beta7: crash-safety — graceful DB-flush failure + ThreadImport exception guard

[RhettCreighton]

What

Two NON-CONSENSUS robustness fixes that turn process-killing crashes into graceful handling.

1. Graceful coin-DB flush failure (src/main.cpp)

In DisconnectTip() and ConnectTip(), assert(view.Flush()); aborted the process (and was a no-op in -DNDEBUG release builds) when the chainstate write failed. Replaced each with a graceful return that follows the existing error path:

if (!view.Flush())
    return AbortNode(state, "Failed to write to coin database");

Both call sites have a CValidationState& state param, and AbortNode(state, ...) is already used throughout these functions (and with this exact message at the FlushStateToDisk site), so the daemon now shuts down cleanly with a clear error instead of assert-aborting / silently skipping the check.

2. ThreadImport exception guard (src/init.cpp)

ThreadImport (reindex / LoadExternalBlockFile / bootstrap.dat / -loadblock) is launched directly via boost::bind(&ThreadImport, ...), NOT through TraceThread, so it is the one worker thread with no surrounding try/catch — an uncaught std::exception would std::terminate the whole process. Wrapped the body in:

try { ... } catch (const std::exception& e) { LogPrintf("%s: failed: %s\n", __func__, e.what()); }

Success path behavior is identical; this only catches what would otherwise crash the node. Mirrors the existing catch (const std::exception& e) style already used elsewhere in init.cpp.

Why

Audit-verified: both are pre-existing crash/abort hazards on I/O or import failure. The fixes only convert a hard process kill into a logged, graceful node shutdown (DB flush) or a logged thread exit (import).

Files touched

• src/main.cpp — DisconnectTip(), ConnectTip()
• src/init.cpp — ThreadImport()

Consensus impact: none

No change to block/tx validation results, PoW/Equihash, the script interpreter, hashed/signed bytes, chainparams, or activation heights — only failure-path handling (graceful abort vs. assert; catching an otherwise-fatal exception).

DRAFT: pending maintainer integration build + gtest.

[RhettCreighton]

✅ Build verification (maintainer): the merged beta7/integration branch — all five beta7 hardening PRs together — compiles and links cleanly via the same proot / glibc-2.29 toolchain used to build the beta6 release. 0 compile errors, portable daemon produced (glibc floor 2.29).

Each PR was also independently peer-reviewed for correctness and consensus-safety (all changes confirmed non-consensus — no effect on block/tx validation, PoW, script, or serialization of any valid object).

Marking ready for review. As usual, the full gtest + qa/rpc-tests suite should run in CI before merge.