  IF_CHECK_PASSED "-fdebug-prefix-map=${PROJECT_SOURCE_DIR}/src=."
+)
+try_append_cxx_flags("-fmacro-prefix-map=A=B" TARGET core_interface SKIP_LINK
+  IF_CHECK_PASSED "-fmacro-prefix-map=${PROJECT_SOURCE_DIR}/src=."
+)
+
+# GCC versions 13.2 (and earlier) are subject to a class of bugs, see
+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90348 and the meta bug
+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111843. To work around that, set
+# -fstack-reuse=none for all gcc builds. (Only gcc understands this flag).
+try_append_cxx_flags("-fstack-reuse=none" TARGET core_interface)
+
+if(MSVC)
+  try_append_linker_flag("/DYNAMICBASE" TARGET core_interface)
+  try_append_linker_flag("/HIGHENTROPYVA" TARGET core_interface)
+  try_append_linker_flag("/NXCOMPAT" TARGET core_interface)
+else()
+
+  # _FORTIFY_SOURCE requires that there is some level of optimization,
+  # otherwise it does nothing and just creates a compiler warning.
+  try_append_cxx_flags("-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3"
+    RESULT_VAR cxx_supports_fortify_source
+    SOURCE "int main() {
+            # if !defined __OPTIMIZE__ || __OPTIMIZE__ <= 0
+              #error
+            #endif
+            }"
+  )
+  if(cxx_supports_fortify_source)
+    target_compile_options(core_interface INTERFACE
+      -U_FORTIFY_SOURCE
+      -D_FORTIFY_SOURCE=3
+    )
+  endif()
+  unset(cxx_supports_fortify_source)
+
+  try_append_cxx_flags("-Wstack-protector" TARGET core_interface SKIP_LINK)
+  try_append_cxx_flags("-fstack-protector-all" TARGET core_interface)
+  try_append_cxx_flags("-fcf-protection=full" TARGET core_interface)
+
+  if(MINGW)
+    # stack-clash-protection is a no-op for Windows.
+    # See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90458 for more details.
+  else()
+    try_append_cxx_flags("-fstack-clash-protection" TARGET core_interface)
+  endif()
+
+  if(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" OR CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64")
+    if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
+      try_append_cxx_flags("-mbranch-protection=bti" TARGET core_interface SKIP_LINK)
+    else()
+      try_append_cxx_flags("-mbranch-protection=standard" TARGET core_interface SKIP_LINK)
+    endif()
+  endif()
+
+  try_append_linker_flag("-Wl,--enable-reloc-section" TARGET core_interface)
+  try_append_linker_flag("-Wl,--dynamicbase" TARGET core_interface)
+  try_append_linker_flag("-Wl,--nxcompat" TARGET core_interface)
+  try_append_linker_flag("-Wl,--high-entropy-va" TARGET core_interface)
+  try_append_linker_flag("-Wl,-z,relro" TARGET core_interface)
+  try_append_linker_flag("-Wl,-z,now" TARGET core_interface)
+  # TODO: This can be dropped once Bitcoin Core no longer supports
+  #       NetBSD 10.0 or if upstream fix is backported.
+  # NetBSD's dynamic linker ld.elf_so < 11.0 supports exactly 2
+  # `PT_LOAD` segments and binaries linked with `-z separate-code`
+  # have 4 `PT_LOAD` segments.
+  # Relevant discussions:
+  # - https://github.com/bitcoin/bitcoin/pull/28724#issuecomment-2589347934
+  # - https://mail-index.netbsd.org/tech-userlevel/2023/01/05/msg013666.html
+  if(CMAKE_SYSTEM_NAME STREQUAL "NetBSD" AND CMAKE_SYSTEM_VERSION VERSION_LESS 11.0)
+    try_append_linker_flag("-Wl,-z,noseparate-code" TARGET core_interface)
+  else()
+    try_append_linker_flag("-Wl,-z,separate-code" TARGET core_interface)
+  endif()
+  if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
+    try_append_linker_flag("-Wl,-fixup_chains" TARGET core_interface)
+  endif()
+endif()
+
+if(REDUCE_EXPORTS)
+  set(CMAKE_CXX_VISIBILITY_PRESET hidden)
+  try_append_linker_flag("-Wl,--exclude-libs,ALL" TARGET core_interface)
+  try_append_linker_flag("-Wl,-no_exported_symbols" VAR CMAKE_EXE_LINKER_FLAGS)
+endif()
+
+if(WERROR)
+  if(MSVC)
+    set(werror_flag "/WX")
+  else()
+    set(werror_flag "-Werror")
+  endif()
+  try_append_cxx_flags(${werror_flag} TARGET core_interface SKIP_LINK RESULT_VAR compiler_supports_werror)
+  if(NOT compiler_supports_werror)
+    message(FATAL_ERROR "WERROR set but ${werror_flag} is not usable.")
+  endif()
+  unset(werror_flag)
+endif()
+
+# Prefer Unix-style package components over frameworks on macOS.
+# This improves compatibility with Python version managers.
+set(Python3_FIND_FRAMEWORK LAST CACHE STRING "")
+# Search for generic names before more specialized ones. This
+# improves compatibility with Python version managers that use shims.
+set(Python3_FIND_UNVERSIONED_NAMES FIRST CACHE STRING "")
+mark_as_advanced(Python3_FIND_FRAMEWORK Python3_FIND_UNVERSIONED_NAMES)
+find_package(Python3 3.10 COMPONENTS Interpreter)
+if(NOT TARGET Python3::Interpreter)
+  list(APPEND configure_warnings
+    "Minimum required Python not found."
+  )
+endif()
+
+target_compile_definitions(core_interface INTERFACE ${DEPENDS_COMPILE_DEFINITIONS})
+target_compile_definitions(core_interface_relwithdebinfo INTERFACE ${DEPENDS_COMPILE_DEFINITIONS_RELWITHDEBINFO})
+target_compile_definitions(core_interface_debug INTERFACE ${DEPENDS_COMPILE_DEFINITIONS_DEBUG})
+
+# If the {CXX,LD}FLAGS environment variables are defined during building depends
+# and configuring this build system, their content might be duplicated.
+if(DEFINED ENV{CXXFLAGS})
+  deduplicate_flags(CMAKE_CXX_FLAGS)
+endif()
+if(DEFINED ENV{LDFLAGS})
+  deduplicate_flags(CMAKE_EXE_LINKER_FLAGS)
+endif()
+
+if(BUILD_TESTS)
+  enable_testing()
+endif()
+
+if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.29)
+  # have "make test" depend on "make all"
+  set(CMAKE_SKIP_TEST_ALL_DEPENDENCY FALSE)
+endif()
+
+add_subdirectory(test)
+add_subdirectory(doc)
+
+add_subdirectory(src)
+
+include(Maintenance)
+setup_split_debug_script()
+add_windows_deploy_target()
+add_macos_deploy_target()
+
+message("\n")
+message("Configure summary")
+message("=================")
+message("Executables:")
+message("  bitcoin ............................. ${BUILD_BITCOIN_BIN}")
+message("  bitcoind ............................ ${BUILD_DAEMON}")
+if(BUILD_DAEMON AND ENABLE_IPC)
+  set(bitcoin_daemon_status ON)
+else()
+  set(bitcoin_daemon_status OFF)
+endif()
+message("  bitcoin-node (multiprocess) ......... ${bitcoin_daemon_status}")
+message("  bitcoin-qt (GUI) .................... ${BUILD_GUI}")
+if(BUILD_GUI AND ENABLE_IPC)
+  set(bitcoin_gui_status ON)
+else()
+  set(bitcoin_gui_status OFF)
+endif()
+message("  bitcoin-gui (GUI, multiprocess) ..... ${bitcoin_gui_status}")
+message("  bitcoin-cli ......................... ${BUILD_CLI}")
+message("  bitcoin-tx .......................... ${BUILD_TX}")
+message("  bitcoin-util ........................ ${BUILD_UTIL}")
+message("  bitcoin-wallet ...................... ${BUILD_WALLET_TOOL}")
+message("  bitcoin-chainstate (experimental) ... ${BUILD_UTIL_CHAINSTATE}")
+message("  libbitcoinkernel (experimental) ..... ${BUILD_KERNEL_LIB}")
+message("  kernel-test (experimental) .......... ${BUILD_KERNEL_TEST}")
+message("Optional features:")
+message("  wallet support ...................... ${ENABLE_WALLET}")
+message("  external signer ..................... ${ENABLE_EXTERNAL_SIGNER}")
+message("  ZeroMQ .............................. ${WITH_ZMQ}")
+if(ENABLE_IPC)
+  if (WITH_EXTERNAL_LIBMULTIPROCESS)
+    set(ipc_status "ON (with external libmultiprocess)")
+  else()
+    set(ipc_status ON)
+  endif()
+else()
+  set(ipc_status OFF)
+endif()
+message("  IPC ................................. ${ipc_status}")
+message("  USDT tracing ........................ ${WITH_USDT}")
+message("  QR code (GUI) ....................... ${WITH_QRENCODE}")
+message("  DBus (GUI) .......................... ${WITH_DBUS}")
+message("Tests:")
+message("  test_bitcoin ........................ ${BUILD_TESTS}")
+message("  test_bitcoin-qt ..................... ${BUILD_GUI_TESTS}")
+message("  bench_bitcoin ....................... ${BUILD_BENCH}")
+message("  fuzz binary ......................... ${BUILD_FUZZ_BINARY}")
+message("")
+if(CMAKE_CROSSCOMPILING)
+  set(cross_status "TRUE, for ${CMAKE_SYSTEM_NAME}, ${CMAKE_SYSTEM_PROCESSOR}")
+else()
+  set(cross_status "FALSE")
+endif()
+message("Cross compiling ....................... ${cross_status}")
+message("C++ compiler .......................... ${CMAKE_CXX_COMPILER_ID} ${CMAKE_CXX_COMPILER_VERSION}, ${CMAKE_CXX_COMPILER}")
+include(FlagsSummary)
+flags_summary()
+message("Treat compiler warnings as errors ..... ${WERROR}")
+message("Use ccache for compiling .............. ${WITH_CCACHE}")
+message("\n")
+if(configure_warnings)
+    message("  ******\n")
+    foreach(warning IN LISTS configure_warnings)
+      message(WARNING "${warning}")
+    endforeach()
+    message("  ******\n")
+endif()
+
+# We want all build properties to be encapsulated properly.
+include(WarnAboutGlobalProperties)
diff --git a/CMakePresets.json b/CMakePresets.json
new file mode 100644
index 00000000..ae9d06da
--- /dev/null
+++ b/CMakePresets.json
@@ -0,0 +1,90 @@
+{
+  "version": 3,
+  "configurePresets": [
+    {
+      "name": "vs2022",
+      "displayName": "Build using 'Visual Studio 17 2022' generator and 'x64-windows' triplet",
+      "condition": {
+        "type": "equals",
+        "lhs": "${hostSystemName}",
+        "rhs": "Windows"
+      },
+      "generator": "Visual Studio 17 2022",
+      "architecture": "x64",
+      "toolchainFile": "$env{VCPKG_ROOT}\\scripts\\buildsystems\\vcpkg.cmake",
+      "cacheVariables": {
+        "VCPKG_TARGET_TRIPLET": "x64-windows",
+        "BUILD_GUI": "ON",
+        "WITH_ZMQ": "ON"
+      }
+    },
+    {
+      "name": "vs2022-static",
+      "displayName": "Build using 'Visual Studio 17 2022' generator and 'x64-windows-static' triplet",
+      "condition": {
+        "type": "equals",
+        "lhs": "${hostSystemName}",
+        "rhs": "Windows"
+      },
+      "generator": "Visual Studio 17 2022",
+      "architecture": "x64",
+      "toolchainFile": "$env{VCPKG_ROOT}\\scripts\\buildsystems\\vcpkg.cmake",
+      "cacheVariables": {
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static",
+        "BUILD_GUI": "ON",
+        "WITH_ZMQ": "ON"
+      }
+    },
+    {
+      "name": "libfuzzer",
+      "displayName": "Build for fuzzing with libfuzzer, and sanitizers enabled",
+      "binaryDir": "${sourceDir}/build_fuzz",
+      "cacheVariables": {
+        "BUILD_FOR_FUZZING": "ON",
+        "CMAKE_C_COMPILER": "clang",
+        "CMAKE_C_FLAGS": "-ftrivial-auto-var-init=pattern",
+        "CMAKE_CXX_COMPILER": "clang++",
+        "CMAKE_CXX_FLAGS": "-ftrivial-auto-var-init=pattern",
+        "SANITIZERS": "undefined,address,fuzzer"
+      }
+    },
+    {
+      "name": "libfuzzer-nosan",
+      "displayName": "Build for fuzzing with libfuzzer, and sanitizers disabled",
+      "binaryDir": "${sourceDir}/build_fuzz_nosan",
+      "cacheVariables": {
+        "BUILD_FOR_FUZZING": "ON",
+        "CMAKE_C_COMPILER": "clang",
+        "CMAKE_CXX_COMPILER": "clang++",
+        "SANITIZERS": "fuzzer"
+      }
+    },
+    {
+      "name": "dev-mode",
+      "displayName": "Developer mode, with all features/dependencies enabled",
+      "binaryDir": "${sourceDir}/build_dev_mode",
+      "errors": {"dev": true},
+      "cacheVariables": {
+        "BUILD_BENCH": "ON",
+        "BUILD_CLI": "ON",
+        "BUILD_DAEMON": "ON",
+        "BUILD_FUZZ_BINARY": "ON",
+        "BUILD_GUI": "ON",
+        "BUILD_GUI_TESTS": "ON",
+        "BUILD_KERNEL_LIB": "ON",
+        "BUILD_SHARED_LIBS": "ON",
+        "BUILD_TESTS": "ON",
+        "BUILD_TX": "ON",
+        "BUILD_UTIL": "ON",
+        "BUILD_UTIL_CHAINSTATE": "ON",
+        "BUILD_WALLET_TOOL": "ON",
+        "ENABLE_EXTERNAL_SIGNER": "ON",
+        "ENABLE_WALLET": "ON",
+        "ENABLE_IPC": "ON",
+        "WITH_QRENCODE": "ON",
+        "WITH_USDT": "ON",
+        "WITH_ZMQ": "ON"
+      }
+    }
+  ]
+}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 00000000..7f42f0be
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,444 @@
+Contributing to Bitcoin Core
+============================
+
+The Bitcoin Core project operates an open contributor model where anyone is
+welcome to contribute towards development in the form of peer review, testing
+and patches. This document explains the practical process and guidelines for
+contributing.
+
+First, in terms of structure, there is no particular concept of "Bitcoin Core
+developers" in the sense of privileged people. Open source often naturally
+revolves around a meritocracy where contributors earn trust from the developer
+community over time. Nevertheless, some hierarchy is necessary for practical
+purposes. As such, there are repository maintainers who are responsible for
+merging pull requests, the [release cycle](/doc/release-process.md), and
+moderation.
+
+Getting Started
+---------------
+
+New contributors are very welcome and needed.
+
+Reviewing and testing is highly valued and the most effective way you can contribute
+as a new contributor. It also will teach you much more about the code and
+process than opening pull requests. Please refer to the [peer review](#peer-review)
+section below.
+
+Before you start contributing, familiarize yourself with the Bitcoin Core build
+system and tests. Refer to the documentation in the repository on how to build
+Bitcoin Core and how to run the unit tests, functional tests, and fuzz tests.
+
+There are many open issues of varying difficulty waiting to be fixed.
+If you're looking for somewhere to start contributing, check out the
+[good first issue](https://github.com/bitcoin/bitcoin/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22)
+list or changes that are
+[up for grabs](https://github.com/bitcoin/bitcoin/issues?utf8=%E2%9C%93&q=label%3A%22Up+for+grabs%22).
+Some of them might no longer be applicable. So if you are interested, but
+unsure, you might want to leave a comment on the issue first.
+
+You may also participate in the [Bitcoin Core PR Review Club](https://bitcoincore.reviews/).
+
+### Good First Issue Label
+
+The purpose of the `good first issue` label is to highlight which issues are
+suitable for a new contributor without a deep understanding of the codebase.
+
+However, good first issues can be solved by anyone. If they remain unsolved
+for a longer time, a frequent contributor might address them.
+
+You do not need to request permission to start working on an issue. However,
+you are encouraged to leave a comment if you are planning to work on it. This
+will help other contributors monitor which issues are actively being addressed
+and is also an effective way to request assistance if and when you need it.
+
+Communication Channels
+----------------------
+
+Most communication about Bitcoin Core development happens on IRC, in the
+`#bitcoin-core-dev` channel on Libera Chat. The easiest way to participate on IRC is
+with the web client, [web.libera.chat](https://web.libera.chat/#bitcoin-core-dev). Chat
+history logs can be found
+on [https://www.erisian.com.au/bitcoin-core-dev/](https://www.erisian.com.au/bitcoin-core-dev/)
+and [https://gnusha.org/bitcoin-core-dev/](https://gnusha.org/bitcoin-core-dev/).
+
+Discussion about codebase improvements happens in GitHub issues and pull
+requests.
+
+The developer
+[mailing list](https://groups.google.com/g/bitcoindev)
+should be used to discuss complicated or controversial consensus or P2P protocol changes before working on
+a patch set.
+Archives can be found on [https://gnusha.org/pi/bitcoindev/](https://gnusha.org/pi/bitcoindev/).
+
+
+Contributor Workflow
+--------------------
+
+The codebase is maintained using the "contributor workflow" where everyone
+without exception contributes patch proposals using "pull requests" (PRs). This
+facilitates social contribution, easy testing and peer review.
+
+To contribute a patch, the workflow is as follows:
+
+  1. Fork repository ([only for the first time](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/fork-a-repo))
+  1. Create topic branch
+  1. Commit patches
+
+For GUI-related issues or pull requests, the https://github.com/bitcoin-core/gui repository should be used.
+For all other issues and pull requests, the https://github.com/bitcoin/bitcoin node repository should be used.
+
+The master branch for all monotree repositories is identical.
+
+As a rule of thumb, everything that only modifies `src/qt` is a GUI-only pull
+request. However:
+
+* For global refactoring or other transversal changes the node repository
+  should be used.
+* For GUI-related build system changes, the node repository should be used
+  because the change needs review by the build systems reviewers.
+* Changes in `src/interfaces` need to go to the node repository because they
+  might affect other components like the wallet.
+
+For large GUI changes that include build system and interface changes, it is
+recommended to first open a pull request against the GUI repository. When there
+is agreement to proceed with the changes, a pull request with the build system
+and interfaces changes can be submitted to the node repository.
+
+The project coding conventions in the [developer notes](doc/developer-notes.md)
+must be followed.
+
+### Committing Patches
+
+In general, [commits should be atomic](https://en.wikipedia.org/wiki/Atomic_commit#Atomic_commit_convention)
+and diffs should be easy to read. For this reason, do not mix any formatting
+fixes or code moves with actual code changes.
+
+Make sure each individual commit is hygienic: that it builds successfully on its
+own without warnings, errors, regressions, or test failures.
+This means tests must be updated in the same commit that changes the behavior.
+
+Commit messages should be verbose by default consisting of a short subject line
+(50 chars max), a blank line and detailed explanatory text as separate
+paragraph(s), unless the title alone is self-explanatory (like "Correct typo
+in init.cpp") in which case a single title line is sufficient. Commit messages should be
+helpful to people reading your code in the future, so explain the reasoning for
+your decisions. Further explanation [here](https://cbea.ms/git-commit/).
+
+If a particular commit references another issue, please add the reference. For
+example: `refs #1234` or `fixes #4321`. Using the `fixes` or `closes` keywords
+will cause the corresponding issue to be closed when the pull request is merged.
+
+Commit messages should never contain any `@` mentions (usernames prefixed with "@").
+
+Please refer to the [Git manual](https://git-scm.com/doc) for more information
+about Git.
+
+  - Push changes to your fork
+  - Create pull request
+
+### Creating the Pull Request
+
+The title of the pull request should be prefixed by the component or area that
+the pull request affects. Valid areas as:
+
+  - `consensus` for changes to consensus critical code
+  - `doc` for changes to the documentation
+  - `qt` or `gui` for changes to bitcoin-qt
+  - `log` for changes to log messages
+  - `mining` for changes to the mining code
+  - `net` or `p2p` for changes to the peer-to-peer network code
+  - `refactor` for structural changes that do not change behavior
+  - `rpc`, `rest` or `zmq` for changes to the RPC, REST or ZMQ APIs
+  - `contrib` or `cli` for changes to the scripts and tools
+  - `test`, `qa` or `ci` for changes to the unit tests, QA tests or CI code
+  - `util` or `lib` for changes to the utils or libraries
+  - `wallet` for changes to the wallet code
+  - `build` for changes to CMake
+  - `guix` for changes to the GUIX reproducible builds
+
+Examples:
+
+    consensus: Add new opcode for BIP-XXXX OP_CHECKAWESOMESIG
+    net: Automatically create onion service, listen on Tor
+    qt: Add feed bump button
+    log: Fix typo in log message
+
+The body of the pull request should contain sufficient description of *what* the
+patch does, and even more importantly, *why*, with justification and reasoning.
+You should include references to any discussions (for example, other issues or
+mailing list discussions).
+
+The description for a new pull request should not contain any `@` mentions. The
+PR description will be included in the commit message when the PR is merged and
+any users mentioned in the description will be annoyingly notified each time a
+fork of Bitcoin Core copies the merge. Instead, make any username mentions in a
+subsequent comment to the PR.
+
+### Translation changes
+
+Note that translations should not be submitted as pull requests. Please see
+[Translation Process](https://github.com/bitcoin/bitcoin/blob/master/doc/translation_process.md)
+for more information on helping with translations.
+
+### Work in Progress Changes and Requests for Comments
+
+If a pull request is not to be considered for merging (yet), please
+prefix the title with [WIP] or use [Tasks Lists](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#task-lists)
+in the body of the pull request to indicate tasks are pending.
+
+### Address Feedback
+
+At this stage, one should expect comments and review from other contributors. You
+can add more commits to your pull request by committing them locally and pushing
+to your fork.
+
+You are expected to reply to any review comments before your pull request is
+merged. You may update the code or reject the feedback if you do not agree with
+it, but you should express so in a reply. If there is outstanding feedback and
+you are not actively working on it, your pull request may be closed.
+
+Please refer to the [peer review](#peer-review) section below for more details.
+
+### Squashing Commits
+
+If your pull request contains fixup commits (commits that change the same line of code repeatedly) or too fine-grained
+commits, you may be asked to [squash](https://git-scm.com/docs/git-rebase#_interactive_mode) your commits
+before it will be reviewed. The basic squashing workflow is shown below.
+
+    git checkout your_branch_name
+    git rebase -i HEAD~n
+    # n is normally the number of commits in the pull request.
+    # Set commits (except the one in the first line) from 'pick' to 'squash', save and quit.
+    # On the next screen, edit/refine commit messages.
+    # Save and quit.
+    git push -f # (force push to GitHub)
+
+Please update the resulting commit message, if needed. It should read as a
+coherent message. In most cases, this means not just listing the interim
+commits.
+
+If your change contains a merge commit, the above workflow may not work and you
+will need to remove the merge commit first. See the next section for details on
+how to rebase.
+
+Please refrain from creating several pull requests for the same change.
+Use the pull request that is already open (or was created earlier) to amend
+changes. This preserves the discussion and review that happened earlier for
+the respective change set.
+
+The length of time required for peer review is unpredictable and will vary from
+pull request to pull request.
+
+### Rebasing Changes
+
+When a pull request conflicts with the target branch, you may be asked to rebase it on top of the current target branch.
+
+    git fetch https://github.com/bitcoin/bitcoin  # Fetch the latest upstream commit
+    git rebase FETCH_HEAD  # Rebuild commits on top of the new base
+
+This project aims to have a clean git history, where code changes are only made in non-merge commits. This simplifies
+auditability because merge commits can be assumed to not contain arbitrary code changes. Merge commits should be signed,
+and the resulting git tree hash must be deterministic and reproducible. The script in
+[/contrib/verify-commits](/contrib/verify-commits) checks that.
+
+After a rebase, reviewers are encouraged to sign off on the force push. This should be relatively straightforward with
+the `git range-diff` tool explained in the [productivity
+notes](/doc/productivity.md#diff-the-diffs-with-git-range-diff). To avoid needless review churn, maintainers will
+generally merge pull requests that received the most review attention first.
+
+Pull Request Philosophy
+-----------------------
+
+Patchsets should always be focused. For example, a pull request could add a
+feature, fix a bug, or refactor code; but not a mixture. Please also avoid super
+pull requests which attempt to do too much, are overly large, or overly complex
+as this makes review difficult.
+
+
+### Features
+
+When adding a new feature, thought must be given to the long term technical debt
+and maintenance that feature may require after inclusion. Before proposing a new
+feature that will require maintenance, please consider if you are willing to
+maintain it (including bug fixing). If features get orphaned with no maintainer
+in the future, they may be removed by the Repository Maintainer.
+
+
+### Refactoring
+
+Refactoring is a necessary part of any software project's evolution. The
+following guidelines cover refactoring pull requests for the project.
+
+There are three categories of refactoring: code-only moves, code style fixes, and
+code refactoring. In general, refactoring pull requests should not mix these
+three kinds of activities in order to make refactoring pull requests easy to
+review and uncontroversial. In all cases, refactoring PRs must not change the
+behaviour of code within the pull request (bugs must be preserved as is).
+
+Project maintainers aim for a quick turnaround on refactoring pull requests, so
+where possible keep them short, uncomplex and easy to verify.
+
+Pull requests that refactor the code should not be made by new contributors. It
+requires a certain level of experience to know where the code belongs to and to
+understand the full ramification (including rebase effort of open pull requests).
+
+Trivial pull requests or pull requests that refactor the code with no clear
+benefits may be immediately closed by the maintainers to reduce unnecessary
+workload on reviewing.
+
+
+"Decision Making" Process
+-------------------------
+
+The following applies to code changes to the Bitcoin Core project (and related
+projects such as libsecp256k1), and is not to be confused with overall Bitcoin
+Network Protocol consensus changes.
+
+Whether a pull request is merged into Bitcoin Core rests with the project merge
+maintainers.
+
+Maintainers will take into consideration if a patch is in line with the general
+principles of the project; meets the minimum standards for inclusion; and will
+judge the general consensus of contributors.
+
+In general, all pull requests must:
+
+  - Have a clear use case, fix a demonstrable bug or serve the greater good of
+    the project (for example refactoring for modularisation);
+  - Be well peer-reviewed;
+  - Have unit tests, functional tests, and fuzz tests, where appropriate;
+  - Follow code style guidelines ([C++](doc/developer-notes.md), [functional tests](test/functional/README.md));
+  - Not break the existing test suite;
+  - Where bugs are fixed, where possible, there should be unit tests
+    demonstrating the bug and also proving the fix. This helps prevent regression.
+  - Change relevant comments and documentation when behaviour of code changes.
+
+Patches that change Bitcoin consensus rules are considerably more involved than
+normal because they affect the entire ecosystem and so must be preceded by
+extensive mailing list discussions and have a numbered BIP. While each case will
+be different, one should be prepared to expend more time and effort than for
+other kinds of patches because of increased peer review and consensus building
+requirements.
+
+
+### Peer Review
+
+Anyone may participate in peer review which is expressed by comments in the pull
+request. Typically reviewers will review the code for obvious errors, as well as
+test out the patch set and opine on the technical merits of the patch. Project
+maintainers take into account the peer review when determining if there is
+consensus to merge a pull request (remember that discussions may have been
+spread out over GitHub, mailing list and IRC discussions).
+
+Code review is a burdensome but important part of the development process, and
+as such, certain types of pull requests are rejected. In general, if the
+**improvements** do not warrant the **review effort** required, the PR has a
+high chance of being rejected. It is up to the PR author to convince the
+reviewers that the changes warrant the review effort, and if reviewers are
+"Concept NACK'ing" the PR, the author may need to present arguments and/or do
+research backing their suggested changes.
+
+#### Conceptual Review
+
+A review can be a conceptual review, where the reviewer leaves a comment
+ * `Concept (N)ACK`, meaning "I do (not) agree with the general goal of this pull
+   request",
+ * `Approach (N)ACK`, meaning `Concept ACK`, but "I do (not) agree with the
+   approach of this change".
+
+A `NACK` needs to include a rationale why the change is not worthwhile.
+NACKs without accompanying reasoning may be disregarded.
+
+#### Code Review
+
+After conceptual agreement on the change, code review can be provided. A review
+begins with `ACK BRANCH_COMMIT`, where `BRANCH_COMMIT` is the top of the PR
+branch, followed by a description of how the reviewer did the review. The
+following language is used within pull request comments:
+
+  - "I have tested the code", involving change-specific manual testing in
+    addition to running the unit, functional, or fuzz tests, and in case it is
+    not obvious how the manual testing was done, it should be described;
+  - "I have not tested the code, but I have reviewed it and it looks
+    OK, I agree it can be merged";
+  - A "nit" refers to a trivial, often non-blocking issue.
+
+Project maintainers reserve the right to weigh the opinions of peer reviewers
+using common sense judgement and may also weigh based on merit. Reviewers that
+have demonstrated a deeper commitment and understanding of the project over time
+or who have clear domain expertise may naturally have more weight, as one would
+expect in all walks of life.
+
+Where a patch set affects consensus-critical code, the bar will be much
+higher in terms of discussion and peer review requirements, keeping in mind that
+mistakes could be very costly to the wider community. This includes refactoring
+of consensus-critical code.
+
+Where a patch set proposes to change the Bitcoin consensus, it must have been
+discussed extensively on the mailing list and IRC, be accompanied by a widely
+discussed BIP and have a generally widely perceived technical consensus of being
+a worthwhile change based on the judgement of the maintainers.
+
+### Finding Reviewers
+
+As most reviewers are themselves developers with their own projects, the review
+process can be quite lengthy, and some amount of patience is required. If you find
+that you've been waiting for a pull request to be given attention for several
+months, there may be a number of reasons for this, some of which you can do something
+about:
+
+  - It may be because of a feature freeze due to an upcoming release. During this time,
+    only bug fixes are taken into consideration. If your pull request is a new feature,
+    it will not be prioritized until after the release. Wait for the release.
+  - It may be because the changes you are suggesting do not appeal to people. Rather than
+    nits and critique, which require effort and means they care enough to spend time on your
+    contribution, thundering silence is a good sign of widespread (mild) dislike of a given change
+    (because people don't assume *others* won't actually like the proposal). Don't take
+    that personally, though! Instead, take another critical look at what you are suggesting
+    and see if it: changes too much, is too broad, doesn't adhere to the
+    [developer notes](doc/developer-notes.md), is dangerous or insecure, is messily written, etc.
+    Identify and address any of the issues you find. Then ask e.g. on IRC if someone could give
+    their opinion on the concept itself.
+  - It may be because your code is too complex for all but a few people, and those people
+    may not have realized your pull request even exists. A great way to find people who
+    are qualified and care about the code you are touching is the
+    [Git Blame feature](https://docs.github.com/en/repositories/working-with-files/using-files/viewing-and-understanding-files). Simply
+    look up who last modified the code you are changing and see if you can find
+    them and give them a nudge. Don't be incessant about the nudging, though.
+  - Finally, if all else fails, ask on IRC or elsewhere for someone to give your pull request
+    a look. If you think you've been waiting for an unreasonably long time (say,
+    more than a month) for no particular reason (a few lines changed, etc.),
+    this is totally fine. Try to return the favor when someone else is asking
+    for feedback on their code, and the universe balances out.
+  - Remember that the best thing you can do while waiting is give review to others!
+
+
+Backporting
+-----------
+
+Security and bug fixes can be backported from `master` to release
+branches.
+Maintainers will do backports in batches and
+use the proper `Needs backport (...)` labels
+when needed (the original author does not need to worry about it).
+
+A backport should contain the following metadata in the commit body:
+
+```
+Github-Pull: #<PR number>
+Rebased-From: <commit hash of the original commit>
+```
+
+Have a look at [an example backport PR](
+https://github.com/bitcoin/bitcoin/pull/16189).
+
+Also see the [backport.py script](
+https://github.com/bitcoin-core/bitcoin-maintainer-tools#backport).
+
+Copyright
+---------
+
+By contributing to this repository, you agree to license your work under the
+MIT license unless specified otherwise in `contrib/debian/copyright` or at
+the top of the file itself. Any work contributed where you are not the original
+author must contain its license header with the original author(s) and source.
diff --git a/COPYING b/COPYING
new file mode 100644
index 00000000..89960cbf
--- /dev/null
+++ b/COPYING
@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2009-2026 The Bitcoin Core developers
+Copyright (c) 2009-2026 Bitcoin Developers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/INSTALL.md b/INSTALL.md
new file mode 100644
index 00000000..013a099c
--- /dev/null
+++ b/INSTALL.md
@@ -0,0 +1 @@
+See [doc/build-\*.md](/doc)
diff --git a/README.md b/README.md
new file mode 100644
index 00000000..cfabb7f6
--- /dev/null
+++ b/README.md
@@ -0,0 +1,79 @@
+Bitcoin Core integration/staging tree
+=====================================
+
+https://bitcoincore.org
+
+For an immediately usable, binary version of the Bitcoin Core software, see
+https://bitcoincore.org/en/download/.
+
+What is Bitcoin Core?
+---------------------
+
+Bitcoin Core connects to the Bitcoin peer-to-peer network to download and fully
+validate blocks and transactions. It also includes a wallet and graphical user
+interface, which can be optionally built.
+
+Further information about Bitcoin Core is available in the [doc folder](/doc).
+
+License
+-------
+
+Bitcoin Core is released under the terms of the MIT license. See [COPYING](COPYING) for more
+information or see https://opensource.org/license/MIT.
+
+Development Process
+-------------------
+
+The `master` branch is regularly built (see `doc/build-*.md` for instructions) and tested, but it is not guaranteed to be
+completely stable. [Tags](https://github.com/bitcoin/bitcoin/tags) are created
+regularly from release branches to indicate new official, stable release versions of Bitcoin Core.
+
+The https://github.com/bitcoin-core/gui repository is used exclusively for the
+development of the GUI. Its master branch is identical in all monotree
+repositories. Release branches and tags do not exist, so please do not fork
+that repository unless it is for development reasons.
+
+The contribution workflow is described in [CONTRIBUTING.md](CONTRIBUTING.md)
+and useful hints for developers can be found in [doc/developer-notes.md](doc/developer-notes.md).
+
+Testing
+-------
+
+Testing and code review is the bottleneck for development; we get more pull
+requests than we can review and test on short notice. Please be patient and help out by testing
+other people's pull requests, and remember this is a security-critical project where any mistake might cost people
+lots of money.
+
+### Automated Testing
+
+Developers are strongly encouraged to write [unit tests](src/test/README.md) for new code, and to
+submit new unit tests for old code. Unit tests can be compiled and run
+(assuming they weren't disabled during the generation of the build system) with: `ctest`. Further details on running
+and extending unit tests can be found in [/src/test/README.md](/src/test/README.md).
+
+There are also [regression and integration tests](/test), written
+in Python.
+These tests can be run (if the [test dependencies](/test) are installed) with: `build/test/functional/test_runner.py`
+(assuming `build` is your build directory).
+
+The CI (Continuous Integration) systems make sure that every pull request is tested on Windows, Linux, and macOS.
+The CI must pass on all commits before merge to avoid unrelated CI failures on new pull requests.
+
+### Manual Quality Assurance (QA) Testing
+
+Changes should be tested by somebody other than the developer who wrote the
+code. This is especially important for large or high-risk changes. It is useful
+to add a test plan to the pull request description if testing the changes is
+not straightforward.
+
+Translations
+------------
+
+Changes to translations as well as new translations can be submitted to
+[Bitcoin Core's Transifex page](https://explore.transifex.com/bitcoin/bitcoin/).
+
+Translations are periodically pulled from Transifex and merged into the git repository. See the
+[translation process](doc/translation_process.md) for details on how this works.
+
+**Important**: We do not accept translation changes as GitHub pull requests because the next
+pull from Transifex would automatically overwrite them again.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..fd4c61d1
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported Versions
+
+See our website for versions of Bitcoin Core that are currently supported with
+security updates: https://bitcoincore.org/en/lifecycle/#schedule
+
+## Reporting a Vulnerability
+
+To report security issues send an email to security@bitcoincore.org (not for support).
+
+The following keys may be used to communicate sensitive information to developers:
+
+| Name | Fingerprint |
+|------|-------------|
+| Pieter Wuille | 133E AC17 9436 F14A 5CF1  B794 860F EB80 4E66 9320 |
+| Michael Ford | E777 299F C265 DD04 7930  70EB 944D 35F9 AC3D B76A |
+| Ava Chow | 1528 1230 0785 C964 44D3  334D 1756 5732 E08E 5E41 |
+
+You can import a key by running the following command with that individual’s fingerprint: `gpg --keyserver hkps://keys.openpgp.org --recv-keys "<fingerprint>"` Ensure that you put quotes around fingerprints containing spaces.
diff --git a/ci/README.md b/ci/README.md
new file mode 100644
index 00000000..293294a5
--- /dev/null
+++ b/ci/README.md
@@ -0,0 +1,99 @@
+# CI Scripts
+
+This directory contains scripts for each build step in each build stage.
+
+## Running a Stage Locally
+
+Be aware that the tests will be built and run in-place, so please run at your own risk.
+If the repository is not a fresh git clone, you might have to clean files from previous builds or test runs first.
+
+The ci needs to perform various sysadmin tasks such as installing packages or writing to the user's home directory.
+While it should be fine to run
+the ci system locally on your development box, the ci scripts can generally be assumed to have received less review and
+testing compared to other parts of the codebase. If you want to keep the work tree clean, you might want to run the ci
+system in a virtual machine with a Linux operating system of your choice.
+
+To allow for a wide range of tested environments, but also ensure reproducibility to some extent, the test stage
+requires `bash`, `docker`, and `python3` to be installed. To run on different architectures than the host `qemu` is also required. To install all requirements on Ubuntu, run
+
+```
+sudo apt install bash docker.io python3 qemu-user-static
+```
+
+For some sanitizer builds, the kernel's address-space layout randomization
+(ASLR) entropy can cause sanitizer shadow memory mappings to fail. When running
+the CI locally you may need to reduce that entropy by running:
+
+```
+sudo sysctl -w vm.mmap_rnd_bits=28
+```
+
+To run a test that requires emulating a CPU architecture different from the
+host, we may rely on the container environment recognizing foreign executables
+and automatically running them using `qemu`. The following sets us up to do so
+(also works for `podman`):
+
+```
+docker run --rm --privileged docker.io/multiarch/qemu-user-static --reset -p yes
+```
+
+It is recommended to run the CI system in a clean environment. The `env -i`
+command below ensures that *only* specified environment variables are propagated
+into the local CI.
+To run the test stage with a specific configuration:
+
+```
+env -i HOME="$HOME" PATH="$PATH" USER="$USER" FILE_ENV="./ci/test/00_setup_env_arm.sh" ./ci/test_run_all.sh
+```
+
+## Configurations
+
+The test files (`FILE_ENV`) are constructed to test a wide range of
+configurations, rather than a single pass/fail. This helps to catch build
+failures and logic errors that present on platforms other than the ones the
+author has tested.
+
+Some builders use the dependency-generator in `./depends`, rather than using
+the system package manager to install build dependencies. This guarantees that
+the tester is using the same versions as the release builds, which also use
+`./depends`.
+
+It is also possible to force a specific configuration without modifying the
+file. For example,
+
+```
+env -i HOME="$HOME" PATH="$PATH" USER="$USER" MAKEJOBS="-j1" FILE_ENV="./ci/test/00_setup_env_arm.sh" ./ci/test_run_all.sh
+```
+
+The files starting with `0n` (`n` greater than 0) are the scripts that are run
+in order.
+
+## Cache
+
+In order to avoid rebuilding all dependencies for each build, the binaries are
+cached and reused when possible. Changes in the dependency-generator will
+trigger cache-invalidation and rebuilds as necessary.
+
+## Configuring a repository for CI
+
+### Primary repository
+
+To configure the primary repository, follow these steps:
+
+1. Register with [Cirrus Runners](https://cirrus-runners.app/) and purchase runners.
+2. Install the Cirrus Runners GitHub app against the GitHub organization.
+3. Enable organisation-level runners to be used in public repositories:
+   1. `Org settings -> Actions -> Runner Groups -> Default -> Allow public repos`
+4. Permit the following actions to run:
+   1. cirruslabs/cache/restore@\*
+   1. cirruslabs/cache/save@\*
+   1. docker/setup-buildx-action@\*
+   1. actions/github-script@\*
+
+### Forked repositories
+
+When used in a fork the CI will run on GitHub's free hosted runners by default.
+In this case, due to GitHub's 10GB-per-repo cache size limitations caches will be frequently evicted and missed, but the workflows will run (slowly).
+
+It is also possible to use your own Cirrus Runners in your own fork with an appropriate patch to the `REPO_USE_CIRRUS_RUNNERS` variable in ../.github/workflows/ci.yml
+NB that Cirrus Runners only work at an organisation level, therefore in order to use your own Cirrus Runners, *the fork must be within your own organisation*.
diff --git a/ci/lint/01_install.sh b/ci/lint/01_install.sh
new file mode 100755
index 00000000..0cf9fbb4
--- /dev/null
+++ b/ci/lint/01_install.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2018-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C
+
+set -o errexit -o pipefail -o xtrace
+
+export CI_RETRY_EXE="/ci_retry --"
+
+pushd "/"
+
+${CI_RETRY_EXE} apt-get update
+# Lint dependencies:
+# - cargo (used to run the lint tests)
+# - curl/xz-utils (to install shellcheck)
+# - git (used in many lint scripts)
+# - gpg (used by verify-commits)
+# - moreutils (used by scripted-diff)
+${CI_RETRY_EXE} apt-get install -y cargo curl xz-utils git gpg moreutils
+
+PYTHON_PATH="/python_build"
+if [ ! -d "${PYTHON_PATH}/bin" ]; then
+  (
+    ${CI_RETRY_EXE} git clone --depth=1 https://github.com/pyenv/pyenv.git
+    cd pyenv/plugins/python-build || exit 1
+    ./install.sh
+  )
+  # For dependencies see https://github.com/pyenv/pyenv/wiki#suggested-build-environment
+  ${CI_RETRY_EXE} apt-get install -y build-essential libssl-dev zlib1g-dev \
+    libbz2-dev libreadline-dev libsqlite3-dev curl llvm \
+    libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev \
+    clang
+  env CC=clang python-build "$(cat "/.python-version")" "${PYTHON_PATH}"
+fi
+export PATH="${PYTHON_PATH}/bin:${PATH}"
+command -v python3
+python3 --version
+
+${CI_RETRY_EXE} pip3 install \
+  lief==0.16.6 \
+  mypy==1.18.2 \
+  pyzmq==27.1.0 \
+  ruff==0.13.2 \
+  vulture==2.14
+
+SHELLCHECK_VERSION=v0.11.0
+curl -sL "https://github.com/koalaman/shellcheck/releases/download/${SHELLCHECK_VERSION}/shellcheck-${SHELLCHECK_VERSION}.linux.x86_64.tar.xz" | \
+    tar --xz -xf - --directory /tmp/
+mv "/tmp/shellcheck-${SHELLCHECK_VERSION}/shellcheck" /usr/bin/
+
+MLC_VERSION=v1
+MLC_BIN=mlc-x86_64-linux
+curl -sL "https://github.com/becheran/mlc/releases/download/${MLC_VERSION}/${MLC_BIN}" -o "/usr/bin/mlc"
+chmod +x /usr/bin/mlc
+
+popd || exit
diff --git a/ci/lint/06_script.sh b/ci/lint/06_script.sh
new file mode 100755
index 00000000..82e499c2
--- /dev/null
+++ b/ci/lint/06_script.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2018-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C
+
+set -o errexit -o pipefail -o xtrace
+
+if [ -n "${LINT_CI_IS_PR}" ]; then
+  export COMMIT_RANGE="HEAD~..HEAD"
+  if [ "$(git rev-list -1 HEAD)" != "$(git rev-list -1 --merges HEAD)" ]; then
+    echo "Error: The top commit must be a merge commit, usually the remote 'pull/<PR_NUMBER>/merge' branch."
+    false
+  fi
+fi
+
+RUST_BACKTRACE=1 cargo run --manifest-path "./test/lint/test_runner/Cargo.toml"
+
+if [ "${LINT_CI_SANITY_CHECK_COMMIT_SIG}" = "1" ] ; then
+    # Sanity check only the last few commits to get notified of missing sigs,
+    # missing keys, or expired keys. Usually there is only one new merge commit
+    # per push on the master branch and a few commits on release branches, so
+    # sanity checking only a few (10) commits seems sufficient and cheap.
+    git log HEAD~10 -1 --format='%H' > ./contrib/verify-commits/trusted-sha512-root-commit
+    git log HEAD~10 -1 --format='%H' > ./contrib/verify-commits/trusted-git-root
+    mapfile -t KEYS < contrib/verify-commits/trusted-keys
+    git config user.email "ci@ci.ci"
+    git config user.name "ci"
+    ${CI_RETRY_EXE} gpg --keyserver hkps://keys.openpgp.org --recv-keys "${KEYS[@]}" &&
+    ./contrib/verify-commits/verify-commits.py;
+fi
diff --git a/ci/lint/container-entrypoint.sh b/ci/lint/container-entrypoint.sh
new file mode 100755
index 00000000..84e60be2
--- /dev/null
+++ b/ci/lint/container-entrypoint.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+export LC_ALL=C
+
+# Fixes permission issues when there is a container UID/GID mismatch with the owner
+# of the mounted bitcoin src dir.
+git config --global --add safe.directory /bitcoin
+
+export PATH="/python_build/bin:${PATH}"
+
+if [ -z "$1" ]; then
+  bash -ic "./ci/lint/06_script.sh"
+else
+  exec "$@"
+fi
diff --git a/ci/lint_imagefile b/ci/lint_imagefile
new file mode 100644
index 00000000..b3238076
--- /dev/null
+++ b/ci/lint_imagefile
@@ -0,0 +1,24 @@
+# Copyright (c) The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+# See test/lint/README.md for usage.
+
+FROM mirror.gcr.io/ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV LC_ALL=C.UTF-8
+
+COPY ./ci/retry/retry /ci_retry
+COPY ./.python-version /.python-version
+COPY ./ci/lint/container-entrypoint.sh /entrypoint.sh
+COPY ./ci/lint/01_install.sh /install.sh
+
+RUN /install.sh && \
+  echo 'alias lint="./ci/lint/06_script.sh"' >> ~/.bashrc && \
+  chmod 755 /entrypoint.sh && \
+  rm -rf /var/lib/apt/lists/*
+
+
+WORKDIR /bitcoin
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/ci/retry/README.md b/ci/retry/README.md
new file mode 100644
index 00000000..1b03c652
--- /dev/null
+++ b/ci/retry/README.md
@@ -0,0 +1,123 @@
+retry - The command line retry tool
+------------------------------------------
+
+Retry any shell command with exponential backoff or constant delay.
+
+### Instructions
+
+Install:
+
+retry is a shell script, so drop it somewhere and make sure it's added to your $PATH. Or you can use the following one-liner:
+
+```sh
+sudo sh -c "curl https://raw.githubusercontent.com/kadwanev/retry/master/retry -o /usr/local/bin/retry && chmod +x /usr/local/bin/retry"
+```
+
+If you're on OS X, retry is also on Homebrew:
+
+```
+brew pull 27283
+brew install retry
+```
+Not popular enough for homebrew-core. Please star this project to help.
+
+### Usage
+
+Help:
+
+`retry -?`
+
+    Usage: retry [options] -- execute command
+        -h, -?, --help
+        -v, --verbose                    Verbose output
+        -t, --tries=#                    Set max retries: Default 10
+        -s, --sleep=secs                 Constant sleep amount (seconds)
+        -m, --min=secs                   Exponential Backoff: minimum sleep amount (seconds): Default 0.3
+        -x, --max=secs                   Exponential Backoff: maximum sleep amount (seconds): Default 60
+        -f, --fail="script +cmds"        Fail Script: run in case of final failure
+
+### Examples
+
+No problem:
+
+`retry echo u work good`
+
+    u work good
+
+Test functionality:
+
+`retry 'echo "y u no work"; false'`
+
+    y u no work
+    Before retry #1: sleeping 0.3 seconds
+    y u no work
+    Before retry #2: sleeping 0.6 seconds
+    y u no work
+    Before retry #3: sleeping 1.2 seconds
+    y u no work
+    Before retry #4: sleeping 2.4 seconds
+    y u no work
+    Before retry #5: sleeping 4.8 seconds
+    y u no work
+    Before retry #6: sleeping 9.6 seconds
+    y u no work
+    Before retry #7: sleeping 19.2 seconds
+    y u no work
+    Before retry #8: sleeping 38.4 seconds
+    y u no work
+    Before retry #9: sleeping 60.0 seconds
+    y u no work
+    Before retry #10: sleeping 60.0 seconds
+    y u no work
+    etc..
+
+Limit retries:
+
+`retry -t 4 'echo "y u no work"; false'`
+
+    y u no work
+    Before retry #1: sleeping 0.3 seconds
+    y u no work
+    Before retry #2: sleeping 0.6 seconds
+    y u no work
+    Before retry #3: sleeping 1.2 seconds
+    y u no work
+    Before retry #4: sleeping 2.4 seconds
+    y u no work
+    Retries exhausted
+
+Bad command:
+
+`retry poop`
+
+    bash: poop: command not found
+
+Fail command:
+
+`retry -t 3 -f 'echo "oh poopsickles"' 'echo "y u no work"; false'`
+
+    y u no work
+    Before retry #1: sleeping 0.3 seconds
+    y u no work
+    Before retry #2: sleeping 0.6 seconds
+    y u no work
+    Before retry #3: sleeping 1.2 seconds
+    y u no work
+    Retries exhausted, running fail script
+    oh poopsickles
+
+Last attempt passed:
+
+`retry -t 3 -- 'if [ $RETRY_ATTEMPT -eq 3 ]; then echo Passed at attempt $RETRY_ATTEMPT; true; else echo Failed at attempt $RETRY_ATTEMPT; false; fi;'`
+
+    Failed at attempt 0
+    Before retry #1: sleeping 0.3 seconds
+    Failed at attempt 1
+    Before retry #2: sleeping 0.6 seconds
+    Failed at attempt 2
+    Before retry #3: sleeping 1.2 seconds
+    Passed at attempt 3
+
+### License
+
+Apache 2.0 - go nuts
diff --git a/ci/retry/retry b/ci/retry/retry
new file mode 100755
index 00000000..3c06519d
--- /dev/null
+++ b/ci/retry/retry
@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+
+GETOPT_BIN=$IN_GETOPT_BIN
+GETOPT_BIN=${GETOPT_BIN:-getopt}
+
+__sleep_amount() {
+  if [ -n "$constant_sleep" ]; then
+    sleep_time=$constant_sleep
+  else
+    #TODO: check for awk
+    #TODO: check if user would rather use one of the other possible dependencies: python, ruby, bc, dc
+    sleep_time=`awk "BEGIN {t = $min_sleep * $(( (1<<($attempts -1)) )); print (t > $max_sleep ? $max_sleep : t)}"`
+  fi
+}
+
+__log_out() {
+  echo "$1" 1>&2
+}
+
+# Parameters: max_tries min_sleep max_sleep constant_sleep fail_script EXECUTION_COMMAND
+retry()
+{
+  local max_tries="$1"; shift
+  local min_sleep="$1"; shift
+  local max_sleep="$1"; shift
+  local constant_sleep="$1"; shift
+  local fail_script="$1"; shift
+  if [ -n "$VERBOSE" ]; then
+    __log_out "Retry Parameters: max_tries=$max_tries min_sleep=$min_sleep max_sleep=$max_sleep constant_sleep=$constant_sleep"
+    if [ -n "$fail_script" ]; then __log_out "Fail script: $fail_script"; fi
+    __log_out ""
+    __log_out "Execution Command: $*"
+    __log_out ""
+  fi
+
+  local attempts=0
+  local return_code=1
+
+
+  while [[ $return_code -ne 0 && $attempts -le $max_tries ]]; do
+    if [ $attempts -gt 0 ]; then
+      __sleep_amount
+      __log_out "Before retry #$attempts: sleeping $sleep_time seconds"
+      sleep $sleep_time
+    fi
+
+    P="$1"
+    for param in "${@:2}"; do P="$P '$param'"; done
+    #TODO: replace single quotes in each arg with '"'"' ?
+    export RETRY_ATTEMPT=$attempts
+    bash -c "$P"
+    return_code=$?
+    #__log_out "Process returned $return_code on attempt $attempts"
+    if [ $return_code -eq 127 ]; then
+      # command not found
+      exit $return_code
+    elif [ $return_code -ne 0 ]; then
+      attempts=$[$attempts +1]
+    fi
+  done
+
+  if [ $attempts -gt $max_tries ]; then
+    if [ -n "$fail_script" ]; then
+      __log_out "Retries exhausted, running fail script"
+      eval $fail_script
+    else
+      __log_out "Retries exhausted"
+    fi
+  fi
+
+  exit $return_code
+}
+
+# If we're being sourced, don't worry about such things
+if [ "$BASH_SOURCE" == "$0" ]; then
+  # Prints the help text
+  help()
+  {
+    local retry=$(basename $0)
+    cat <<EOF
+Usage: $retry [options] -- execute command
+    -h, -?, --help
+    -v, --verbose                    Verbose output
+    -t, --tries=#                    Set max retries: Default 10
+    -s, --sleep=secs                 Constant sleep amount (seconds)
+    -m, --min=secs                   Exponential Backoff: minimum sleep amount (seconds): Default 0.3
+    -x, --max=secs                   Exponential Backoff: maximum sleep amount (seconds): Default 60
+    -f, --fail="script +cmds"        Fail Script: run in case of final failure
+EOF
+  }
+
+  # show help for no arguments if stdin is a terminal
+  if { [ -z "$1" ] && [ -t 0 ] ; } || [ "$1" == '-h' ] || [ "$1" == '-?' ] || [ "$1" == '--help' ]
+  then
+    help
+    exit 0
+  fi
+
+  $GETOPT_BIN --test > /dev/null
+  if [[ $? -ne 4 ]]; then
+      echo "I’m sorry, 'getopt --test' failed in this environment. Please load GNU getopt."
+      exit 1
+  fi
+
+  OPTIONS=vt:s:m:x:f:
+  LONGOPTIONS=verbose,tries:,sleep:,min:,max:,fail:
+
+  PARSED=$($GETOPT_BIN --options="$OPTIONS" --longoptions="$LONGOPTIONS" --name "$0" -- "$@")
+  if [[ $? -ne 0 ]]; then
+    # e.g. $? == 1
+    #  then getopt has complained about wrong arguments to stdout
+    exit 2
+  fi
+  # read getopt’s output this way to handle the quoting right:
+  eval set -- "$PARSED"
+
+  max_tries=10
+  min_sleep=0.3
+  max_sleep=60.0
+  constant_sleep=
+  fail_script=
+
+  # now enjoy the options in order and nicely split until we see --
+  while true; do
+      case "$1" in
+          -v|--verbose)
+              VERBOSE=true
+              shift
+              ;;
+          -t|--tries)
+              max_tries="$2"
+              shift 2
+              ;;
+          -s|--sleep)
+              constant_sleep="$2"
+              shift 2
+              ;;
+          -m|--min)
+              min_sleep="$2"
+              shift 2
+              ;;
+          -x|--max)
+              max_sleep="$2"
+              shift 2
+              ;;
+          -f|--fail)
+              fail_script="$2"
+              shift 2
+              ;;
+          --)
+              shift
+              break
+              ;;
+          *)
+              echo "Programming error"
+              exit 3
+              ;;
+      esac
+  done
+
+  retry "$max_tries" "$min_sleep" "$max_sleep" "$constant_sleep" "$fail_script" "$@"
+
+fi
diff --git a/ci/test/00_setup_env.sh b/ci/test/00_setup_env.sh
new file mode 100755
index 00000000..890bccde
--- /dev/null
+++ b/ci/test/00_setup_env.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+set -o errexit -o pipefail -o xtrace
+
+# The source root dir, usually from git, usually read-only.
+# The ci system copies this folder.
+BASE_READ_ONLY_DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )"/../../ >/dev/null 2>&1 && pwd )
+export BASE_READ_ONLY_DIR
+# The destination root dir inside the container.
+# This folder will also hold any SDKs.
+# This folder only exists on the ci guest and will be a copy of BASE_READ_ONLY_DIR
+export BASE_ROOT_DIR="${BASE_ROOT_DIR:-/ci_container_base}"
+# The depends dir.
+# This folder exists only on the ci guest, and on the ci host as a volume.
+export DEPENDS_DIR=${DEPENDS_DIR:-$BASE_ROOT_DIR/depends}
+# A folder for the ci system to put temporary files (build result, datadirs for tests, ...)
+# This folder only exists on the ci guest.
+export BASE_SCRATCH_DIR=${BASE_SCRATCH_DIR:-$BASE_ROOT_DIR/ci/scratch}
+
+echo "Setting specific values in env"
+if [ -n "${FILE_ENV}" ]; then
+  set -o errexit;
+  # shellcheck disable=SC1090
+  source "${FILE_ENV}"
+fi
+
+echo "Fallback to default values in env (if not yet set)"
+# The number of parallel jobs to pass down to make and test_runner.py
+export MAKEJOBS=${MAKEJOBS:--j$(if command -v nproc > /dev/null 2>&1; then nproc; else sysctl -n hw.logicalcpu; fi)}
+
+export RUN_UNIT_TESTS=${RUN_UNIT_TESTS:-true}
+export RUN_FUNCTIONAL_TESTS=${RUN_FUNCTIONAL_TESTS:-true}
+export RUN_TIDY=${RUN_TIDY:-false}
+# By how much to scale the test_runner timeouts (option --timeout-factor).
+# This is needed because some ci machines have slow CPU or disk, so sanitizers
+# might be slow or a reindex might be waiting on disk IO.
+export TEST_RUNNER_TIMEOUT_FACTOR=${TEST_RUNNER_TIMEOUT_FACTOR:-40}
+export RUN_FUZZ_TESTS=${RUN_FUZZ_TESTS:-false}
+
+# Randomize test order.
+# See https://www.boost.org/doc/libs/1_71_0/libs/test/doc/html/boost_test/utf_reference/rt_param_reference/random.html
+export BOOST_TEST_RANDOM=${BOOST_TEST_RANDOM:-1}
+# See man 7 debconf
+export DEBIAN_FRONTEND=noninteractive
+export CCACHE_MAXSIZE=${CCACHE_MAXSIZE:-500M}
+export CCACHE_TEMPDIR=${CCACHE_TEMPDIR:-/tmp/.ccache-temp}
+export CCACHE_COMPRESS=${CCACHE_COMPRESS:-1}
+# The cache dir.
+# This folder exists only on the ci guest, and on the ci host as a volume.
+export CCACHE_DIR="${CCACHE_DIR:-$BASE_SCRATCH_DIR/ccache}"
+# Folder where the build result is put (bin and lib).
+export BASE_OUTDIR=${BASE_OUTDIR:-$BASE_SCRATCH_DIR/out}
+# The folder for previous release binaries.
+# This folder exists only on the ci guest, and on the ci host as a volume.
+export PREVIOUS_RELEASES_DIR=${PREVIOUS_RELEASES_DIR:-$BASE_ROOT_DIR/prev_releases}
+export CI_BASE_PACKAGES=${CI_BASE_PACKAGES:-build-essential pkgconf curl ca-certificates ccache python3-dev rsync git procps bison e2fsprogs cmake ninja-build}
+export GOAL=${GOAL:-install}
+export DIR_QA_ASSETS=${DIR_QA_ASSETS:-${BASE_SCRATCH_DIR}/qa-assets}
+export CI_RETRY_EXE=${CI_RETRY_EXE:-"retry --"}
+
+# The --platform argument used with `docker build` and `docker run`.
+export CI_IMAGE_PLATFORM=${CI_IMAGE_PLATFORM:-"linux"} # Force linux, but use native arch by default
diff --git a/ci/test/00_setup_env_arm.sh b/ci/test/00_setup_env_arm.sh
new file mode 100755
index 00000000..f4ad97d2
--- /dev/null
+++ b/ci/test/00_setup_env_arm.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export HOST=arm-linux-gnueabihf
+export DPKG_ADD_ARCH="armhf"
+export PACKAGES="python3-zmq g++-arm-linux-gnueabihf libc6:armhf libstdc++6:armhf libfontconfig1:armhf libxcb1:armhf"
+export CONTAINER_NAME=ci_arm_linux
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"  # Check that https://packages.debian.org/trixie/g++-arm-linux-gnueabihf (version 14.x, similar to guix) can cross-compile
+export CI_IMAGE_PLATFORM="linux/arm64"
+export GOAL="install"
+export CI_LIMIT_STACK_SIZE=1
+# -Wno-psabi is to disable ABI warnings: "note: parameter passing for argument of type ... changed in GCC 7.1"
+# This could be removed once the ABI change warning does not show up by default
+export BITCOIN_CONFIG=" \
+  --preset=dev-mode \
+  -DREDUCE_EXPORTS=ON \
+  -DCMAKE_CXX_FLAGS='-Wno-psabi -Wno-error=maybe-uninitialized' \
+"
diff --git a/ci/test/00_setup_env_i686_no_ipc.sh b/ci/test/00_setup_env_i686_no_ipc.sh
new file mode 100755
index 00000000..dca0486f
--- /dev/null
+++ b/ci/test/00_setup_env_i686_no_ipc.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2020-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export HOST=i686-pc-linux-gnu
+export CONTAINER_NAME=ci_i686_no_multiprocess
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"
+export CI_IMAGE_PLATFORM="linux/amd64"
+export PACKAGES="llvm clang g++-multilib"
+export DEP_OPTS="DEBUG=1 NO_IPC=1"
+export GOAL="install"
+export CI_LIMIT_STACK_SIZE=1
+export TEST_RUNNER_EXTRA="--v2transport --usecli"
+export BITCOIN_CONFIG="\
+ --preset=dev-mode \
+ -DENABLE_IPC=OFF \
+ -DCMAKE_BUILD_TYPE=Debug \
+ -DCMAKE_C_COMPILER='clang;-m32' \
+ -DCMAKE_CXX_COMPILER='clang++;-m32' \
+ -DAPPEND_CPPFLAGS='-DBOOST_MULTI_INDEX_ENABLE_SAFE_MODE' \
+"
diff --git a/ci/test/00_setup_env_mac_cross.sh b/ci/test/00_setup_env_mac_cross.sh
new file mode 100755
index 00000000..5b33c127
--- /dev/null
+++ b/ci/test/00_setup_env_mac_cross.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export SDK_URL=${SDK_URL:-https://bitcoincore.org/depends-sources/sdks}
+
+export CONTAINER_NAME=ci_macos_cross
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie" # Check that https://packages.debian.org/trixie/clang (version 19, similar to guix) can cross-compile
+export HOST=arm64-apple-darwin
+export PACKAGES="clang lld llvm zip"
+export XCODE_VERSION=15.0
+export XCODE_BUILD_ID=15A240d
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export GOAL="deploy"
+export BITCOIN_CONFIG="\
+ --preset=dev-mode \
+ -DWITH_USDT=OFF \
+ -DREDUCE_EXPORTS=ON \
+"
diff --git a/ci/test/00_setup_env_mac_cross_intel.sh b/ci/test/00_setup_env_mac_cross_intel.sh
new file mode 100755
index 00000000..28eb7a09
--- /dev/null
+++ b/ci/test/00_setup_env_mac_cross_intel.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export SDK_URL=${SDK_URL:-https://bitcoincore.org/depends-sources/sdks}
+
+export CONTAINER_NAME=ci_macos_cross_intel
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie" # Check that https://packages.debian.org/trixie/clang (version 19, similar to guix) can cross-compile
+export HOST=x86_64-apple-darwin
+export PACKAGES="clang lld llvm zip"
+export XCODE_VERSION=15.0
+export XCODE_BUILD_ID=15A240d
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export GOAL="deploy"
+export BITCOIN_CONFIG="\
+ --preset=dev-mode \
+ -DWITH_USDT=OFF \
+ -DREDUCE_EXPORTS=ON \
+"
diff --git a/ci/test/00_setup_env_mac_native.sh b/ci/test/00_setup_env_mac_native.sh
new file mode 100755
index 00000000..a9b4d5c8
--- /dev/null
+++ b/ci/test/00_setup_env_mac_native.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME="ci_mac_native"  # macos does not use a container, but the env var is needed for logging
+export PIP_PACKAGES="--break-system-packages pycapnp zmq"
+export GOAL="install deploy"
+export CMAKE_GENERATOR="Ninja"
+export CI_OS_NAME="macos"
+export NO_DEPENDS=1
+export OSX_SDK=""
+export BITCOIN_CONFIG="\
+  --preset=dev-mode \
+  -DWITH_USDT=OFF \
+  -DREDUCE_EXPORTS=ON \
+  -DCMAKE_EXE_LINKER_FLAGS='-Wl,-stack_size -Wl,0x80000' \
+"
+export BITCOIN_CMD="bitcoin -m" # Used in functional tests
diff --git a/ci/test/00_setup_env_mac_native_fuzz.sh b/ci/test/00_setup_env_mac_native_fuzz.sh
new file mode 100755
index 00000000..ea074e47
--- /dev/null
+++ b/ci/test/00_setup_env_mac_native_fuzz.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME="ci_mac_native_fuzz"  # macos does not use a container, but the env var is needed for logging
+export CMAKE_GENERATOR="Ninja"
+export BITCOIN_CONFIG="-DBUILD_FOR_FUZZING=ON -DCMAKE_EXE_LINKER_FLAGS='-Wl,-stack_size -Wl,0x80000' -DAPPEND_CPPFLAGS='-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG'"
+export CI_OS_NAME="macos"
+export NO_DEPENDS=1
+export OSX_SDK=""
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export RUN_FUZZ_TESTS=true
+export GOAL="all"
diff --git a/ci/test/00_setup_env_native_alpine_musl.sh b/ci/test/00_setup_env_native_alpine_musl.sh
new file mode 100755
index 00000000..ce7614ab
--- /dev/null
+++ b/ci/test/00_setup_env_native_alpine_musl.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2020-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME=ci_native_alpine_musl
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/alpine:3.22"
+export CI_BASE_PACKAGES="build-base musl-dev pkgconf curl ccache make ninja git python3-dev py3-pip which patch xz procps rsync util-linux bison e2fsprogs cmake dash linux-headers"
+export PIP_PACKAGES="--break-system-packages pyzmq pycapnp"
+export DEP_OPTS="DEBUG=1"
+export GOAL="install"
+export BITCOIN_CONFIG="\
+ --preset=dev-mode \
+ -DREDUCE_EXPORTS=ON \
+ -DCMAKE_BUILD_TYPE=Debug \
+"
+export BITCOIN_CMD="bitcoin -m" # Used in functional tests
diff --git a/ci/test/00_setup_env_native_asan.sh b/ci/test/00_setup_env_native_asan.sh
new file mode 100755
index 00000000..0e732240
--- /dev/null
+++ b/ci/test/00_setup_env_native_asan.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
+
+# Only install BCC tracing packages in CI. Container has to match the host for BCC to work.
+if [[ "${INSTALL_BCC_TRACING_TOOLS}" == "true" ]]; then
+  # Required for USDT functional tests to run
+  BPFCC_PACKAGE="bpfcc-tools linux-headers-$(uname --kernel-release)"
+  export CI_CONTAINER_CAP="--privileged -v /sys/kernel:/sys/kernel:rw"
+else
+  BPFCC_PACKAGE=""
+  export CI_CONTAINER_CAP="--cap-add SYS_PTRACE"  # If run with (ASan + LSan), the container needs access to ptrace (https://github.com/google/sanitizers/issues/764)
+fi
+
+export CONTAINER_NAME=ci_native_asan
+export APT_LLVM_V="21"
+export PACKAGES="systemtap-sdt-dev clang-${APT_LLVM_V} llvm-${APT_LLVM_V} libclang-rt-${APT_LLVM_V}-dev mold python3-zmq qt6-base-dev qt6-tools-dev qt6-l10n-tools libevent-dev libboost-dev libzmq3-dev libqrencode-dev libsqlite3-dev ${BPFCC_PACKAGE} libcapnp-dev capnproto python3-pip"
+export PIP_PACKAGES="--break-system-packages pycapnp"
+export NO_DEPENDS=1
+export GOAL="install"
+export CI_LIMIT_STACK_SIZE=1
+export BITCOIN_CONFIG="\
+ --preset=dev-mode \
+ -DSANITIZERS=address,float-divide-by-zero,integer,undefined \
+ -DCMAKE_C_COMPILER=clang \
+ -DCMAKE_CXX_COMPILER=clang++ \
+ -DCMAKE_C_FLAGS='-ftrivial-auto-var-init=pattern' \
+ -DCMAKE_CXX_FLAGS='-ftrivial-auto-var-init=pattern' \
+ -DCMAKE_EXE_LINKER_FLAGS='-fuse-ld=mold' \
+ -DAPPEND_CXXFLAGS='-std=c++23' \
+ -DAPPEND_CPPFLAGS='-DARENA_DEBUG -DDEBUG_LOCKORDER' \
+"
diff --git a/ci/test/00_setup_env_native_fuzz.sh b/ci/test/00_setup_env_native_fuzz.sh
new file mode 100755
index 00000000..b3ad36a8
--- /dev/null
+++ b/ci/test/00_setup_env_native_fuzz.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
+export CONTAINER_NAME=ci_native_fuzz
+export APT_LLVM_V="21"
+export PACKAGES="clang-${APT_LLVM_V} llvm-${APT_LLVM_V} libclang-rt-${APT_LLVM_V}-dev libevent-dev libboost-dev libsqlite3-dev libcapnp-dev capnproto"
+export NO_DEPENDS=1
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export RUN_FUZZ_TESTS=true
+export GOAL="all"
+export CI_CONTAINER_CAP="--cap-add SYS_PTRACE"  # If run with (ASan + LSan), the container needs access to ptrace (https://github.com/google/sanitizers/issues/764)
+export BITCOIN_CONFIG="\
+ -DBUILD_FOR_FUZZING=ON \
+ -DSANITIZERS=fuzzer,address,undefined,float-divide-by-zero,integer \
+ -DCMAKE_C_COMPILER=clang \
+ -DCMAKE_CXX_COMPILER=clang++ \
+ -DCMAKE_C_FLAGS='-ftrivial-auto-var-init=pattern' \
+ -DCMAKE_CXX_FLAGS='-ftrivial-auto-var-init=pattern' \
+"
diff --git a/ci/test/00_setup_env_native_fuzz_with_msan.sh b/ci/test/00_setup_env_native_fuzz_with_msan.sh
new file mode 100755
index 00000000..7529bbc6
--- /dev/null
+++ b/ci/test/00_setup_env_native_fuzz_with_msan.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2020-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
+export APT_LLVM_V="21"
+LIBCXX_DIR="/cxx_build/"
+export MSAN_FLAGS="-fsanitize=memory -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer -g -O1 -fno-optimize-sibling-calls"
+# -lstdc++ to resolve link issues due to upstream packaging
+LIBCXX_FLAGS="-nostdinc++ -nostdlib++ -isystem ${LIBCXX_DIR}include/c++/v1 -L${LIBCXX_DIR}lib -Wl,-rpath,${LIBCXX_DIR}lib -lc++ -lc++abi -lpthread -Wno-unused-command-line-argument -lstdc++"
+export MSAN_AND_LIBCXX_FLAGS="${MSAN_FLAGS} ${LIBCXX_FLAGS}"
+
+export CONTAINER_NAME="ci_native_fuzz_msan"
+export PACKAGES="clang-${APT_LLVM_V} llvm-${APT_LLVM_V} llvm-${APT_LLVM_V}-dev libclang-${APT_LLVM_V}-dev libclang-rt-${APT_LLVM_V}-dev"
+export DEP_OPTS="DEBUG=1 NO_QT=1 CC=clang CXX=clang++ CFLAGS='${MSAN_FLAGS}' CXXFLAGS='${MSAN_AND_LIBCXX_FLAGS}'"
+export GOAL="all"
+# Setting CMAKE_{C,CXX}_FLAGS_DEBUG flags to an empty string ensures that the flags set in MSAN_FLAGS remain unaltered.
+# _FORTIFY_SOURCE is not compatible with MSAN.
+export BITCOIN_CONFIG="\
+ -DCMAKE_BUILD_TYPE=Debug \
+ -DCMAKE_C_FLAGS_DEBUG='' \
+ -DCMAKE_CXX_FLAGS_DEBUG='' \
+ -DBUILD_FOR_FUZZING=ON \
+ -DSANITIZERS=memory \
+ -DAPPEND_CPPFLAGS='-DBOOST_MULTI_INDEX_ENABLE_SAFE_MODE -U_FORTIFY_SOURCE' \
+"
+export USE_INSTRUMENTED_LIBCPP="MemoryWithOrigins"
+export RUN_UNIT_TESTS="false"
+export RUN_FUNCTIONAL_TESTS="false"
+export RUN_FUZZ_TESTS=true
diff --git a/ci/test/00_setup_env_native_fuzz_with_valgrind.sh b/ci/test/00_setup_env_native_fuzz_with_valgrind.sh
new file mode 100755
index 00000000..d8b0f5f1
--- /dev/null
+++ b/ci/test/00_setup_env_native_fuzz_with_valgrind.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"
+export CONTAINER_NAME=ci_native_fuzz_valgrind
+export PACKAGES="libevent-dev libboost-dev libsqlite3-dev valgrind libcapnp-dev capnproto"
+export NO_DEPENDS=1
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export RUN_FUZZ_TESTS=true
+export FUZZ_TESTS_CONFIG="--valgrind"
+export GOAL="all"
+export BITCOIN_CONFIG="\
+ -DBUILD_FOR_FUZZING=ON \
+ -DCMAKE_CXX_FLAGS='-Wno-error=array-bounds' \
+"
diff --git a/ci/test/00_setup_env_native_iwyu.sh b/ci/test/00_setup_env_native_iwyu.sh
new file mode 100755
index 00000000..3868510d
--- /dev/null
+++ b/ci/test/00_setup_env_native_iwyu.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"  # To build codegen, CMake must be 3.31 or newer.
+export CONTAINER_NAME=ci_native_iwyu
+export TIDY_LLVM_V="21"
+export APT_LLVM_V="${TIDY_LLVM_V}"
+export PACKAGES="clang-${TIDY_LLVM_V} clang-format-${TIDY_LLVM_V} libclang-${TIDY_LLVM_V}-dev llvm-${TIDY_LLVM_V}-dev jq libevent-dev libboost-dev libzmq3-dev systemtap-sdt-dev qt6-base-dev qt6-tools-dev qt6-l10n-tools libqrencode-dev libsqlite3-dev libcapnp-dev capnproto"
+export NO_DEPENDS=1
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export RUN_FUZZ_TESTS=false
+export RUN_CHECK_DEPS=false
+export RUN_IWYU=true
+export GOAL="codegen"
+export BITCOIN_CONFIG="\
+ --preset dev-mode -DBUILD_GUI=OFF \
+ -DCMAKE_C_COMPILER=clang-${TIDY_LLVM_V} \
+ -DCMAKE_CXX_COMPILER=clang++-${TIDY_LLVM_V} \
+"
diff --git a/ci/test/00_setup_env_native_msan.sh b/ci/test/00_setup_env_native_msan.sh
new file mode 100755
index 00000000..c0559fc6
--- /dev/null
+++ b/ci/test/00_setup_env_native_msan.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2020-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
+export APT_LLVM_V="21"
+LIBCXX_DIR="/cxx_build/"
+export MSAN_FLAGS="-fsanitize=memory -fsanitize-memory-track-origins=2 -fno-omit-frame-pointer -g -O1 -fno-optimize-sibling-calls"
+LIBCXX_FLAGS="-nostdinc++ -nostdlib++ -isystem ${LIBCXX_DIR}include/c++/v1 -L${LIBCXX_DIR}lib -Wl,-rpath,${LIBCXX_DIR}lib -lc++ -lc++abi -lpthread -Wno-unused-command-line-argument"
+export MSAN_AND_LIBCXX_FLAGS="${MSAN_FLAGS} ${LIBCXX_FLAGS}"
+
+export CONTAINER_NAME="ci_native_msan"
+export PACKAGES="clang-${APT_LLVM_V} llvm-${APT_LLVM_V} llvm-${APT_LLVM_V}-dev libclang-${APT_LLVM_V}-dev libclang-rt-${APT_LLVM_V}-dev python3-pip"
+export PIP_PACKAGES="--break-system-packages pycapnp"
+export DEP_OPTS="DEBUG=1 NO_QT=1 CC=clang CXX=clang++ CFLAGS='${MSAN_FLAGS}' CXXFLAGS='${MSAN_AND_LIBCXX_FLAGS}'"
+export GOAL="install"
+export CI_LIMIT_STACK_SIZE=1
+# Setting CMAKE_{C,CXX}_FLAGS_DEBUG flags to an empty string ensures that the flags set in MSAN_FLAGS remain unaltered.
+# _FORTIFY_SOURCE is not compatible with MSAN.
+export BITCOIN_CONFIG="\
+ --preset=dev-mode \
+ -DBUILD_GUI=OFF \
+ -DCMAKE_BUILD_TYPE=Debug \
+ -DCMAKE_C_FLAGS_DEBUG='' \
+ -DCMAKE_CXX_FLAGS_DEBUG='' \
+ -DSANITIZERS=memory \
+ -DAPPEND_CPPFLAGS='-U_FORTIFY_SOURCE' \
+"
+export USE_INSTRUMENTED_LIBCPP="MemoryWithOrigins"
diff --git a/ci/test/00_setup_env_native_nowallet.sh b/ci/test/00_setup_env_native_nowallet.sh
new file mode 100755
index 00000000..28446a70
--- /dev/null
+++ b/ci/test/00_setup_env_native_nowallet.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME=ci_native_nowallet
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
+# Use minimum supported python3.10 (or best-effort 3.12) and clang-17, see doc/dependencies.md
+export PACKAGES="python3-zmq python3-pip clang-17 llvm-17 libc++abi-17-dev libc++-17-dev"
+export PIP_PACKAGES="--break-system-packages pycapnp"
+export DEP_OPTS="NO_WALLET=1 CC=clang-17 CXX='clang++-17 -stdlib=libc++'"
+export GOAL="install"
+export BITCOIN_CONFIG="\
+  --preset=dev-mode \
+  -DREDUCE_EXPORTS=ON \
+  -DENABLE_WALLET=OFF \
+"
diff --git a/ci/test/00_setup_env_native_previous_releases.sh b/ci/test/00_setup_env_native_previous_releases.sh
new file mode 100755
index 00000000..a44a51c3
--- /dev/null
+++ b/ci/test/00_setup_env_native_previous_releases.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME=ci_native_previous_releases
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:22.04"
+# Use minimum supported python3.10 and gcc-12, see doc/dependencies.md
+export PACKAGES="gcc-12 g++-12 python3-zmq"
+export DEP_OPTS="CC=gcc-12 CXX=g++-12"
+export TEST_RUNNER_EXTRA="--previous-releases --coverage --extended --exclude feature_dbcrash"  # Run extended tests so that coverage does not fail, but exclude the very slow dbcrash
+export GOAL="install"
+export CI_LIMIT_STACK_SIZE=1
+export DOWNLOAD_PREVIOUS_RELEASES="true"
+export BITCOIN_CONFIG="\
+ --preset=dev-mode \
+ -DREDUCE_EXPORTS=ON \
+ -DCMAKE_BUILD_TYPE=Debug \
+ -DCMAKE_C_FLAGS='-funsigned-char' \
+ -DCMAKE_C_FLAGS_DEBUG='-g2 -O2' \
+ -DCMAKE_CXX_FLAGS='-funsigned-char' \
+ -DCMAKE_CXX_FLAGS_DEBUG='-g2 -O2' \
+ -DAPPEND_CPPFLAGS='-DBOOST_MULTI_INDEX_ENABLE_SAFE_MODE' \
+"
diff --git a/ci/test/00_setup_env_native_tidy.sh b/ci/test/00_setup_env_native_tidy.sh
new file mode 100755
index 00000000..04f3e2e7
--- /dev/null
+++ b/ci/test/00_setup_env_native_tidy.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
+export CONTAINER_NAME=ci_native_tidy
+export TIDY_LLVM_V="21"
+export APT_LLVM_V="${TIDY_LLVM_V}"
+export PACKAGES="clang-${TIDY_LLVM_V} libclang-${TIDY_LLVM_V}-dev llvm-${TIDY_LLVM_V}-dev libomp-${TIDY_LLVM_V}-dev clang-tidy-${TIDY_LLVM_V} jq libevent-dev libboost-dev libzmq3-dev systemtap-sdt-dev qt6-base-dev qt6-tools-dev qt6-l10n-tools libqrencode-dev libsqlite3-dev libcapnp-dev capnproto"
+export NO_DEPENDS=1
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export RUN_FUZZ_TESTS=false
+export RUN_CHECK_DEPS=true
+export RUN_TIDY=true
+export GOAL="install"
+export BITCOIN_CONFIG="\
+ --preset dev-mode \
+ -DCMAKE_C_COMPILER=clang-${TIDY_LLVM_V} \
+ -DCMAKE_CXX_COMPILER=clang++-${TIDY_LLVM_V} \
+ -DCMAKE_C_FLAGS_RELWITHDEBINFO='-O0 -g0' \
+ -DCMAKE_CXX_FLAGS_RELWITHDEBINFO='-O0 -g0' \
+"
diff --git a/ci/test/00_setup_env_native_tsan.sh b/ci/test/00_setup_env_native_tsan.sh
new file mode 100755
index 00000000..b0429ce8
--- /dev/null
+++ b/ci/test/00_setup_env_native_tsan.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME=ci_native_tsan
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
+export APT_LLVM_V="21"
+LIBCXX_DIR="/cxx_build/"
+LIBCXX_FLAGS="-fsanitize=thread -nostdinc++ -nostdlib++ -isystem ${LIBCXX_DIR}include/c++/v1 -L${LIBCXX_DIR}lib -Wl,-rpath,${LIBCXX_DIR}lib -lc++ -lc++abi -lpthread -Wno-unused-command-line-argument"
+export PACKAGES="clang-${APT_LLVM_V} llvm-${APT_LLVM_V} llvm-${APT_LLVM_V}-dev libclang-${APT_LLVM_V}-dev libclang-rt-${APT_LLVM_V}-dev python3-zmq python3-pip"
+export PIP_PACKAGES="--break-system-packages pycapnp"
+export DEP_OPTS="CC=clang CXX=clang++ CXXFLAGS='${LIBCXX_FLAGS}' NO_QT=1"
+export GOAL="install"
+export CI_LIMIT_STACK_SIZE=1
+export BITCOIN_CONFIG="\
+  --preset=dev-mode \
+  -DBUILD_GUI=OFF \
+  -DSANITIZERS=thread \
+  -DAPPEND_CPPFLAGS='-DARENA_DEBUG -DDEBUG_LOCKCONTENTION -D_LIBCPP_REMOVE_TRANSITIVE_INCLUDES' \
+"
+export USE_INSTRUMENTED_LIBCPP="Thread"
diff --git a/ci/test/00_setup_env_native_valgrind.sh b/ci/test/00_setup_env_native_valgrind.sh
new file mode 100755
index 00000000..30c84bf4
--- /dev/null
+++ b/ci/test/00_setup_env_native_valgrind.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"
+export CONTAINER_NAME=ci_native_valgrind
+export PACKAGES="valgrind python3-zmq libevent-dev libboost-dev libzmq3-dev libsqlite3-dev libcapnp-dev capnproto python3-pip"
+export PIP_PACKAGES="--break-system-packages pycapnp"
+export USE_VALGRIND=1
+export NO_DEPENDS=1
+# bind tests excluded for now, see https://github.com/bitcoin/bitcoin/issues/17765#issuecomment-602068547
+export TEST_RUNNER_EXTRA="--exclude rpc_bind --exclude feature_bind_extra"
+export GOAL="install"
+# TODO enable GUI
+export BITCOIN_CONFIG="\
+  --preset=dev-mode \
+ -DBUILD_GUI=OFF \
+ -DWITH_USDT=OFF \
+"
diff --git a/ci/test/00_setup_env_s390x.sh b/ci/test/00_setup_env_s390x.sh
new file mode 100755
index 00000000..d1e34070
--- /dev/null
+++ b/ci/test/00_setup_env_s390x.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export HOST=s390x-linux-gnu
+export PACKAGES="python3-zmq"
+export CONTAINER_NAME=ci_s390x
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"
+export CI_IMAGE_PLATFORM="linux/s390x"
+# bind tests excluded for now, see https://github.com/bitcoin/bitcoin/issues/17765#issuecomment-602068547
+export TEST_RUNNER_EXTRA="--exclude rpc_bind --exclude feature_bind_extra"
+export RUN_FUNCTIONAL_TESTS=true
+export GOAL="install"
+export BITCOIN_CONFIG="\
+  --preset=dev-mode \
+  -DREDUCE_EXPORTS=ON \
+"
diff --git a/ci/test/00_setup_env_win64.sh b/ci/test/00_setup_env_win64.sh
new file mode 100755
index 00000000..dbbf55c1
--- /dev/null
+++ b/ci/test/00_setup_env_win64.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2025-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME=ci_win64
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"  # Check that https://packages.debian.org/trixie/g++-mingw-w64-ucrt64 can cross-compile
+export HOST=x86_64-w64-mingw32ucrt
+export PACKAGES="g++-mingw-w64-ucrt64 nsis"
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export GOAL="deploy"
+export BITCOIN_CONFIG="\
+  --preset=dev-mode \
+  -DENABLE_IPC=OFF \
+  -DWITH_USDT=OFF \
+  -DREDUCE_EXPORTS=ON \
+  -DCMAKE_CXX_FLAGS='-Wno-error=maybe-uninitialized' \
+"
diff --git a/ci/test/00_setup_env_win64_msvcrt.sh b/ci/test/00_setup_env_win64_msvcrt.sh
new file mode 100755
index 00000000..6c948aeb
--- /dev/null
+++ b/ci/test/00_setup_env_win64_msvcrt.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+export CONTAINER_NAME=ci_win64_msvcrt
+export CI_IMAGE_NAME_TAG="mirror.gcr.io/debian:trixie"  # Check that https://packages.debian.org/trixie/g++-mingw-w64-x86-64-posix (version 14.x, similar to guix) can cross-compile
+export HOST=x86_64-w64-mingw32
+export PACKAGES="g++-mingw-w64-x86-64-posix nsis"
+export RUN_UNIT_TESTS=false
+export RUN_FUNCTIONAL_TESTS=false
+export GOAL="deploy"
+export BITCOIN_CONFIG="\
+  --preset=dev-mode \
+  -DENABLE_IPC=OFF \
+  -DWITH_USDT=OFF \
+  -DREDUCE_EXPORTS=ON \
+  -DCMAKE_CXX_FLAGS='-Wno-error=maybe-uninitialized' \
+"
diff --git a/ci/test/01_base_install.sh b/ci/test/01_base_install.sh
new file mode 100755
index 00000000..0ac56208
--- /dev/null
+++ b/ci/test/01_base_install.sh
@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2018-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+set -o errexit -o pipefail -o xtrace
+
+CFG_DONE="${BASE_ROOT_DIR}/ci.base-install-done"  # Use a global setting to remember whether this script ran to avoid running it twice
+
+if [ "$( cat "${CFG_DONE}" || true )" == "done" ]; then
+  echo "Skip base install"
+  exit 0
+fi
+
+MAKEJOBS="-j$( nproc )"  # Use nproc, because MAKEJOBS is the default in docker image builds.
+
+if [ -n "$DPKG_ADD_ARCH" ]; then
+  dpkg --add-architecture "$DPKG_ADD_ARCH"
+fi
+
+if [ -n "${APT_LLVM_V}" ]; then
+  ${CI_RETRY_EXE} apt-get update
+  ${CI_RETRY_EXE} apt-get install curl -y
+  curl "https://apt.llvm.org/llvm-snapshot.gpg.key" | tee "/etc/apt/trusted.gpg.d/apt.llvm.org.asc"
+  (
+    # shellcheck disable=SC2034
+    source /etc/os-release
+    echo "deb http://apt.llvm.org/${VERSION_CODENAME}/ llvm-toolchain-${VERSION_CODENAME}-${APT_LLVM_V} main" > "/etc/apt/sources.list.d/llvm-toolchain-${VERSION_CODENAME}-${APT_LLVM_V}.list"
+  )
+fi
+
+if [[ $CI_IMAGE_NAME_TAG == *alpine* ]]; then
+  ${CI_RETRY_EXE} apk update
+  # shellcheck disable=SC2086
+  ${CI_RETRY_EXE} apk add --no-cache $CI_BASE_PACKAGES $PACKAGES
+elif [ "$CI_OS_NAME" != "macos" ]; then
+  if [[ -n "${APPEND_APT_SOURCES_LIST}" ]]; then
+    echo "${APPEND_APT_SOURCES_LIST}" >> /etc/apt/sources.list
+  fi
+  ${CI_RETRY_EXE} apt-get update
+  # shellcheck disable=SC2086
+  ${CI_RETRY_EXE} apt-get install --no-install-recommends --no-upgrade -y $PACKAGES $CI_BASE_PACKAGES
+fi
+
+if [ -n "${APT_LLVM_V}" ]; then
+  update-alternatives --install /usr/bin/clang++ clang++ "/usr/bin/clang++-${APT_LLVM_V}" 100
+  update-alternatives --install /usr/bin/clang clang "/usr/bin/clang-${APT_LLVM_V}" 100
+  update-alternatives --install /usr/bin/llvm-symbolizer llvm-symbolizer "/usr/bin/llvm-symbolizer-${APT_LLVM_V}" 100
+fi
+
+if [ -n "$PIP_PACKAGES" ]; then
+  # shellcheck disable=SC2086
+  ${CI_RETRY_EXE} pip3 install --user $PIP_PACKAGES
+fi
+
+if [[ -n "${USE_INSTRUMENTED_LIBCPP}" ]]; then
+  ${CI_RETRY_EXE} git clone --depth=1 https://github.com/llvm/llvm-project -b "llvmorg-21.1.5" /llvm-project
+
+  cmake -G Ninja -B /cxx_build/ \
+    -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi;libunwind" \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DLLVM_USE_SANITIZER="${USE_INSTRUMENTED_LIBCPP}" \
+    -DCMAKE_C_COMPILER=clang \
+    -DCMAKE_CXX_COMPILER=clang++ \
+    -DLLVM_TARGETS_TO_BUILD=Native \
+    -DLLVM_ENABLE_PER_TARGET_RUNTIME_DIR=OFF \
+    -DLIBCXXABI_USE_LLVM_UNWINDER=OFF \
+    -DLIBCXX_ABI_DEFINES="_LIBCPP_ABI_BOUNDED_ITERATORS;_LIBCPP_ABI_BOUNDED_ITERATORS_IN_STD_ARRAY;_LIBCPP_ABI_BOUNDED_ITERATORS_IN_STRING;_LIBCPP_ABI_BOUNDED_ITERATORS_IN_VECTOR;_LIBCPP_ABI_BOUNDED_UNIQUE_PTR" \
+    -DLIBCXX_HARDENING_MODE=debug \
+    -S /llvm-project/runtimes
+
+  ninja -C /cxx_build/ "$MAKEJOBS"
+
+  # Clear no longer needed source folder
+  du -sh /llvm-project
+  rm -rf /llvm-project
+fi
+
+if [[ "${RUN_IWYU}" == true ]]; then
+  ${CI_RETRY_EXE} git clone --depth=1 https://github.com/include-what-you-use/include-what-you-use -b clang_"${TIDY_LLVM_V}" /include-what-you-use
+  (cd /include-what-you-use && patch -p1 < /ci_container_base/ci/test/01_iwyu.patch)
+  cmake -B /iwyu-build/ -G 'Unix Makefiles' -DCMAKE_PREFIX_PATH=/usr/lib/llvm-"${TIDY_LLVM_V}" -S /include-what-you-use
+  make -C /iwyu-build/ install "$MAKEJOBS"
+fi
+
+mkdir -p "${DEPENDS_DIR}/SDKs" "${DEPENDS_DIR}/sdk-sources"
+
+OSX_SDK_BASENAME="Xcode-${XCODE_VERSION}-${XCODE_BUILD_ID}-extracted-SDK-with-libcxx-headers"
+
+if [ -n "$XCODE_VERSION" ] && [ ! -d "${DEPENDS_DIR}/SDKs/${OSX_SDK_BASENAME}" ]; then
+  OSX_SDK_FILENAME="${OSX_SDK_BASENAME}.tar"
+  OSX_SDK_PATH="${DEPENDS_DIR}/sdk-sources/${OSX_SDK_FILENAME}"
+  if [ ! -f "$OSX_SDK_PATH" ]; then
+    ${CI_RETRY_EXE} curl --location --fail "${SDK_URL}/${OSX_SDK_FILENAME}" -o "$OSX_SDK_PATH"
+  fi
+  tar -C "${DEPENDS_DIR}/SDKs" -xf "$OSX_SDK_PATH"
+fi
+
+echo -n "done" > "${CFG_DONE}"
diff --git a/ci/test/01_iwyu.patch b/ci/test/01_iwyu.patch
new file mode 100644
index 00000000..e14316bf
--- /dev/null
+++ b/ci/test/01_iwyu.patch
@@ -0,0 +1,598 @@
+Prefer angled brackets over quotes for include directives.
+See: https://en.cppreference.com/w/cpp/preprocessor/include.html.
+
+--- a/iwyu_path_util.cc
++++ b/iwyu_path_util.cc
+@@ -211,7 +211,7 @@ bool IsQuotedInclude(const string& s) {
+ }
+
+ string AddQuotes(string include_name, bool angled) {
+-  if (angled) {
++  if (true) {
+       return "<" + include_name + ">";
+   }
+   return "\"" + include_name + "\"";
+
+
+Prefer C++ headers over C counterparts.
+See: https://github.com/include-what-you-use/include-what-you-use/blob/clang_21/iwyu_include_picker.cc#L587-L629.
+
+--- a/iwyu_include_picker.cc
++++ b/iwyu_include_picker.cc
+@@ -100,20 +100,20 @@ const IncludeMapEntry libc_symbol_map[] = {
+   // equal.  The visibility on the symbol-name is ignored; by convention
+   // we always set it to kPrivate.
+   { "_POSIX_VDISABLE", kPrivate, "<unistd.h>", kPublic },
+-  { "abort", kPrivate, "<stdlib.h>", kPublic },
++  { "abort", kPrivate, "<stdlib.h>", kPrivate },
+   { "aiocb", kPrivate, "<aio.h>", kPublic },
+   { "blkcnt_t", kPrivate, "<sys/types.h>", kPublic },
+   { "blksize_t", kPrivate, "<sys/types.h>", kPublic },
+   { "cc_t", kPrivate, "<termios.h>", kPublic },
+-  { "clock_t", kPrivate, "<time.h>", kPublic },
++  { "clock_t", kPrivate, "<time.h>", kPrivate },
+   { "clock_t", kPrivate, "<sys/types.h>", kPublic },
+   { "clockid_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "ctermid", kPrivate, "<stdio.h>", kPublic },
++  { "ctermid", kPrivate, "<stdio.h>", kPrivate },
+   { "daddr_t", kPrivate, "<sys/types.h>", kPublic },
+   { "dev_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "div_t", kPrivate, "<stdlib.h>", kPublic },
+-  { "double_t", kPrivate, "<math.h>", kPublic },
+-  { "error_t", kPrivate, "<errno.h>", kPublic },
++  { "div_t", kPrivate, "<stdlib.h>", kPrivate },
++  { "double_t", kPrivate, "<math.h>", kPrivate },
++  { "error_t", kPrivate, "<errno.h>", kPrivate },
+   { "error_t", kPrivate, "<argp.h>", kPublic },
+   { "error_t", kPrivate, "<argz.h>", kPublic },
+   { "FD_CLR", kPrivate, "<sys/select.h>", kPublic },
+@@ -122,10 +122,10 @@ const IncludeMapEntry libc_symbol_map[] = {
+   { "fd_set", kPrivate, "<sys/select.h>", kPublic },
+   { "FD_SETSIZE", kPrivate, "<sys/select.h>", kPublic },
+   { "FD_ZERO", kPrivate, "<sys/select.h>", kPublic },
+-  { "fenv_t", kPrivate, "<fenv.h>", kPublic },
+-  { "fexcept_t", kPrivate, "<fenv.h>", kPublic },
+-  { "FILE", kPrivate, "<stdio.h>", kPublic },
+-  { "float_t", kPrivate, "<math.h>", kPublic },
++  { "fenv_t", kPrivate, "<fenv.h>", kPrivate },
++  { "fexcept_t", kPrivate, "<fenv.h>", kPrivate },
++  { "FILE", kPrivate, "<stdio.h>", kPrivate },
++  { "float_t", kPrivate, "<math.h>", kPrivate },
+   { "fsblkcnt_t", kPrivate, "<sys/types.h>", kPublic },
+   { "fsfilcnt_t", kPrivate, "<sys/types.h>", kPublic },
+   { "getopt", kPrivate, "<unistd.h>", kPublic },
+@@ -135,31 +135,31 @@ const IncludeMapEntry libc_symbol_map[] = {
+   { "in_addr_t", kPrivate, "<netinet/in.h>", kPublic },
+   { "in_port_t", kPrivate, "<netinet/in.h>", kPublic },
+   { "id_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "imaxdiv_t", kPrivate, "<inttypes.h>", kPublic },
+-  { "intmax_t", kPrivate, "<stdint.h>", kPublic },
+-  { "uintmax_t", kPrivate, "<stdint.h>", kPublic },
++  { "imaxdiv_t", kPrivate, "<inttypes.h>", kPrivate },
++  { "intmax_t", kPrivate, "<stdint.h>", kPrivate },
++  { "uintmax_t", kPrivate, "<stdint.h>", kPrivate },
+   { "ino64_t", kPrivate, "<sys/types.h>", kPublic },
+   { "ino_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "int8_t", kPrivate, "<stdint.h>", kPublic },
+-  { "int16_t", kPrivate, "<stdint.h>", kPublic },
+-  { "int32_t", kPrivate, "<stdint.h>", kPublic },
+-  { "int64_t", kPrivate, "<stdint.h>", kPublic },
+-  { "uint8_t", kPrivate, "<stdint.h>", kPublic },
+-  { "uint16_t", kPrivate, "<stdint.h>", kPublic },
+-  { "uint32_t", kPrivate, "<stdint.h>", kPublic },
+-  { "uint64_t", kPrivate, "<stdint.h>", kPublic },
+-  { "intptr_t", kPrivate, "<stdint.h>", kPublic },
+-  { "uintptr_t", kPrivate, "<stdint.h>", kPublic },
++  { "int8_t", kPrivate, "<stdint.h>", kPrivate },
++  { "int16_t", kPrivate, "<stdint.h>", kPrivate },
++  { "int32_t", kPrivate, "<stdint.h>", kPrivate },
++  { "int64_t", kPrivate, "<stdint.h>", kPrivate },
++  { "uint8_t", kPrivate, "<stdint.h>", kPrivate },
++  { "uint16_t", kPrivate, "<stdint.h>", kPrivate },
++  { "uint32_t", kPrivate, "<stdint.h>", kPrivate },
++  { "uint64_t", kPrivate, "<stdint.h>", kPrivate },
++  { "intptr_t", kPrivate, "<stdint.h>", kPrivate },
++  { "uintptr_t", kPrivate, "<stdint.h>", kPrivate },
+   { "iovec", kPrivate, "<sys/uio.h>", kPublic },
+-  { "itimerspec", kPrivate, "<time.h>", kPublic },
++  { "itimerspec", kPrivate, "<time.h>", kPrivate },
+   { "key_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "L_ctermid", kPrivate, "<stdio.h>", kPublic },
+-  { "lconv", kPrivate, "<locale.h>", kPublic },
+-  { "ldiv_t", kPrivate, "<stdlib.h>", kPublic },
+-  { "lldiv_t", kPrivate, "<stdlib.h>", kPublic },
+-  { "locale_t", kPrivate, "<locale.h>", kPublic },
+-  { "max_align_t", kPrivate, "<stddef.h>", kPublic },
+-  { "mbstate_t", kPrivate, "<wchar.h>", kPublic },
++  { "L_ctermid", kPrivate, "<stdio.h>", kPrivate },
++  { "lconv", kPrivate, "<locale.h>", kPrivate },
++  { "ldiv_t", kPrivate, "<stdlib.h>", kPrivate },
++  { "lldiv_t", kPrivate, "<stdlib.h>", kPrivate },
++  { "locale_t", kPrivate, "<locale.h>", kPrivate },
++  { "max_align_t", kPrivate, "<stddef.h>", kPrivate },
++  { "mbstate_t", kPrivate, "<wchar.h>", kPrivate },
+   { "mcontext_t", kPrivate, "<ucontext.h>", kPublic },
+   { "mode_t", kPrivate, "<sys/types.h>", kPublic },
+   { "nl_item", kPrivate, "<nl_types.h>", kPublic },
+@@ -175,8 +175,8 @@ const IncludeMapEntry libc_symbol_map[] = {
+   { "optind", kPrivate, "<unistd.h>", kPublic },
+   { "optopt", kPrivate, "<unistd.h>", kPublic },
+   { "pid_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "posix_memalign", kPrivate, "<stdlib.h>", kPublic },
+-  { "printf", kPrivate, "<stdio.h>", kPublic },
++  { "posix_memalign", kPrivate, "<stdlib.h>", kPrivate },
++  { "printf", kPrivate, "<stdio.h>", kPrivate },
+   { "pthread_attr_t", kPrivate, "<pthread.h>", kPublic },
+   { "pthread_cond_t", kPrivate, "<pthread.h>", kPublic },
+   { "pthread_condattr_t", kPrivate, "<pthread.h>", kPublic },
+@@ -187,7 +187,7 @@ const IncludeMapEntry libc_symbol_map[] = {
+   { "pthread_rwlock_t", kPrivate, "<pthread.h>", kPublic },
+   { "pthread_rwlockattr_t", kPrivate, "<pthread.h>", kPublic },
+   { "pthread_t", kPrivate, "<pthread.h>", kPublic },
+-  { "ptrdiff_t", kPrivate, "<stddef.h>", kPublic },
++  { "ptrdiff_t", kPrivate, "<stddef.h>", kPrivate },
+   { "regex_t", kPrivate, "<regex.h>", kPublic },
+   { "regmatch_t", kPrivate, "<regex.h>", kPublic },
+   { "regoff_t", kPrivate, "<regex.h>", kPublic },
+@@ -218,51 +218,51 @@ const IncludeMapEntry libc_symbol_map[] = {
+   { "SCHED_FIFO", kPrivate, "<sched.h>", kPublic },
+   { "SCHED_OTHER", kPrivate, "<sched.h>", kPublic },
+   { "SCHED_RR", kPrivate, "<sched.h>", kPublic },
+-  { "SEEK_CUR", kPrivate, "<stdio.h>", kPublic },
+-  { "SEEK_END", kPrivate, "<stdio.h>", kPublic },
+-  { "SEEK_SET", kPrivate, "<stdio.h>", kPublic },
+-  { "sig_atomic_t", kPrivate, "<signal.h>", kPublic },
+-  { "sigevent", kPrivate, "<signal.h>", kPublic },
+-  { "siginfo_t", kPrivate, "<signal.h>", kPublic },
+-  { "sigset_t", kPrivate, "<signal.h>", kPublic },
+-  { "sigval", kPrivate, "<signal.h>", kPublic },
++  { "SEEK_CUR", kPrivate, "<stdio.h>", kPrivate },
++  { "SEEK_END", kPrivate, "<stdio.h>", kPrivate },
++  { "SEEK_SET", kPrivate, "<stdio.h>", kPrivate },
++  { "sig_atomic_t", kPrivate, "<signal.h>", kPrivate },
++  { "sigevent", kPrivate, "<signal.h>", kPrivate },
++  { "siginfo_t", kPrivate, "<signal.h>", kPrivate },
++  { "sigset_t", kPrivate, "<signal.h>", kPrivate },
++  { "sigval", kPrivate, "<signal.h>", kPrivate },
+   { "sockaddr", kPrivate, "<sys/socket.h>", kPublic },
+   { "socklen_t", kPrivate, "<sys/socket.h>", kPublic },
+   { "ssize_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "stack_t", kPrivate, "<signal.h>", kPublic },
++  { "stack_t", kPrivate, "<signal.h>", kPrivate },
+   { "stat", kPrivate, "<sys/stat.h>", kPublic },
+   { "suseconds_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "time_t", kPrivate, "<time.h>", kPublic },
++  { "time_t", kPrivate, "<time.h>", kPrivate },
+   { "time_t", kPrivate, "<sys/types.h>", kPublic },
+   { "timer_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "timespec", kPrivate, "<time.h>", kPublic },
++  { "timespec", kPrivate, "<time.h>", kPrivate },
+   { "timeval", kPrivate, "<sys/time.h>", kPublic },
+-  { "tm", kPrivate, "<time.h>", kPublic },
++  { "tm", kPrivate, "<time.h>", kPrivate },
+   { "u_char", kPrivate, "<sys/types.h>", kPublic },
+   { "ucontext_t", kPrivate, "<ucontext.h>", kPublic },
+   { "uid_t", kPrivate, "<sys/types.h>", kPublic },
+   { "useconds_t", kPrivate, "<sys/types.h>", kPublic },
+-  { "wchar_t", kPrivate, "<stddef.h>", kPublic },
+-  { "wctrans_t", kPrivate, "<wctype.h>", kPublic },
+-  { "wctype_t", kPrivate, "<wctype.h>", kPublic },
++  { "wchar_t", kPrivate, "<stddef.h>", kPrivate },
++  { "wctrans_t", kPrivate, "<wctype.h>", kPrivate },
++  { "wctype_t", kPrivate, "<wctype.h>", kPrivate },
+   { "winsize", kPrivate, "<termios.h>", kPublic },
+-  { "wint_t", kPrivate, "<wchar.h>", kPublic },
++  { "wint_t", kPrivate, "<wchar.h>", kPrivate },
+   // It is unspecified if the cname headers provide ::size_t.
+   // <locale.h> is the one header which defines NULL but not size_t.
+-  { "size_t", kPrivate, "<stddef.h>", kPublic },  // 'canonical' location for size_t
+-  { "size_t", kPrivate, "<signal.h>", kPublic },
+-  { "size_t", kPrivate, "<stdio.h>", kPublic },
+-  { "size_t", kPrivate, "<stdlib.h>", kPublic },
+-  { "size_t", kPrivate, "<string.h>", kPublic },
+-  { "size_t", kPrivate, "<time.h>", kPublic },
+-  { "size_t", kPrivate, "<uchar.h>", kPublic },
+-  { "size_t", kPrivate, "<wchar.h>", kPublic },
++  { "size_t", kPrivate, "<stddef.h>", kPrivate },  // 'canonical' location for size_t
++  { "size_t", kPrivate, "<signal.h>", kPrivate },
++  { "size_t", kPrivate, "<stdio.h>", kPrivate },
++  { "size_t", kPrivate, "<stdlib.h>", kPrivate },
++  { "size_t", kPrivate, "<string.h>", kPrivate },
++  { "size_t", kPrivate, "<time.h>", kPrivate },
++  { "size_t", kPrivate, "<uchar.h>", kPrivate },
++  { "size_t", kPrivate, "<wchar.h>", kPrivate },
+   // Macros that can be defined in more than one file, don't have the
+   // same __foo_defined guard that other types do, so the grep above
+   // doesn't discover them.  Until I figure out a better way, I just
+   // add them in by hand as I discover them.
+-  { "EOF", kPrivate, "<stdio.h>", kPublic },
+-  { "FILE", kPrivate, "<stdio.h>", kPublic },
++  { "EOF", kPrivate, "<stdio.h>", kPrivate },
++  { "FILE", kPrivate, "<stdio.h>", kPrivate },
+   { "IBSHIFT", kPrivate, "<asm/termbits.h>", kPublic },
+   { "MAP_POPULATE", kPrivate, "<sys/mman.h>", kPublic },
+   { "MAP_POPULATE", kPrivate, "<linux/mman.h>", kPublic },
+@@ -270,22 +270,22 @@ const IncludeMapEntry libc_symbol_map[] = {
+   { "MAP_STACK", kPrivate, "<linux/mman.h>", kPublic },
+   { "MAXHOSTNAMELEN", kPrivate, "<sys/param.h>", kPublic },
+   { "MAXHOSTNAMELEN", kPrivate, "<protocols/timed.h>", kPublic },
+-  { "SIGABRT", kPrivate, "<signal.h>", kPublic },
+-  { "SIGCHLD", kPrivate, "<signal.h>", kPublic },
+-  { "va_arg", kPrivate, "<stdarg.h>", kPublic },
+-  { "va_copy", kPrivate, "<stdarg.h>", kPublic },
+-  { "va_end", kPrivate, "<stdarg.h>", kPublic },
+-  { "va_list", kPrivate, "<stdarg.h>", kPublic },
+-  { "va_start", kPrivate, "<stdarg.h>", kPublic },
+-  { "WEOF", kPrivate, "<wchar.h>", kPublic },
++  { "SIGABRT", kPrivate, "<signal.h>", kPrivate },
++  { "SIGCHLD", kPrivate, "<signal.h>", kPrivate },
++  { "va_arg", kPrivate, "<stdarg.h>", kPrivate },
++  { "va_copy", kPrivate, "<stdarg.h>", kPrivate },
++  { "va_end", kPrivate, "<stdarg.h>", kPrivate },
++  { "va_list", kPrivate, "<stdarg.h>", kPrivate },
++  { "va_start", kPrivate, "<stdarg.h>", kPrivate },
++  { "WEOF", kPrivate, "<wchar.h>", kPrivate },
+   // These are symbols that could be defined in either stdlib.h or
+   // malloc.h, but we always want the stdlib location.
+-  { "malloc", kPrivate, "<stdlib.h>", kPublic },
+-  { "calloc", kPrivate, "<stdlib.h>", kPublic },
+-  { "realloc", kPrivate, "<stdlib.h>", kPublic },
+-  { "free", kPrivate, "<stdlib.h>", kPublic },
++  { "malloc", kPrivate, "<stdlib.h>", kPrivate },
++  { "calloc", kPrivate, "<stdlib.h>", kPrivate },
++  { "realloc", kPrivate, "<stdlib.h>", kPrivate },
++  { "free", kPrivate, "<stdlib.h>", kPrivate },
+   // Entries for NULL
+-  { "NULL", kPrivate, "<stddef.h>", kPublic },  // 'canonical' location for NULL
++  { "NULL", kPrivate, "<stddef.h>", kPrivate },  // 'canonical' location for NULL
+   { "NULL", kPrivate, "<clocale>", kPublic },
+   { "NULL", kPrivate, "<cstddef>", kPublic },
+   { "NULL", kPrivate, "<cstdio>", kPublic },
+@@ -293,13 +293,13 @@ const IncludeMapEntry libc_symbol_map[] = {
+   { "NULL", kPrivate, "<cstring>", kPublic },
+   { "NULL", kPrivate, "<ctime>", kPublic },
+   { "NULL", kPrivate, "<cwchar>", kPublic },
+-  { "NULL", kPrivate, "<locale.h>", kPublic },
+-  { "NULL", kPrivate, "<stdio.h>", kPublic },
+-  { "NULL", kPrivate, "<stdlib.h>", kPublic },
+-  { "NULL", kPrivate, "<string.h>", kPublic },
+-  { "NULL", kPrivate, "<time.h>", kPublic },
+-  { "NULL", kPrivate, "<wchar.h>", kPublic },
+-  { "offsetof", kPrivate, "<stddef.h>", kPublic },
++  { "NULL", kPrivate, "<locale.h>", kPrivate },
++  { "NULL", kPrivate, "<stdio.h>", kPrivate },
++  { "NULL", kPrivate, "<stdlib.h>", kPrivate },
++  { "NULL", kPrivate, "<string.h>", kPrivate },
++  { "NULL", kPrivate, "<time.h>", kPrivate },
++  { "NULL", kPrivate, "<wchar.h>", kPrivate },
++  { "offsetof", kPrivate, "<stddef.h>", kPrivate },
+ };
+ 
+ // Common kludges for C++ standard libraries
+@@ -355,7 +355,7 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/a.out.h>", kPrivate, "<a.out.h>", kPublic },
+   { "<bits/auxv.h>", kPrivate, "<sys/auxv.h>", kPublic },
+   { "<bits/byteswap.h>", kPrivate, "<byteswap.h>", kPublic },
+-  { "<bits/cmathcalls.h>", kPrivate, "<complex.h>", kPublic },
++  { "<bits/cmathcalls.h>", kPrivate, "<complex.h>", kPrivate },
+   { "<bits/confname.h>", kPrivate, "<unistd.h>", kPublic },
+   { "<bits/dirent.h>", kPrivate, "<dirent.h>", kPublic },
+   { "<bits/dlfcn.h>", kPrivate, "<dlfcn.h>", kPublic },
+@@ -363,18 +363,18 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/endian.h>", kPrivate, "<endian.h>", kPublic },
+   { "<bits/environments.h>", kPrivate, "<unistd.h>", kPublic },
+   { "<bits/epoll.h>", kPrivate, "<sys/epoll.h>", kPublic },
+-  { "<bits/errno.h>", kPrivate, "<errno.h>", kPublic },
++  { "<bits/errno.h>", kPrivate, "<errno.h>", kPrivate },
+   { "<bits/error.h>", kPrivate, "<error.h>", kPublic },
+   { "<bits/eventfd.h>", kPrivate, "<sys/eventfd.h>", kPublic },
+   { "<bits/fcntl.h>", kPrivate, "<fcntl.h>", kPublic },
+   { "<bits/fcntl2.h>", kPrivate, "<fcntl.h>", kPublic },
+-  { "<bits/fenv.h>", kPrivate, "<fenv.h>", kPublic },
+-  { "<bits/fenvinline.h>", kPrivate, "<fenv.h>", kPublic },
+-  { "<bits/huge_val.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/huge_valf.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/huge_vall.h>", kPrivate, "<math.h>", kPublic },
++  { "<bits/fenv.h>", kPrivate, "<fenv.h>", kPrivate },
++  { "<bits/fenvinline.h>", kPrivate, "<fenv.h>", kPrivate },
++  { "<bits/huge_val.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/huge_valf.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/huge_vall.h>", kPrivate, "<math.h>", kPrivate },
+   { "<bits/hwcap.h>", kPrivate, "<sys/auxv.h>", kPublic },
+-  { "<bits/inf.h>", kPrivate, "<math.h>", kPublic },
++  { "<bits/inf.h>", kPrivate, "<math.h>", kPrivate },
+   { "<bits/inotify.h>", kPrivate, "<sys/inotify.h>", kPublic },
+   { "<bits/ioctl-types.h>", kPrivate, "<sys/ioctl.h>", kPublic },
+   { "<bits/ioctls.h>", kPrivate, "<sys/ioctl.h>", kPublic },
+@@ -382,24 +382,24 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/ipctypes.h>", kPrivate, "<sys/ipc.h>", kPublic },
+   { "<bits/libio-ldbl.h>", kPrivate, "<libio.h>", kPublic },
+   { "<bits/link.h>", kPrivate, "<link.h>", kPublic },
+-  { "<bits/locale.h>", kPrivate, "<locale.h>", kPublic },
+-  { "<bits/math-finite.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/mathcalls.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/mathdef.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/mathinline.h>", kPrivate, "<math.h>", kPublic },
++  { "<bits/locale.h>", kPrivate, "<locale.h>", kPrivate },
++  { "<bits/math-finite.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/mathcalls.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/mathdef.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/mathinline.h>", kPrivate, "<math.h>", kPrivate },
+   { "<bits/mman.h>", kPrivate, "<sys/mman.h>", kPublic },
+   { "<bits/mman-shared.h>", kPrivate, "<sys/mman.h>", kPublic },
+   { "<bits/monetary-ldbl.h>", kPrivate, "<monetary.h>", kPublic },
+   { "<bits/mqueue.h>", kPrivate, "<mqueue.h>", kPublic },
+   { "<bits/mqueue2.h>", kPrivate, "<mqueue.h>", kPublic },
+   { "<bits/msq.h>", kPrivate, "<sys/msg.h>", kPublic },
+-  { "<bits/nan.h>", kPrivate, "<math.h>", kPublic },
++  { "<bits/nan.h>", kPrivate, "<math.h>", kPrivate },
+   { "<bits/netdb.h>", kPrivate, "<netdb.h>", kPublic },
+   { "<bits/param.h>", kPrivate, "<sys/param.h>", kPublic },
+   { "<bits/poll.h>", kPrivate, "<sys/poll.h>", kPrivate },
+   { "<bits/poll2.h>", kPrivate, "<sys/poll.h>", kPrivate },
+-  { "<bits/posix1_lim.h>", kPrivate, "<limits.h>", kPublic },
+-  { "<bits/posix2_lim.h>", kPrivate, "<limits.h>", kPublic },
++  { "<bits/posix1_lim.h>", kPrivate, "<limits.h>", kPrivate },
++  { "<bits/posix2_lim.h>", kPrivate, "<limits.h>", kPrivate },
+   { "<bits/posix_opt.h>", kPrivate, "<unistd.h>", kPublic },
+   { "<bits/printf-ldbl.h>", kPrivate, "<printf.h>", kPublic },
+   { "<bits/pthreadtypes.h>", kPrivate, "<pthread.h>", kPublic },
+@@ -409,17 +409,17 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/select2.h>", kPrivate, "<sys/select.h>", kPublic },
+   { "<bits/sem.h>", kPrivate, "<sys/sem.h>", kPublic },
+   { "<bits/semaphore.h>", kPrivate, "<semaphore.h>", kPublic },
+-  { "<bits/setjmp.h>", kPrivate, "<setjmp.h>", kPublic },
+-  { "<bits/setjmp2.h>", kPrivate, "<setjmp.h>", kPublic },
++  { "<bits/setjmp.h>", kPrivate, "<setjmp.h>", kPrivate },
++  { "<bits/setjmp2.h>", kPrivate, "<setjmp.h>", kPrivate },
+   { "<bits/shm.h>", kPrivate, "<sys/shm.h>", kPublic },
+-  { "<bits/sigaction.h>", kPrivate, "<signal.h>", kPublic },
+-  { "<bits/sigcontext.h>", kPrivate, "<signal.h>", kPublic },
+-  { "<bits/siginfo.h>", kPrivate, "<signal.h>", kPublic },
+-  { "<bits/signum.h>", kPrivate, "<signal.h>", kPublic },
+-  { "<bits/signum-arch.h>", kPrivate, "<signal.h>", kPublic },
+-  { "<bits/sigset.h>", kPrivate, "<signal.h>", kPublic },
+-  { "<bits/sigstack.h>", kPrivate, "<signal.h>", kPublic },
+-  { "<bits/sigthread.h>", kPrivate, "<signal.h>", kPublic },
++  { "<bits/sigaction.h>", kPrivate, "<signal.h>", kPrivate },
++  { "<bits/sigcontext.h>", kPrivate, "<signal.h>", kPrivate },
++  { "<bits/siginfo.h>", kPrivate, "<signal.h>", kPrivate },
++  { "<bits/signum.h>", kPrivate, "<signal.h>", kPrivate },
++  { "<bits/signum-arch.h>", kPrivate, "<signal.h>", kPrivate },
++  { "<bits/sigset.h>", kPrivate, "<signal.h>", kPrivate },
++  { "<bits/sigstack.h>", kPrivate, "<signal.h>", kPrivate },
++  { "<bits/sigthread.h>", kPrivate, "<signal.h>", kPrivate },
+   { "<bits/sockaddr.h>", kPrivate, "<sys/un.h>", kPublic },
+   { "<bits/socket.h>", kPrivate, "<sys/socket.h>", kPublic },
+   { "<bits/socket2.h>", kPrivate, "<sys/socket.h>", kPublic },
+@@ -429,22 +429,22 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/statfs.h>", kPrivate, "<sys/statfs.h>", kPublic },
+   { "<bits/statvfs.h>", kPrivate, "<sys/statvfs.h>", kPublic },
+   { "<bits/statx-generic.h>", kPrivate, "<sys/stat.h>", kPublic },
+-  { "<bits/stdio-ldbl.h>", kPrivate, "<stdio.h>", kPublic },
++  { "<bits/stdio-ldbl.h>", kPrivate, "<stdio.h>", kPrivate },
+   { "<bits/stdio-lock.h>", kPrivate, "<libio.h>", kPublic },
+-  { "<bits/stdio.h>", kPrivate, "<stdio.h>", kPublic },
+-  { "<bits/stdio2.h>", kPrivate, "<stdio.h>", kPublic },
+-  { "<bits/stdio_lim.h>", kPrivate, "<stdio.h>", kPublic },
+-  { "<bits/stdlib-bsearch.h>", kPrivate, "<stdlib.h>", kPublic },
+-  { "<bits/stdlib-float.h>", kPrivate, "<stdlib.h>", kPublic },
+-  { "<bits/stdlib-ldbl.h>", kPrivate, "<stdlib.h>", kPublic },
+-  { "<bits/stdlib.h>", kPrivate, "<stdlib.h>", kPublic },
+-  { "<bits/string.h>", kPrivate, "<string.h>", kPublic },
+-  { "<bits/string2.h>", kPrivate, "<string.h>", kPublic },
+-  { "<bits/string3.h>", kPrivate, "<string.h>", kPublic },
++  { "<bits/stdio.h>", kPrivate, "<stdio.h>", kPrivate },
++  { "<bits/stdio2.h>", kPrivate, "<stdio.h>", kPrivate },
++  { "<bits/stdio_lim.h>", kPrivate, "<stdio.h>", kPrivate },
++  { "<bits/stdlib-bsearch.h>", kPrivate, "<stdlib.h>", kPrivate },
++  { "<bits/stdlib-float.h>", kPrivate, "<stdlib.h>", kPrivate },
++  { "<bits/stdlib-ldbl.h>", kPrivate, "<stdlib.h>", kPrivate },
++  { "<bits/stdlib.h>", kPrivate, "<stdlib.h>", kPrivate },
++  { "<bits/string.h>", kPrivate, "<string.h>", kPrivate },
++  { "<bits/string2.h>", kPrivate, "<string.h>", kPrivate },
++  { "<bits/string3.h>", kPrivate, "<string.h>", kPrivate },
+   { "<bits/stropts.h>", kPrivate, "<stropts.h>", kPublic },
+   { "<bits/struct_stat.h>", kPrivate, "<sys/stat.h>", kPublic },
+   { "<bits/struct_stat.h>", kPrivate, "<ftw.h>", kPublic },
+-  { "<bits/sys_errlist.h>", kPrivate, "<stdio.h>", kPublic },
++  { "<bits/sys_errlist.h>", kPrivate, "<stdio.h>", kPrivate },
+   { "<bits/syscall.h>", kPrivate, "<sys/syscall.h>", kPublic },
+   { "<bits/sysctl.h>", kPrivate, "<sys/sysctl.h>", kPublic },
+   { "<bits/syslog-ldbl.h>", kPrivate, "<sys/syslog.h>", kPrivate },
+@@ -459,12 +459,12 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/termios-struct.h>", kPrivate, "<termios.h>", kPublic },
+   { "<bits/termios-tcflow.h>", kPrivate, "<termios.h>", kPublic },
+   { "<bits/termios.h>", kPrivate, "<termios.h>", kPublic },
+-  { "<bits/time.h>", kPrivate, "<time.h>", kPublic },
++  { "<bits/time.h>", kPrivate, "<time.h>", kPrivate },
+   { "<bits/time.h>", kPrivate, "<sys/time.h>", kPublic },
+   { "<bits/timerfd.h>", kPrivate, "<sys/timerfd.h>", kPublic },
+   { "<bits/timex.h>", kPrivate, "<sys/timex.h>", kPublic },
+   { "<bits/types.h>", kPrivate, "<sys/types.h>", kPublic },
+-  { "<bits/types/siginfo_t.h>", kPrivate, "<signal.h>", kPublic },
++  { "<bits/types/siginfo_t.h>", kPrivate, "<signal.h>", kPrivate },
+   { "<bits/types/siginfo_t.h>", kPrivate, "<sys/wait.h>", kPublic },
+   { "<bits/uio.h>", kPrivate, "<sys/uio.h>", kPublic },
+   { "<bits/unistd.h>", kPrivate, "<unistd.h>", kPublic },
+@@ -474,11 +474,11 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/utsname.h>", kPrivate, "<sys/utsname.h>", kPublic },
+   { "<bits/waitflags.h>", kPrivate, "<sys/wait.h>", kPublic },
+   { "<bits/waitstatus.h>", kPrivate, "<sys/wait.h>", kPublic },
+-  { "<bits/wchar-ldbl.h>", kPrivate, "<wchar.h>", kPublic },
+-  { "<bits/wchar.h>", kPrivate, "<wchar.h>", kPublic },
+-  { "<bits/wchar2.h>", kPrivate, "<wchar.h>", kPublic },
+-  { "<bits/wordsize.h>", kPrivate, "<limits.h>", kPublic },
+-  { "<bits/xopen_lim.h>", kPrivate, "<limits.h>", kPublic },
++  { "<bits/wchar-ldbl.h>", kPrivate, "<wchar.h>", kPrivate },
++  { "<bits/wchar.h>", kPrivate, "<wchar.h>", kPrivate },
++  { "<bits/wchar2.h>", kPrivate, "<wchar.h>", kPrivate },
++  { "<bits/wordsize.h>", kPrivate, "<limits.h>", kPrivate },
++  { "<bits/xopen_lim.h>", kPrivate, "<limits.h>", kPrivate },
+   { "<bits/xtitypes.h>", kPrivate, "<stropts.h>", kPublic },
+   // Sometimes libc tells you what mapping to do via an '#error':
+   // # error "Never use <bits/dlfcn.h> directly; include <dlfcn.h> instead."
+@@ -488,7 +488,7 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/a.out.h>", kPrivate, "<a.out.h>", kPublic },
+   { "<bits/byteswap-16.h>", kPrivate, "<byteswap.h>", kPublic },
+   { "<bits/byteswap.h>", kPrivate, "<byteswap.h>", kPublic },
+-  { "<bits/cmathcalls.h>", kPrivate, "<complex.h>", kPublic },
++  { "<bits/cmathcalls.h>", kPrivate, "<complex.h>", kPrivate },
+   { "<bits/confname.h>", kPrivate, "<unistd.h>", kPublic },
+   { "<bits/dirent.h>", kPrivate, "<dirent.h>", kPublic },
+   { "<bits/dlfcn.h>", kPrivate, "<dlfcn.h>", kPublic },
+@@ -498,38 +498,38 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<bits/eventfd.h>", kPrivate, "<sys/eventfd.h>", kPublic },
+   { "<bits/fcntl-linux.h>", kPrivate, "<fcntl.h>", kPublic },
+   { "<bits/fcntl.h>", kPrivate, "<fcntl.h>", kPublic },
+-  { "<bits/fenv.h>", kPrivate, "<fenv.h>", kPublic },
+-  { "<bits/huge_val.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/huge_valf.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/huge_vall.h>", kPrivate, "<math.h>", kPublic },
++  { "<bits/fenv.h>", kPrivate, "<fenv.h>", kPrivate },
++  { "<bits/huge_val.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/huge_valf.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/huge_vall.h>", kPrivate, "<math.h>", kPrivate },
+   { "<bits/in.h>", kPrivate, "<netinet/in.h>", kPublic },
+-  { "<bits/inf.h>", kPrivate, "<math.h>", kPublic },
++  { "<bits/inf.h>", kPrivate, "<math.h>", kPrivate },
+   { "<bits/inotify.h>", kPrivate, "<sys/inotify.h>", kPublic },
+   { "<bits/ioctl-types.h>", kPrivate, "<sys/ioctl.h>", kPublic },
+   { "<bits/ioctls.h>", kPrivate, "<sys/ioctl.h>", kPublic },
+   { "<bits/ipc.h>", kPrivate, "<sys/ipc.h>", kPublic },
+   { "<bits/ipctypes.h>", kPrivate, "<sys/ipc.h>", kPublic },
+-  { "<bits/locale.h>", kPrivate, "<locale.h>", kPublic },
+-  { "<bits/math-finite.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/mathdef.h>", kPrivate, "<math.h>", kPublic },
+-  { "<bits/mathinline.h>", kPrivate, "<math.h>", kPublic },
++  { "<bits/locale.h>", kPrivate, "<locale.h>", kPrivate },
++  { "<bits/math-finite.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/mathdef.h>", kPrivate, "<math.h>", kPrivate },
++  { "<bits/mathinline.h>", kPrivate, "<math.h>", kPrivate },
+   { "<bits/mman-linux.h>", kPrivate, "<sys/mman.h>", kPublic },
+   { "<bits/mman.h>", kPrivate, "<sys/mman.h>", kPublic },
+   { "<bits/mqueue.h>", kPrivate, "<mqueue.h>", kPublic },
+   { "<bits/msq.h>", kPrivate, "<sys/msg.h>", kPublic },
+-  { "<bits/nan.h>", kPrivate, "<math.h>", kPublic },
++  { "<bits/nan.h>", kPrivate, "<math.h>", kPrivate },
+   { "<bits/param.h>", kPrivate, "<sys/param.h>", kPublic },
+   { "<bits/poll.h>", kPrivate, "<sys/poll.h>", kPrivate },
+   { "<bits/predefs.h>", kPrivate, "<features.h>", kPublic },
+   { "<bits/resource.h>", kPrivate, "<sys/resource.h>", kPublic },
+   { "<bits/select.h>", kPrivate, "<sys/select.h>", kPublic },
+   { "<bits/semaphore.h>", kPrivate, "<semaphore.h>", kPublic },
+-  { "<bits/sigcontext.h>", kPrivate, "<signal.h>", kPublic },
++  { "<bits/sigcontext.h>", kPrivate, "<signal.h>", kPrivate },
+   { "<bits/signalfd.h>", kPrivate, "<sys/signalfd.h>", kPublic },
+-  { "<bits/stdlib-float.h>", kPrivate, "<stdlib.h>", kPublic },
+-  { "<bits/string.h>", kPrivate, "<string.h>", kPublic },
+-  { "<bits/string2.h>", kPrivate, "<string.h>", kPublic },
+-  { "<bits/string3.h>", kPrivate, "<string.h>", kPublic },
++  { "<bits/stdlib-float.h>", kPrivate, "<stdlib.h>", kPrivate },
++  { "<bits/string.h>", kPrivate, "<string.h>", kPrivate },
++  { "<bits/string2.h>", kPrivate, "<string.h>", kPrivate },
++  { "<bits/string3.h>", kPrivate, "<string.h>", kPrivate },
+   { "<bits/timerfd.h>", kPrivate, "<sys/timerfd.h>", kPublic },
+   { "<bits/typesizes.h>", kPrivate, "<sys/types.h>", kPublic },
+   // Top-level #includes that just forward to another file:
+@@ -541,13 +541,13 @@ const IncludeMapEntry libc_include_map[] = {
+   // on the POSIX.1-2024 list, I just choose the top-level one.
+   { "<sys/aio.h>", kPrivate, "<aio.h>", kPublic },
+   { "<sys/dirent.h>", kPrivate, "<dirent.h>", kPublic },
+-  { "<sys/errno.h>", kPrivate, "<errno.h>", kPublic },
++  { "<sys/errno.h>", kPrivate, "<errno.h>", kPrivate },
+   { "<sys/fcntl.h>", kPrivate, "<fcntl.h>", kPublic },
+   { "<sys/poll.h>", kPrivate, "<poll.h>", kPublic },
+   { "<sys/semaphore.h>", kPrivate, "<semaphore.h>", kPublic },
+-  { "<sys/signal.h>", kPrivate, "<signal.h>", kPublic },
++  { "<sys/signal.h>", kPrivate, "<signal.h>", kPrivate },
+   { "<sys/spawn.h>", kPrivate, "<spawn.h>", kPublic },
+-  { "<sys/stdio.h>", kPrivate, "<stdio.h>", kPublic },
++  { "<sys/stdio.h>", kPrivate, "<stdio.h>", kPrivate },
+   { "<sys/syslog.h>", kPrivate, "<syslog.h>", kPublic },
+   { "<sys/termios.h>", kPrivate, "<termios.h>", kPublic },
+   { "<sys/unistd.h>", kPrivate, "<unistd.h>", kPublic },
+@@ -567,21 +567,21 @@ const IncludeMapEntry libc_include_map[] = {
+   { "<asm/unistd_64.h>", kPrivate, "<asm/unistd.h>", kPrivate },
+   // I don't know what grep would have found these.  I found them
+   // via user report.
+-  { "<asm/errno.h>", kPrivate, "<errno.h>", kPublic },
+-  { "<asm/errno-base.h>", kPrivate, "<errno.h>", kPublic },
++  { "<asm/errno.h>", kPrivate, "<errno.h>", kPrivate },
++  { "<asm/errno-base.h>", kPrivate, "<errno.h>", kPrivate },
+   { "<asm/ptrace-abi.h>", kPrivate, "<asm/ptrace.h>", kPublic },
+   { "<asm/unistd.h>", kPrivate, "<sys/syscall.h>", kPublic },
+-  { "<linux/limits.h>", kPrivate, "<limits.h>", kPublic },   // PATH_MAX
++  { "<linux/limits.h>", kPrivate, "<limits.h>", kPrivate },   // PATH_MAX
+   { "<linux/prctl.h>", kPrivate, "<sys/prctl.h>", kPublic },
+   { "<sys/ucontext.h>", kPrivate, "<ucontext.h>", kPublic },
+   // System headers available on AIX, BSD, Solaris and other Unix systems
+   { "<sys/dtrace.h>", kPrivate, "<dtrace.h>", kPublic },
+   { "<sys/paths.h>", kPrivate, "<paths.h>", kPublic },
+-  { "<sys/syslimits.h>", kPrivate, "<limits.h>", kPublic },
++  { "<sys/syslimits.h>", kPrivate, "<limits.h>", kPrivate },
+   { "<sys/ttycom.h>", kPrivate, "<sys/ioctl.h>", kPublic },
+   { "<sys/ustat.h>", kPrivate, "<ustat.h>", kPublic },
+   // Exports guaranteed by the C standard
+-  { "<stdint.h>", kPublic, "<inttypes.h>", kPublic },
++  { "<stdint.h>", kPrivate, "<inttypes.h>", kPrivate },
+ };
+ 
+ const IncludeMapEntry stdlib_c_include_map[] = {
+@@ -601,31 +601,31 @@ const IncludeMapEntry stdlib_c_include_map[] = {
+   //
+   // $ curl -s -N https://raw.githubusercontent.com/cplusplus/draft/c%2B%2B20/source/lib-intro.tex | sed -n '/begin{multicolfloattable}.*{headers.cpp.c}/,/end{multicolfloattable}/p' | grep tcode | perl -nle 'm/tcode{<c(.*)>}/ && print qq@  { "<$1.h>", kPublic, "<c$1>", kPublic },@' | sort
+   { "<assert.h>", kPublic, "<cassert>", kPublic },
+-  { "<complex.h>", kPublic, "<ccomplex>", kPublic },
+-  { "<ctype.h>", kPublic, "<cctype>", kPublic },
+-  { "<errno.h>", kPublic, "<cerrno>", kPublic },
+-  { "<fenv.h>", kPublic, "<cfenv>", kPublic },
+-  { "<float.h>", kPublic, "<cfloat>", kPublic },
+-  { "<inttypes.h>", kPublic, "<cinttypes>", kPublic },
+-  { "<iso646.h>", kPublic, "<ciso646>", kPublic },
+-  { "<limits.h>", kPublic, "<climits>", kPublic },
+-  { "<locale.h>", kPublic, "<clocale>", kPublic },
+-  { "<math.h>", kPublic, "<cmath>", kPublic },
+-  { "<setjmp.h>", kPublic, "<csetjmp>", kPublic },
+-  { "<signal.h>", kPublic, "<csignal>", kPublic },
+-  { "<stdalign.h>", kPublic, "<cstdalign>", kPublic },
+-  { "<stdarg.h>", kPublic, "<cstdarg>", kPublic },
+-  { "<stdbool.h>", kPublic, "<cstdbool>", kPublic },
+-  { "<stddef.h>", kPublic, "<cstddef>", kPublic },
+-  { "<stdint.h>", kPublic, "<cstdint>", kPublic },
+-  { "<stdio.h>", kPublic, "<cstdio>", kPublic },
+-  { "<stdlib.h>", kPublic, "<cstdlib>", kPublic },
+-  { "<string.h>", kPublic, "<cstring>", kPublic },
+-  { "<tgmath.h>", kPublic, "<ctgmath>", kPublic },
+-  { "<time.h>", kPublic, "<ctime>", kPublic },
+-  { "<uchar.h>", kPublic, "<cuchar>", kPublic },
+-  { "<wchar.h>", kPublic, "<cwchar>", kPublic },
+-  { "<wctype.h>", kPublic, "<cwctype>", kPublic },
++  { "<complex.h>", kPrivate, "<ccomplex>", kPublic },
++  { "<ctype.h>", kPrivate, "<cctype>", kPublic },
++  { "<errno.h>", kPrivate, "<cerrno>", kPublic },
++  { "<fenv.h>", kPrivate, "<cfenv>", kPublic },
++  { "<float.h>", kPrivate, "<cfloat>", kPublic },
++  { "<inttypes.h>", kPrivate, "<cinttypes>", kPublic },
++  { "<iso646.h>", kPrivate, "<ciso646>", kPublic },
++  { "<limits.h>", kPrivate, "<climits>", kPublic },
++  { "<locale.h>", kPrivate, "<clocale>", kPublic },
++  { "<math.h>", kPrivate, "<cmath>", kPublic },
++  { "<setjmp.h>", kPrivate, "<csetjmp>", kPublic },
++  { "<signal.h>", kPrivate, "<csignal>", kPublic },
++  { "<stdalign.h>", kPrivate, "<cstdalign>", kPublic },
++  { "<stdarg.h>", kPrivate, "<cstdarg>", kPublic },
++  { "<stdbool.h>", kPrivate, "<cstdbool>", kPublic },
++  { "<stddef.h>", kPrivate, "<cstddef>", kPublic },
++  { "<stdint.h>", kPrivate, "<cstdint>", kPublic },
++  { "<stdio.h>", kPrivate, "<cstdio>", kPublic },
++  { "<stdlib.h>", kPrivate, "<cstdlib>", kPublic },
++  { "<string.h>", kPrivate, "<cstring>", kPublic },
++  { "<tgmath.h>", kPrivate, "<ctgmath>", kPublic },
++  { "<time.h>", kPrivate, "<ctime>", kPublic },
++  { "<uchar.h>", kPrivate, "<cuchar>", kPublic },
++  { "<wchar.h>", kPrivate, "<cwchar>", kPublic },
++  { "<wctype.h>", kPrivate, "<cwctype>", kPublic },
+ };
+ 
+ const char* stdlib_cpp_public_headers[] = {
diff --git a/ci/test/02_run_container.py b/ci/test/02_run_container.py
new file mode 100755
index 00000000..64077c4b
--- /dev/null
+++ b/ci/test/02_run_container.py
@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+# Copyright (c) The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+from pathlib import Path
+import os
+import shlex
+import subprocess
+import sys
+import time
+
+
+def run(cmd, **kwargs):
+    print("+ " + shlex.join(cmd), flush=True)
+    kwargs.setdefault("check", True)
+    try:
+        return subprocess.run(cmd, **kwargs)
+    except Exception as e:
+        sys.exit(e)
+
+
+def main():
+    print("Export only allowed settings:")
+    settings = run(
+        ["bash", "-c", "grep export ./ci/test/00_setup_env*.sh"],
+        stdout=subprocess.PIPE,
+        text=True,
+    ).stdout.splitlines()
+    settings = set(l.split("=")[0].split("export ")[1] for l in settings)
+    # Add "hidden" settings, which are never exported, manually. Otherwise,
+    # they will not be passed on.
+    settings.update([
+        "BASE_BUILD_DIR",
+        "CI_FAILFAST_TEST_LEAVE_DANGLING",
+    ])
+
+    # Append $USER to /tmp/env to support multi-user systems and $CONTAINER_NAME
+    # to allow support starting multiple runs simultaneously by the same user.
+    env_file = "/tmp/env-{u}-{c}".format(
+        u=os.environ["USER"],
+        c=os.environ["CONTAINER_NAME"],
+    )
+    with open(env_file, "w") as file:
+        for k, v in os.environ.items():
+            if k in settings:
+                file.write(f"{k}={v}\n")
+    run(["cat", env_file])
+
+    if os.getenv("DANGER_RUN_CI_ON_HOST"):
+        print("Running on host system without docker wrapper")
+        print("Create missing folders")
+        for create_dir in [
+                os.environ["CCACHE_DIR"],
+                os.environ["PREVIOUS_RELEASES_DIR"],
+        ]:
+            Path(create_dir).mkdir(parents=True, exist_ok=True)
+
+        # Modify PATH to prepend the retry script, needed for CI_RETRY_EXE
+        os.environ["PATH"] = f"{os.environ['BASE_ROOT_DIR']}/ci/retry:{os.environ['PATH']}"
+        # GNU getopt is required for the CI_RETRY_EXE script
+        if os.getenv("CI_OS_NAME") == "macos":
+            prefix = run(
+                ["brew", "--prefix", "gnu-getopt"],
+                stdout=subprocess.PIPE,
+                text=True,
+            ).stdout.strip()
+            os.environ["IN_GETOPT_BIN"] = f"{prefix}/bin/getopt"
+    else:
+        CI_IMAGE_LABEL = "bitcoin-ci-test"
+
+        # Use buildx unconditionally
+        # Using buildx is required to properly load the correct driver, for use with registry caching. Neither build, nor BUILDKIT=1 currently do this properly
+        cmd_build = ["docker", "buildx", "build"]
+        cmd_build += [
+            f"--file={os.environ['BASE_READ_ONLY_DIR']}/ci/test_imagefile",
+            f"--build-arg=CI_IMAGE_NAME_TAG={os.environ['CI_IMAGE_NAME_TAG']}",
+            f"--build-arg=FILE_ENV={os.environ['FILE_ENV']}",
+            f"--build-arg=BASE_ROOT_DIR={os.environ['BASE_ROOT_DIR']}",
+            f"--platform={os.environ['CI_IMAGE_PLATFORM']}",
+            f"--label={CI_IMAGE_LABEL}",
+            f"--tag={os.environ['CONTAINER_NAME']}",
+        ]
+        cmd_build += shlex.split(os.getenv("DOCKER_BUILD_CACHE_ARG", ""))
+        cmd_build += [os.environ["BASE_READ_ONLY_DIR"]]
+
+        print(f"Building {os.environ['CONTAINER_NAME']} image tag to run in")
+        if run(cmd_build, check=False).returncode != 0:
+            print(f"Retry building {os.environ['CONTAINER_NAME']} image tag after failure")
+            time.sleep(3)
+            run(cmd_build)
+
+        for suffix in ["ccache", "depends", "depends_sources", "previous_releases"]:
+            run(["docker", "volume", "create", f"{os.environ['CONTAINER_NAME']}_{suffix}"], check=False)
+
+        CI_CCACHE_MOUNT = f"type=volume,src={os.environ['CONTAINER_NAME']}_ccache,dst={os.environ['CCACHE_DIR']}"
+        CI_DEPENDS_MOUNT = f"type=volume,src={os.environ['CONTAINER_NAME']}_depends,dst={os.environ['DEPENDS_DIR']}/built"
+        CI_DEPENDS_SOURCES_MOUNT = f"type=volume,src={os.environ['CONTAINER_NAME']}_depends_sources,dst={os.environ['DEPENDS_DIR']}/sources"
+        CI_PREVIOUS_RELEASES_MOUNT = f"type=volume,src={os.environ['CONTAINER_NAME']}_previous_releases,dst={os.environ['PREVIOUS_RELEASES_DIR']}"
+        CI_BUILD_MOUNT = []
+
+        if os.getenv("DANGER_CI_ON_HOST_FOLDERS"):
+            # ensure the directories exist
+            for create_dir in [
+                    os.environ["CCACHE_DIR"],
+                    f"{os.environ['DEPENDS_DIR']}/built",
+                    f"{os.environ['DEPENDS_DIR']}/sources",
+                    os.environ["PREVIOUS_RELEASES_DIR"],
+                    os.environ["BASE_BUILD_DIR"],  # Unset by default, must be defined externally
+            ]:
+                Path(create_dir).mkdir(parents=True, exist_ok=True)
+
+            CI_CCACHE_MOUNT = f"type=bind,src={os.environ['CCACHE_DIR']},dst={os.environ['CCACHE_DIR']}"
+            CI_DEPENDS_MOUNT = f"type=bind,src={os.environ['DEPENDS_DIR']}/built,dst={os.environ['DEPENDS_DIR']}/built"
+            CI_DEPENDS_SOURCES_MOUNT = f"type=bind,src={os.environ['DEPENDS_DIR']}/sources,dst={os.environ['DEPENDS_DIR']}/sources"
+            CI_PREVIOUS_RELEASES_MOUNT = f"type=bind,src={os.environ['PREVIOUS_RELEASES_DIR']},dst={os.environ['PREVIOUS_RELEASES_DIR']}"
+            CI_BUILD_MOUNT = [f"--mount=type=bind,src={os.environ['BASE_BUILD_DIR']},dst={os.environ['BASE_BUILD_DIR']}"]
+
+        if os.getenv("DANGER_CI_ON_HOST_CCACHE_FOLDER"):
+            if not os.path.isdir(os.environ["CCACHE_DIR"]):
+                print(f"Error: Directory '{os.environ['CCACHE_DIR']}' must be created in advance.")
+                sys.exit(1)
+            CI_CCACHE_MOUNT = f"type=bind,src={os.environ['CCACHE_DIR']},dst={os.environ['CCACHE_DIR']}"
+
+        run(["docker", "network", "create", "--ipv6", "--subnet", "1111:1111::/112", "ci-ip6net"], check=False)
+
+        if os.getenv("RESTART_CI_DOCKER_BEFORE_RUN"):
+            print("Restart docker before run to stop and clear all containers started with --rm")
+            run(["podman", "container", "rm", "--force", "--all"])  # Similar to "systemctl restart docker"
+
+            # Still prune everything in case the filtered pruning doesn't work, or if labels were not set
+            # on a previous run. Belt and suspenders approach, should be fine to remove in the future.
+            # Prune images used by --external containers (e.g. build containers) when
+            # using podman.
+            print("Prune all dangling images")
+            run(["podman", "image", "prune", "--force", "--external"])
+
+        print(f"Prune all dangling {CI_IMAGE_LABEL} images")
+        # When detecting podman-docker, `--external` should be added.
+        run(["docker", "image", "prune", "--force", "--filter", f"label={CI_IMAGE_LABEL}"])
+
+        cmd_run = ["docker", "run", "--rm", "--interactive", "--detach", "--tty"]
+        cmd_run += [
+            "--cap-add=LINUX_IMMUTABLE",
+            *shlex.split(os.getenv("CI_CONTAINER_CAP", "")),
+            f"--mount=type=bind,src={os.environ['BASE_READ_ONLY_DIR']},dst={os.environ['BASE_READ_ONLY_DIR']},readonly",
+            f"--mount={CI_CCACHE_MOUNT}",
+            f"--mount={CI_DEPENDS_MOUNT}",
+            f"--mount={CI_DEPENDS_SOURCES_MOUNT}",
+            f"--mount={CI_PREVIOUS_RELEASES_MOUNT}",
+            *CI_BUILD_MOUNT,
+            f"--env-file={env_file}",
+            f"--name={os.environ['CONTAINER_NAME']}",
+            "--network=ci-ip6net",
+            f"--platform={os.environ['CI_IMAGE_PLATFORM']}",
+            os.environ["CONTAINER_NAME"],
+        ]
+
+        container_id = run(
+            cmd_run,
+            stdout=subprocess.PIPE,
+            text=True,
+        ).stdout.strip()
+
+    def ci_exec(cmd_inner, **kwargs):
+        if os.getenv("DANGER_RUN_CI_ON_HOST"):
+            prefix = []
+        else:
+            prefix = ["docker", "exec", container_id]
+
+        return run([*prefix, *cmd_inner], **kwargs)
+
+    # Normalize all folders to BASE_ROOT_DIR
+    ci_exec([
+        "rsync",
+        "--recursive",
+        "--perms",
+        "--stats",
+        "--human-readable",
+        f"{os.environ['BASE_READ_ONLY_DIR']}/",
+        f"{os.environ['BASE_ROOT_DIR']}",
+    ])
+    ci_exec([f"{os.environ['BASE_ROOT_DIR']}/ci/test/01_base_install.sh"])
+    ci_exec([f"{os.environ['BASE_ROOT_DIR']}/ci/test/03_test_script.sh"])
+
+    if not os.getenv("DANGER_RUN_CI_ON_HOST"):
+        print("Stop and remove CI container by ID")
+        run(["docker", "container", "kill", container_id])
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ci/test/03_test_script.sh b/ci/test/03_test_script.sh
new file mode 100755
index 00000000..050d9e6a
--- /dev/null
+++ b/ci/test/03_test_script.sh
@@ -0,0 +1,254 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2018-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+set -ex
+
+cd "${BASE_ROOT_DIR}"
+
+export PATH="/path_with space:${PATH}"
+export ASAN_OPTIONS="detect_leaks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1"
+export LSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/lsan"
+export TSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/tsan:halt_on_error=1:second_deadlock_stack=1"
+export UBSAN_OPTIONS="suppressions=${BASE_ROOT_DIR}/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1"
+
+echo "Number of available processing units: $(nproc)"
+if [ "$CI_OS_NAME" == "macos" ]; then
+  top -l 1 -s 0 | awk ' /PhysMem/ {print}'
+else
+  free -m -h
+  echo "System info: $(uname --kernel-name --kernel-release)"
+  lscpu
+fi
+echo "Free disk space:"
+df -h
+
+# We force an install of linux-headers again here via $PACKAGES to fix any
+# kernel mismatch between a cached docker image and the underlying host.
+# This can happen occasionally on hosted runners if the runner image is updated.
+if [[ "$CONTAINER_NAME" == "ci_native_asan" ]]; then
+  $CI_RETRY_EXE apt-get update
+  ${CI_RETRY_EXE} bash -c "apt-get install --no-install-recommends --no-upgrade -y $PACKAGES"
+fi
+
+# What host to compile for. See also ./depends/README.md
+# Tests that need cross-compilation export the appropriate HOST.
+# Tests that run natively guess the host
+export HOST=${HOST:-$("$BASE_ROOT_DIR/depends/config.guess")}
+
+echo "=== BEGIN env ==="
+env
+echo "=== END env ==="
+
+# Don't apply patches in the iwyu job, because it relies on the `git diff`
+# command to detect IWYU errors. It is safe to skip this patch in the iwyu job
+# because it doesn't run a UB detector.
+if [[ "${RUN_IWYU}" != true ]]; then
+  # compact->outputs[i].file_size is uninitialized memory, so reading it is UB.
+  # The statistic bytes_written is only used for logging, which is disabled in
+  # CI, so as a temporary minimal fix to work around UB and CI failures, leave
+  # bytes_written unmodified.
+  # See https://github.com/bitcoin/bitcoin/pull/28359#issuecomment-1698694748
+  # Tee patch to stdout to make it clear CI is testing modified code.
+  tee >(patch -p1) <<'EOF'
+--- a/src/leveldb/db/db_impl.cc
++++ b/src/leveldb/db/db_impl.cc
+@@ -1028,9 +1028,6 @@ Status DBImpl::DoCompactionWork(CompactionState* compact) {
+       stats.bytes_read += compact->compaction->input(which, i)->file_size;
+     }
+   }
+-  for (size_t i = 0; i < compact->outputs.size(); i++) {
+-    stats.bytes_written += compact->outputs[i].file_size;
+-  }
+
+   mutex_.Lock();
+   stats_[compact->compaction->level() + 1].Add(stats);
+EOF
+fi
+
+if [ "$RUN_FUZZ_TESTS" = "true" ]; then
+  export DIR_FUZZ_IN=${DIR_QA_ASSETS}/fuzz_corpora/
+  if [ ! -d "$DIR_FUZZ_IN" ]; then
+    ${CI_RETRY_EXE} git clone --depth=1 https://github.com/bitcoin-core/qa-assets "${DIR_QA_ASSETS}"
+  fi
+  (
+    cd "${DIR_QA_ASSETS}"
+    echo "Using qa-assets repo from commit ..."
+    git log -1
+  )
+elif [ "$RUN_UNIT_TESTS" = "true" ]; then
+  export DIR_UNIT_TEST_DATA=${DIR_QA_ASSETS}/unit_test_data/
+  if [ ! -d "$DIR_UNIT_TEST_DATA" ]; then
+    mkdir -p "$DIR_UNIT_TEST_DATA"
+    ${CI_RETRY_EXE} curl --location --fail https://github.com/bitcoin-core/qa-assets/raw/main/unit_test_data/script_assets_test.json -o "${DIR_UNIT_TEST_DATA}/script_assets_test.json"
+  fi
+fi
+
+# Make sure default datadir does not exist and is never read by creating a dummy file
+if [ "$CI_OS_NAME" == "macos" ]; then
+  echo > "${HOME}/Library/Application Support/Bitcoin"
+else
+  echo > "${HOME}/.bitcoin"
+fi
+
+if [ -z "$NO_DEPENDS" ]; then
+  if [[ $CI_IMAGE_NAME_TAG == *alpine* ]]; then
+    SHELL_OPTS="CONFIG_SHELL=/usr/bin/dash"
+  else
+    SHELL_OPTS="CONFIG_SHELL="
+  fi
+  bash -c "$SHELL_OPTS make $MAKEJOBS -C depends HOST=$HOST $DEP_OPTS LOG=1"
+fi
+if [ "$DOWNLOAD_PREVIOUS_RELEASES" = "true" ]; then
+  test/get_previous_releases.py --target-dir "$PREVIOUS_RELEASES_DIR"
+fi
+
+BITCOIN_CONFIG_ALL="-DBUILD_BENCH=ON -DBUILD_FUZZ_BINARY=ON"
+if [ -z "$NO_DEPENDS" ]; then
+  BITCOIN_CONFIG_ALL="${BITCOIN_CONFIG_ALL} -DCMAKE_TOOLCHAIN_FILE=$DEPENDS_DIR/$HOST/toolchain.cmake"
+fi
+if [ -z "$NO_WERROR" ]; then
+  BITCOIN_CONFIG_ALL="${BITCOIN_CONFIG_ALL} -DWERROR=ON"
+fi
+
+ccache --zero-stats
+PRINT_CCACHE_STATISTICS="ccache --version | head -n 1 && ccache --show-stats"
+
+# Folder where the build is done.
+BASE_BUILD_DIR=${BASE_BUILD_DIR:-$BASE_SCRATCH_DIR/build-$HOST}
+
+BITCOIN_CONFIG_ALL="$BITCOIN_CONFIG_ALL -DCMAKE_INSTALL_PREFIX=$BASE_OUTDIR -Werror=dev"
+
+if [[ "${RUN_IWYU}" == true || "${RUN_TIDY}" == true ]]; then
+  BITCOIN_CONFIG_ALL="$BITCOIN_CONFIG_ALL -DCMAKE_EXPORT_COMPILE_COMMANDS=ON"
+fi
+
+eval "CMAKE_ARGS=($BITCOIN_CONFIG_ALL $BITCOIN_CONFIG)"
+cmake -S "$BASE_ROOT_DIR" -B "$BASE_BUILD_DIR" "${CMAKE_ARGS[@]}" || (
+  cd "${BASE_BUILD_DIR}"
+  # shellcheck disable=SC2046
+  cat $(cmake -P "${BASE_ROOT_DIR}/ci/test/GetCMakeLogFiles.cmake")
+  false
+)
+
+if [[ "${GOAL}" != all && "${GOAL}" != codegen ]]; then
+  GOAL="all ${GOAL}"
+fi
+
+# shellcheck disable=SC2086
+cmake --build "${BASE_BUILD_DIR}" "$MAKEJOBS" --target $GOAL || (
+  echo "Build failure. Verbose build follows."
+  # shellcheck disable=SC2086
+  cmake --build "${BASE_BUILD_DIR}" -j1 --target $GOAL --verbose
+  false
+)
+
+bash -c "${PRINT_CCACHE_STATISTICS}"
+if [ "$CI" = "true" ]; then
+  hit_rate=$(ccache -s | grep "Hits:" | head -1 | sed 's/.*(\(.*\)%).*/\1/')
+  if [ "${hit_rate%.*}" -lt 75 ]; then
+      echo "::notice title=low ccache hitrate::Ccache hit-rate in $CONTAINER_NAME was $hit_rate%"
+  fi
+fi
+du -sh "${DEPENDS_DIR}"/*/
+du -sh "${PREVIOUS_RELEASES_DIR}"
+
+if [ -n "${CI_LIMIT_STACK_SIZE}" ]; then
+  ulimit -s 512
+fi
+
+if [ -n "$USE_VALGRIND" ]; then
+  "${BASE_ROOT_DIR}/ci/test/wrap-valgrind.sh"
+fi
+
+if [ "$RUN_CHECK_DEPS" = "true" ]; then
+  "${BASE_ROOT_DIR}/contrib/devtools/check-deps.sh" "${BASE_BUILD_DIR}"
+fi
+
+if [ "$RUN_UNIT_TESTS" = "true" ]; then
+  DIR_UNIT_TEST_DATA="${DIR_UNIT_TEST_DATA}" \
+  LD_LIBRARY_PATH="${DEPENDS_DIR}/${HOST}/lib" \
+  CTEST_OUTPUT_ON_FAILURE=ON \
+  ctest --test-dir "${BASE_BUILD_DIR}" \
+    --stop-on-failure \
+    "${MAKEJOBS}" \
+    --timeout $(( TEST_RUNNER_TIMEOUT_FACTOR * 60 ))
+fi
+
+if [ "$RUN_FUNCTIONAL_TESTS" = "true" ]; then
+  # parses TEST_RUNNER_EXTRA as an array which allows for multiple arguments such as TEST_RUNNER_EXTRA='--exclude "rpc_bind.py --ipv6"'
+  eval "TEST_RUNNER_EXTRA=($TEST_RUNNER_EXTRA)"
+  LD_LIBRARY_PATH="${DEPENDS_DIR}/${HOST}/lib" \
+  "${BASE_BUILD_DIR}/test/functional/test_runner.py" \
+    "${MAKEJOBS}" \
+    --tmpdirprefix "${BASE_SCRATCH_DIR}/test_runner/" \
+    --ansi \
+    --combinedlogslen=99999999 \
+    --timeout-factor="${TEST_RUNNER_TIMEOUT_FACTOR}" \
+    "${TEST_RUNNER_EXTRA[@]}" \
+    --quiet \
+    --failfast
+fi
+
+if [ "${RUN_TIDY}" = "true" ]; then
+  cmake -B /tidy-build -DLLVM_DIR=/usr/lib/llvm-"${TIDY_LLVM_V}"/cmake -DCMAKE_BUILD_TYPE=Release -S "${BASE_ROOT_DIR}"/contrib/devtools/bitcoin-tidy
+  cmake --build /tidy-build "$MAKEJOBS"
+  cmake --build /tidy-build --target bitcoin-tidy-tests "$MAKEJOBS"
+
+  set -eo pipefail
+  # Filter out:
+  # * qt qrc and moc generated files
+  jq 'map(select(.file | test("src/qt/.*_autogen/.*\\.cpp$") | not))' "${BASE_BUILD_DIR}/compile_commands.json" > tmp.json
+  mv tmp.json "${BASE_BUILD_DIR}/compile_commands.json"
+
+  cd "${BASE_BUILD_DIR}/src/"
+  if ! ( run-clang-tidy-"${TIDY_LLVM_V}" -quiet -load="/tidy-build/libbitcoin-tidy.so" "${MAKEJOBS}" | tee tmp.tidy-out.txt ); then
+    grep -C5 "error: " tmp.tidy-out.txt
+    echo "^^^ ⚠️ Failure generated from clang-tidy"
+    false
+  fi
+fi
+
+if [[ "${RUN_IWYU}" == true ]]; then
+  # TODO: Consider enforcing IWYU across the entire codebase.
+  FILES_WITH_ENFORCED_IWYU="/src/((crypto|index|kernel)/.*\\.cpp|node/blockstorage.cpp|node/utxo_snapshot.cpp|core_io.cpp|signet.cpp)"
+  jq --arg patterns "$FILES_WITH_ENFORCED_IWYU" 'map(select(.file | test($patterns)))' "${BASE_BUILD_DIR}/compile_commands.json" > "${BASE_BUILD_DIR}/compile_commands_iwyu_errors.json"
+  jq --arg patterns "$FILES_WITH_ENFORCED_IWYU" 'map(select(.file | test($patterns) | not))' "${BASE_BUILD_DIR}/compile_commands.json" > "${BASE_BUILD_DIR}/compile_commands_iwyu_warnings.json"
+
+  cd "${BASE_ROOT_DIR}"
+
+  run_iwyu() {
+    mv "${BASE_BUILD_DIR}/$1" "${BASE_BUILD_DIR}/compile_commands.json"
+    python3 "/include-what-you-use/iwyu_tool.py" \
+             -p "${BASE_BUILD_DIR}" "${MAKEJOBS}" \
+             -- -Xiwyu --cxx17ns -Xiwyu --mapping_file="${BASE_ROOT_DIR}/contrib/devtools/iwyu/bitcoin.core.imp" \
+             -Xiwyu --max_line_length=160 \
+             2>&1 | tee /tmp/iwyu_ci.out
+    python3 "/include-what-you-use/fix_includes.py" --nosafe_headers < /tmp/iwyu_ci.out
+    git diff -U0 | ./contrib/devtools/clang-format-diff.py -binary="clang-format-${TIDY_LLVM_V}" -p1 -i -v
+  }
+
+  run_iwyu "compile_commands_iwyu_errors.json"
+  if ! ( git --no-pager diff --exit-code ); then
+    echo "^^^ ⚠️ Failure generated from IWYU"
+    false
+  fi
+
+  run_iwyu "compile_commands_iwyu_warnings.json"
+  git --no-pager diff
+fi
+
+if [ "$RUN_FUZZ_TESTS" = "true" ]; then
+  # shellcheck disable=SC2086
+  LD_LIBRARY_PATH="${DEPENDS_DIR}/${HOST}/lib" \
+  "${BASE_BUILD_DIR}/test/fuzz/test_runner.py" \
+    ${FUZZ_TESTS_CONFIG} \
+    "${MAKEJOBS}" \
+    -l DEBUG \
+    "${DIR_FUZZ_IN}" \
+    --empty_min_time=60
+fi
diff --git a/ci/test/GetCMakeLogFiles.cmake b/ci/test/GetCMakeLogFiles.cmake
new file mode 100644
index 00000000..80f71dcf
--- /dev/null
+++ b/ci/test/GetCMakeLogFiles.cmake
@@ -0,0 +1,11 @@
+# Copyright (c) 2024-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+if(CMAKE_VERSION VERSION_GREATER_EQUAL 3.26)
+  set(log_files "CMakeFiles/CMakeConfigureLog.yaml")
+else()
+  set(log_files "CMakeFiles/CMakeOutput.log CMakeFiles/CMakeError.log")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} -E echo ${log_files})
diff --git a/ci/test/wrap-valgrind.sh b/ci/test/wrap-valgrind.sh
new file mode 100755
index 00000000..e351cf24
--- /dev/null
+++ b/ci/test/wrap-valgrind.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2018-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+for b_name in "${BASE_OUTDIR}/bin"/*; do
+    # shellcheck disable=SC2044
+    for b in $(find "${BASE_ROOT_DIR}" -executable -type f -name "$(basename "$b_name")"); do
+      echo "Wrap $b ..."
+      mv "$b" "${b}_orig"
+      echo '#!/usr/bin/env bash' > "$b"
+      echo "exec valgrind --gen-suppressions=all --quiet --error-exitcode=1 --suppressions=${BASE_ROOT_DIR}/contrib/valgrind.supp \"${b}_orig\" \"\$@\"" >> "$b"
+      chmod +x "$b"
+    done
+done
diff --git a/ci/test_imagefile b/ci/test_imagefile
new file mode 100644
index 00000000..93494cc1
--- /dev/null
+++ b/ci/test_imagefile
@@ -0,0 +1,24 @@
+# Copyright (c) The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+# See ci/README.md for usage.
+
+# We never want scratch, but default arg silences a Warning
+ARG CI_IMAGE_NAME_TAG=scratch
+FROM ${CI_IMAGE_NAME_TAG}
+
+ARG FILE_ENV
+ENV FILE_ENV=${FILE_ENV}
+
+ARG BASE_ROOT_DIR
+ENV BASE_ROOT_DIR=${BASE_ROOT_DIR}
+
+# Make retry available in PATH, needed for CI_RETRY_EXE
+COPY ./ci/retry/retry /usr/bin/retry
+COPY ./ci/test/00_setup_env.sh ./${FILE_ENV} ./ci/test/01_base_install.sh ./ci/test/01_iwyu.patch /ci_container_base/ci/test/
+
+# Bash is required, so install it when missing
+RUN sh -c "bash -c 'true' || ( apk update && apk add --no-cache bash )"
+
+RUN ["bash", "-c", "cd /ci_container_base/ && set -o errexit && source ./ci/test/00_setup_env.sh && ./ci/test/01_base_install.sh"]
diff --git a/ci/test_run_all.sh b/ci/test_run_all.sh
new file mode 100755
index 00000000..1a5719c9
--- /dev/null
+++ b/ci/test_run_all.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+#
+# Copyright (c) 2019-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+export LC_ALL=C.UTF-8
+
+set -o errexit; source ./ci/test/00_setup_env.sh
+set -o errexit
+"./ci/test/02_run_container.py"
diff --git a/cmake/bitcoin-build-config.h.in b/cmake/bitcoin-build-config.h.in
new file mode 100644
index 00000000..bf3ddcd7
--- /dev/null
+++ b/cmake/bitcoin-build-config.h.in
@@ -0,0 +1,115 @@
+// Copyright (c) 2023-present The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or https://opensource.org/license/mit/.
+
+#ifndef BITCOIN_CONFIG_H
+#define BITCOIN_CONFIG_H
+
+/* Version Build */
+#define CLIENT_VERSION_BUILD @CLIENT_VERSION_BUILD@
+
+/* Version is release */
+#define CLIENT_VERSION_IS_RELEASE @CLIENT_VERSION_IS_RELEASE@
+
+/* Major version */
+#define CLIENT_VERSION_MAJOR @CLIENT_VERSION_MAJOR@
+
+/* Minor version */
+#define CLIENT_VERSION_MINOR @CLIENT_VERSION_MINOR@
+
+/* Copyright holder(s) before %s replacement */
+#define COPYRIGHT_HOLDERS "@COPYRIGHT_HOLDERS@"
+
+/* Copyright holder(s) */
+#define COPYRIGHT_HOLDERS_FINAL "@COPYRIGHT_HOLDERS_FINAL@"
+
+/* Replacement for %s in copyright holders string */
+#define COPYRIGHT_HOLDERS_SUBSTITUTION "@CLIENT_NAME@"
+
+/* Copyright year */
+#define COPYRIGHT_YEAR @COPYRIGHT_YEAR@
+
+/* Define if external signer support is enabled */
+#cmakedefine ENABLE_EXTERNAL_SIGNER 1
+
+/* Define to 1 to enable tracepoints for Userspace, Statically Defined Tracing
+   */
+#cmakedefine ENABLE_TRACING 1
+
+/* Define to 1 to enable wallet functions. */
+#cmakedefine ENABLE_WALLET 1
+
+/* Define to 1 if you have the declaration of `fork', and to 0 if you don't.
+   */
+#cmakedefine01 HAVE_DECL_FORK
+
+/* Define to 1 if '*ifaddrs' are available. */
+#cmakedefine HAVE_IFADDRS 1
+
+/* Define to 1 if you have the declaration of `pipe2', and to 0 if you don't.
+   */
+#cmakedefine01 HAVE_DECL_PIPE2
+
+/* Define to 1 if you have the declaration of `setsid', and to 0 if you don't.
+   */
+#cmakedefine01 HAVE_DECL_SETSID
+
+/* Define to 1 if fdatasync is available. */
+#cmakedefine HAVE_FDATASYNC 1
+
+/* Define this symbol if the BSD getentropy system call is available with
+   sys/random.h */
+#cmakedefine HAVE_GETENTROPY_RAND 1
+
+/* Define this symbol if the Linux getrandom function call is available */
+#cmakedefine HAVE_GETRANDOM 1
+
+/* Define this symbol if you have malloc_info */
+#cmakedefine HAVE_MALLOC_INFO 1
+
+/* Define this symbol if you have mallopt with M_ARENA_MAX */
+#cmakedefine HAVE_MALLOPT_ARENA_MAX 1
+
+/* Define to 1 if O_CLOEXEC flag is available. */
+#cmakedefine01 HAVE_O_CLOEXEC
+
+/* Define this symbol if you have posix_fallocate */
+#cmakedefine HAVE_POSIX_FALLOCATE 1
+
+/* Define this symbol if platform supports unix domain sockets */
+#cmakedefine HAVE_SOCKADDR_UN 1
+
+/* Define this symbol to build code that uses getauxval */
+#cmakedefine HAVE_STRONG_GETAUXVAL 1
+
+/* Define this symbol if the BSD sysctl() is available */
+#cmakedefine HAVE_SYSCTL 1
+
+/* Define this symbol if the BSD sysctl(KERN_ARND) is available */
+#cmakedefine HAVE_SYSCTL_ARND 1
+
+/* Define to 1 if std::system or ::wsystem is available. */
+#cmakedefine HAVE_SYSTEM 1
+
+/* Define to the address where bug reports for this package should be sent. */
+#define CLIENT_BUGREPORT "@CLIENT_BUGREPORT@"
+
+/* Define to the full name of this package. */
+#define CLIENT_NAME "@CLIENT_NAME@"
+
+/* Define to the home page for this package. */
+#define CLIENT_URL "@PROJECT_HOMEPAGE_URL@"
+
+/* Define to the version of this package. */
+#define CLIENT_VERSION_STRING "@CLIENT_VERSION_STRING@"
+
+/* Define to 1 if strerror_r returns char *. */
+#cmakedefine STRERROR_R_CHAR_P 1
+
+/* Define if dbus support should be compiled in */
+#cmakedefine USE_DBUS 1
+
+/* Define if QR support should be compiled in */
+#cmakedefine USE_QRCODE 1
+
+#endif //BITCOIN_CONFIG_H
diff --git a/cmake/ccache.cmake b/cmake/ccache.cmake
new file mode 100644
index 00000000..0bfd3a41
--- /dev/null
+++ b/cmake/ccache.cmake
@@ -0,0 +1,30 @@
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+if(NOT MSVC)
+  find_program(CCACHE_EXECUTABLE ccache)
+  if(CCACHE_EXECUTABLE)
+    execute_process(
+      COMMAND readlink -f ${CMAKE_CXX_COMPILER}
+      OUTPUT_VARIABLE compiler_resolved_link
+      ERROR_QUIET
+      OUTPUT_STRIP_TRAILING_WHITESPACE
+    )
+    if(CCACHE_EXECUTABLE STREQUAL compiler_resolved_link AND NOT WITH_CCACHE)
+      list(APPEND configure_warnings
+        "Disabling ccache was attempted using -DWITH_CCACHE=${WITH_CCACHE}, but ccache masquerades as the compiler."
+      )
+      set(WITH_CCACHE ON)
+    elseif(WITH_CCACHE)
+      list(APPEND CMAKE_C_COMPILER_LAUNCHER ${CCACHE_EXECUTABLE})
+      list(APPEND CMAKE_CXX_COMPILER_LAUNCHER ${CCACHE_EXECUTABLE})
+    endif()
+  else()
+    set(WITH_CCACHE OFF)
+  endif()
+else()
+  set(WITH_CCACHE OFF)
+endif()
+
+mark_as_advanced(CCACHE_EXECUTABLE)
diff --git a/cmake/crc32c.cmake b/cmake/crc32c.cmake
new file mode 100644
index 00000000..25f046bb
--- /dev/null
+++ b/cmake/crc32c.cmake
@@ -0,0 +1,115 @@
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+# This file is part of the transition from Autotools to CMake. Once CMake
+# support has been merged we should switch to using the upstream CMake
+# buildsystem.
+
+include(CheckCXXSourceCompiles)
+include(CheckSourceCompilesWithFlags)
+
+# Check for __builtin_prefetch support in the compiler.
+check_cxx_source_compiles("
+  int main() {
+    char data = 0;
+    const char* address = &data;
+    __builtin_prefetch(address, 0, 0);
+    return 0;
+  }
+  " HAVE_BUILTIN_PREFETCH
+)
+
+# Check for _mm_prefetch support in the compiler.
+check_cxx_source_compiles("
+  #if defined(_MSC_VER)
+  #include <intrin.h>
+  #else
+  #include <xmmintrin.h>
+  #endif
+
+  int main() {
+    char data = 0;
+    const char* address = &data;
+    _mm_prefetch(address, _MM_HINT_NTA);
+    return 0;
+  }
+  " HAVE_MM_PREFETCH
+)
+
+# Check for SSE4.2 support in the compiler.
+if(MSVC)
+  set(SSE42_CXXFLAGS /arch:AVX)
+else()
+  set(SSE42_CXXFLAGS -msse4.2)
+endif()
+check_cxx_source_compiles_with_flags("
+  #include <cstdint>
+  #if defined(_MSC_VER)
+  #include <intrin.h>
+  #elif defined(__GNUC__) && defined(__SSE4_2__)
+  #include <nmmintrin.h>
+  #endif
+
+  int main() {
+    uint64_t l = 0;
+    l = _mm_crc32_u8(l, 0);
+    l = _mm_crc32_u32(l, 0);
+    l = _mm_crc32_u64(l, 0);
+    return l;
+  }
+  " HAVE_SSE42
+  CXXFLAGS ${SSE42_CXXFLAGS}
+)
+
+# Check for ARMv8 w/ CRC and CRYPTO extensions support in the compiler.
+set(ARM64_CRC_CXXFLAGS -march=armv8-a+crc+crypto)
+check_cxx_source_compiles_with_flags("
+  #include <arm_acle.h>
+  #include <arm_neon.h>
+
+  int main() {
+  #ifdef __aarch64__
+    __crc32cb(0, 0); __crc32ch(0, 0); __crc32cw(0, 0); __crc32cd(0, 0);
+    vmull_p64(0, 0);
+  #else
+  #error crc32c library does not support hardware acceleration on 32-bit ARM
+  #endif
+    return 0;
+  }
+  " HAVE_ARM64_CRC32C
+  CXXFLAGS ${ARM64_CRC_CXXFLAGS}
+)
+
+add_library(crc32c STATIC EXCLUDE_FROM_ALL
+  ${PROJECT_SOURCE_DIR}/src/crc32c/src/crc32c.cc
+  ${PROJECT_SOURCE_DIR}/src/crc32c/src/crc32c_portable.cc
+)
+target_compile_definitions(crc32c PRIVATE
+  HAVE_BUILTIN_PREFETCH=$<BOOL:${HAVE_BUILTIN_PREFETCH}>
+  HAVE_MM_PREFETCH=$<BOOL:${HAVE_MM_PREFETCH}>
+  HAVE_STRONG_GETAUXVAL=$<BOOL:${HAVE_STRONG_GETAUXVAL}>
+  BYTE_ORDER_BIG_ENDIAN=$<STREQUAL:${CMAKE_CXX_BYTE_ORDER},BIG_ENDIAN>
+  HAVE_SSE42=$<BOOL:${HAVE_SSE42}>
+  HAVE_ARM64_CRC32C=$<BOOL:${HAVE_ARM64_CRC32C}>
+)
+target_include_directories(crc32c
+  PUBLIC
+    $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/src/crc32c/include>
+)
+target_link_libraries(crc32c PRIVATE core_interface)
+set_target_properties(crc32c PROPERTIES EXPORT_COMPILE_COMMANDS OFF)
+
+if(HAVE_SSE42)
+  set(_crc32_src ${PROJECT_SOURCE_DIR}/src/crc32c/src/crc32c_sse42.cc)
+  target_sources(crc32c PRIVATE ${_crc32_src})
+  set_property(SOURCE ${_crc32_src} PROPERTY COMPILE_OPTIONS ${SSE42_CXXFLAGS})
+endif()
+
+if(HAVE_ARM64_CRC32C)
+  set(_crc32_src ${PROJECT_SOURCE_DIR}/src/crc32c/src/crc32c_arm64.cc)
+  target_sources(crc32c PRIVATE ${_crc32_src})
+  set_property(SOURCE ${_crc32_src} PROPERTY COMPILE_OPTIONS ${ARM64_CRC_CXXFLAGS})
+endif()
+
+unset(_crc32_src)
diff --git a/cmake/introspection.cmake b/cmake/introspection.cmake
new file mode 100644
index 00000000..d2257633
--- /dev/null
+++ b/cmake/introspection.cmake
@@ -0,0 +1,213 @@
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+include(CheckCXXSourceCompiles)
+include(CheckCXXSymbolExists)
+
+check_cxx_symbol_exists(O_CLOEXEC "fcntl.h" HAVE_O_CLOEXEC)
+check_cxx_symbol_exists(fdatasync "unistd.h" HAVE_FDATASYNC)
+check_cxx_symbol_exists(fork "unistd.h" HAVE_DECL_FORK)
+check_cxx_symbol_exists(pipe2 "unistd.h" HAVE_DECL_PIPE2)
+check_cxx_symbol_exists(setsid "unistd.h" HAVE_DECL_SETSID)
+
+if(NOT WIN32)
+  include(TestAppendRequiredLibraries)
+  test_append_socket_library(core_interface)
+endif()
+
+include(TestAppendRequiredLibraries)
+test_append_atomic_library(core_interface)
+
+# Even though ::system is part of the standard library, we still check
+# for it, to support building targets that don't have it, such as iOS.
+check_cxx_symbol_exists(std::system "cstdlib" HAVE_STD_SYSTEM)
+check_cxx_symbol_exists(::_wsystem "stdlib.h" HAVE__WSYSTEM)
+if(HAVE_STD_SYSTEM OR HAVE__WSYSTEM)
+  set(HAVE_SYSTEM 1)
+endif()
+
+check_cxx_source_compiles("
+  #include <string.h>
+
+  int main()
+  {
+    char buf[100];
+    char* p{strerror_r(0, buf, sizeof buf)};
+    (void)p;
+  }
+  " STRERROR_R_CHAR_P
+)
+
+# Check for malloc_info (for memory statistics information in getmemoryinfo).
+check_cxx_symbol_exists(malloc_info "malloc.h" HAVE_MALLOC_INFO)
+
+# Check for mallopt(M_ARENA_MAX) (to set glibc arenas).
+check_cxx_source_compiles("
+  #include <malloc.h>
+
+  int main()
+  {
+    mallopt(M_ARENA_MAX, 1);
+  }
+  " HAVE_MALLOPT_ARENA_MAX
+)
+
+# Check for posix_fallocate().
+check_cxx_source_compiles("
+  #include <fcntl.h>
+
+  int main()
+  {
+    return posix_fallocate(0, 0, 0);
+  }
+  " HAVE_POSIX_FALLOCATE
+)
+
+# Check for strong getauxval() support in the system headers.
+check_cxx_source_compiles("
+  #include <sys/auxv.h>
+
+  int main()
+  {
+    getauxval(AT_HWCAP);
+  }
+  " HAVE_STRONG_GETAUXVAL
+)
+
+# Check for UNIX sockets.
+check_cxx_source_compiles("
+  #include <sys/socket.h>
+  #include <sys/un.h>
+
+  int main()
+  {
+    struct sockaddr_un addr;
+    addr.sun_family = AF_UNIX;
+  }
+  " HAVE_SOCKADDR_UN
+)
+
+# Check for different ways of gathering OS randomness:
+# - Linux getrandom()
+check_cxx_source_compiles("
+  #include <sys/random.h>
+
+  int main()
+  {
+    getrandom(nullptr, 32, 0);
+  }
+  " HAVE_GETRANDOM
+)
+
+# - BSD getentropy()
+check_cxx_source_compiles("
+  #include <sys/random.h>
+
+  int main()
+  {
+    getentropy(nullptr, 32);
+  }
+  " HAVE_GETENTROPY_RAND
+)
+
+
+# - BSD sysctl()
+check_cxx_source_compiles("
+  #include <sys/types.h>
+  #include <sys/sysctl.h>
+
+  #ifdef __linux__
+  #error Don't use sysctl on Linux, it's deprecated even when it works
+  #endif
+
+  int main()
+  {
+    sysctl(nullptr, 2, nullptr, nullptr, nullptr, 0);
+  }
+  " HAVE_SYSCTL
+)
+
+# - BSD sysctl(KERN_ARND)
+check_cxx_source_compiles("
+  #include <sys/types.h>
+  #include <sys/sysctl.h>
+
+  #ifdef __linux__
+  #error Don't use sysctl on Linux, it's deprecated even when it works
+  #endif
+
+  int main()
+  {
+    static int name[2] = {CTL_KERN, KERN_ARND};
+    sysctl(name, 2, nullptr, nullptr, nullptr, 0);
+  }
+  " HAVE_SYSCTL_ARND
+)
+
+if(NOT MSVC)
+  include(CheckSourceCompilesWithFlags)
+
+  # Check for SSE4.1 intrinsics.
+  set(SSE41_CXXFLAGS -msse4.1)
+  check_cxx_source_compiles_with_flags("
+    #include <immintrin.h>
+
+    int main()
+    {
+      __m128i a = _mm_set1_epi32(0);
+      __m128i b = _mm_set1_epi32(1);
+      __m128i r = _mm_blend_epi16(a, b, 0xFF);
+      return _mm_extract_epi32(r, 3);
+    }
+    " HAVE_SSE41
+    CXXFLAGS ${SSE41_CXXFLAGS}
+  )
+
+  # Check for AVX2 intrinsics.
+  set(AVX2_CXXFLAGS -mavx -mavx2)
+  check_cxx_source_compiles_with_flags("
+    #include <immintrin.h>
+
+    int main()
+    {
+      __m256i l = _mm256_set1_epi32(0);
+      return _mm256_extract_epi32(l, 7);
+    }
+    " HAVE_AVX2
+    CXXFLAGS ${AVX2_CXXFLAGS}
+  )
+
+  # Check for x86 SHA-NI intrinsics.
+  set(X86_SHANI_CXXFLAGS -msse4 -msha)
+  check_cxx_source_compiles_with_flags("
+    #include <immintrin.h>
+
+    int main()
+    {
+      __m128i i = _mm_set1_epi32(0);
+      __m128i j = _mm_set1_epi32(1);
+      __m128i k = _mm_set1_epi32(2);
+      return _mm_extract_epi32(_mm_sha256rnds2_epu32(i, j, k), 0);
+    }
+    " HAVE_X86_SHANI
+    CXXFLAGS ${X86_SHANI_CXXFLAGS}
+  )
+
+  # Check for ARMv8 SHA-NI intrinsics.
+  set(ARM_SHANI_CXXFLAGS -march=armv8-a+crypto)
+  check_cxx_source_compiles_with_flags("
+    #include <arm_neon.h>
+
+    int main()
+    {
+      uint32x4_t a, b, c;
+      vsha256h2q_u32(a, b, c);
+      vsha256hq_u32(a, b, c);
+      vsha256su0q_u32(a, b);
+      vsha256su1q_u32(a, b, c);
+    }
+    " HAVE_ARM_SHANI
+    CXXFLAGS ${ARM_SHANI_CXXFLAGS}
+  )
+endif()
diff --git a/cmake/leveldb.cmake b/cmake/leveldb.cmake
new file mode 100644
index 00000000..572b2bed
--- /dev/null
+++ b/cmake/leveldb.cmake
@@ -0,0 +1,103 @@
+# Copyright (c) 2023-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or https://opensource.org/license/mit/.
+
+# This file is part of the transition from Autotools to CMake. Once CMake
+# support has been merged we should switch to using the upstream CMake
+# buildsystem.
+
+include(CheckCXXSymbolExists)
+check_cxx_symbol_exists(F_FULLFSYNC "fcntl.h" HAVE_FULLFSYNC)
+
+add_library(leveldb STATIC EXCLUDE_FROM_ALL
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/builder.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/c.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/db_impl.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/db_iter.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/dbformat.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/dumpfile.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/filename.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/log_reader.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/log_writer.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/memtable.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/repair.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/table_cache.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/version_edit.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/version_set.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/db/write_batch.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/block.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/block_builder.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/filter_block.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/format.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/iterator.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/merger.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/table.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/table_builder.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/table/two_level_iterator.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/arena.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/bloom.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/cache.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/coding.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/comparator.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/crc32c.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/env.cc
+  $<$<NOT:$<BOOL:${WIN32}>>:${PROJECT_SOURCE_DIR}/src/leveldb/util/env_posix.cc>
+  $<$<BOOL:${WIN32}>:${PROJECT_SOURCE_DIR}/src/leveldb/util/env_windows.cc>
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/filter_policy.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/hash.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/histogram.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/logging.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/options.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/util/status.cc
+  ${PROJECT_SOURCE_DIR}/src/leveldb/helpers/memenv/memenv.cc
+)
+
+target_compile_definitions(leveldb
+  PRIVATE
+    HAVE_SNAPPY=0
+    HAVE_CRC32C=1
+    HAVE_FDATASYNC=$<BOOL:${HAVE_FDATASYNC}>
+    HAVE_FULLFSYNC=$<BOOL:${HAVE_FULLFSYNC}>
+    HAVE_O_CLOEXEC=$<BOOL:${HAVE_O_CLOEXEC}>
+    FALLTHROUGH_INTENDED=[[fallthrough]]
+    $<$<NOT:$<BOOL:${WIN32}>>:LEVELDB_PLATFORM_POSIX>
+    $<$<BOOL:${WIN32}>:LEVELDB_PLATFORM_WINDOWS>
+    $<$<BOOL:${WIN32}>:_UNICODE;UNICODE>
+)
+if(MINGW)
+  target_compile_definitions(leveldb
+    PRIVATE
+      __USE_MINGW_ANSI_STDIO=1
+  )
+endif()
+
+target_include_directories(leveldb
+  PRIVATE
+    $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/src/leveldb>
+  PUBLIC
+    $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/src/leveldb/include>
+)
+
+add_library(nowarn_leveldb_interface INTERFACE)
+if(MSVC)
+  target_compile_options(nowarn_leveldb_interface INTERFACE
+    /wd4722
+  )
+  target_compile_definitions(nowarn_leveldb_interface INTERFACE
+    _CRT_NONSTDC_NO_WARNINGS
+  )
+else()
+  try_append_cxx_flags("-Wconditional-uninitialized" TARGET nowarn_leveldb_interface SKIP_LINK
+    IF_CHECK_PASSED "-Wno-conditional-uninitialized"
+  )
+endif()
+
+target_link_libraries(leveldb PRIVATE
+  core_interface
+  nowarn_leveldb_interface
+  crc32c
+)
+
+set_target_properties(leveldb PROPERTIES
+  EXPORT_COMPILE_COMMANDS OFF
+)
diff --git a/cmake/libmultiprocess.cmake b/cmake/libmultiprocess.cmake
new file mode 100644
index 00000000..027109a9
--- /dev/null
+++ b/cmake/libmultiprocess.cmake
@@ -0,0 +1,38 @@
+# Copyright (c) 2025-present The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file C