build(setup): warn when a prebuilt daemon is older than the dragonx source

build.sh bundles whatever daemon binary already sits in prebuilt-binaries/, and
setup.sh only rebuilds a platform's daemon when its flag (--win/--mac) is passed
— so a daemon left over from an older source revision silently shipped in the
wallet (the Network tab showed dragonxd v1.0.1 while the source was v1.0.2).

Add a stale-daemon guard: compare the vX.Y.Z baked into each prebuilt daemon
against CLIENT_VERSION_* in the checked-out dragonx source. On the present/skip
and --check paths it now prints either "matches dragonx source" or a STALE
warning naming both versions and the rebuild command, plus a summary reminder at
the end of the daemon section. Version is read with grep -a (no binutils/strings
dependency); no-ops cleanly when the source or a binary is absent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

setup.sh

@@ -442,6 +442,53 @@ copy_daemon_data() {
     done
 }
 
+# ── Stale-daemon guard ───────────────────────────────────────────────────────
+# A prebuilt daemon binary is only rebuilt on its platform's flag (--win/--mac),
+# and build.sh merely BUNDLES whatever binary already exists — so a daemon left
+# over from an old source revision silently ships in the wallet (e.g. the Network
+# tab once reported v1.0.1 while the source was v1.0.2). These helpers compare the
+# version baked into a prebuilt binary against the dragonx source and flag drift.
+STALE_DAEMON=0
+
+# MAJOR.MINOR.REVISION from the checked-out dragonx source (empty if unavailable).
+dragonx_source_version() {
+    local hdr="$DRAGONX_SRC/src/clientversion.h"
+    [[ -f "$hdr" ]] || return 1
+    local maj min rev
+    maj=$(awk '/#define[ \t]+CLIENT_VERSION_MAJOR/{print $3; exit}' "$hdr")
+    min=$(awk '/#define[ \t]+CLIENT_VERSION_MINOR/{print $3; exit}' "$hdr")
+    rev=$(awk '/#define[ \t]+CLIENT_VERSION_REVISION/{print $3; exit}' "$hdr")
+    [[ -n "$maj" && -n "$min" && -n "$rev" ]] || return 1
+    printf '%s.%s.%s' "$maj" "$min" "$rev"
+}
+
+# vX.Y.Z baked into a built daemon binary (the daemon embeds "vX.Y.Z-<githash>").
+# Uses grep -a so no `strings`/binutils dependency is required.
+dragonx_binary_version() {
+    local bin="$1"
+    [[ -f "$bin" ]] || return 1
+    LC_ALL=C grep -aoE 'v[0-9]+\.[0-9]+\.[0-9]+-[0-9a-f]{6,}' "$bin" 2>/dev/null \
+        | head -1 | sed -E 's/^v([0-9]+\.[0-9]+\.[0-9]+).*/\1/'
+}
+
+# Compare a prebuilt daemon against the source; warn (and set STALE_DAEMON) on drift.
+#   $1 = label, $2 = binary path, $3 = rebuild flag(s) (e.g. "--win", "" for Linux)
+daemon_version_guard() {
+    local label="$1" bin="$2" rebuild_hint="$3"
+    [[ -f "$bin" ]] || return 0
+    local src bv
+    src=$(dragonx_source_version) || return 0       # no source checked out → can't compare
+    bv=$(dragonx_binary_version "$bin")
+    [[ -n "$bv" ]] || return 0                       # couldn't read the binary's version
+    if [[ "$bv" == "$src" ]]; then
+        ok "  $label daemon is v$bv (matches dragonx source)"
+    else
+        warn "  $label daemon is v$bv but dragonx source is v$src — STALE"
+        warn "    rebuild so the wallet ships the current daemon:  ./setup.sh${rebuild_hint:+ $rebuild_hint}"
+        STALE_DAEMON=1
+    fi
+}
+
 # ── Linux daemon ─────────────────────────────────────────────────────────────
 
 # Skip Linux daemon build if only cross-compile targets were requested
@@ -461,11 +508,13 @@ fi
 if $CHECK_ONLY; then
     if [[ -f "$DRAGONXD_LINUX/dragonxd" ]] || [[ -f "$DRAGONXD_LINUX/hushd" ]]; then
         ok "dragonxd daemon (Linux) present"
+        daemon_version_guard "Linux" "$DRAGONXD_LINUX/dragonxd" ""
     else
         miss "dragonxd daemon (Linux) not built"
     fi
 elif $SKIP_LINUX_DAEMON; then
     skip "dragonxd (Linux) — skipped, binaries already present (cross-compile only)"
+    daemon_version_guard "Linux" "$DRAGONXD_LINUX/dragonxd" ""
 else
     clone_dragonx_if_needed
 
@@ -500,9 +549,11 @@ fi
 
 if ! $SETUP_WIN; then
     skip "dragonxd (Windows) — use --win to cross-compile"
+    daemon_version_guard "Windows" "$DRAGONXD_WIN/dragonxd.exe" "--win"
 elif $CHECK_ONLY; then
     if [[ -f "$DRAGONXD_WIN/dragonxd.exe" ]] || [[ -f "$DRAGONXD_WIN/hushd.exe" ]]; then
         ok "dragonxd daemon (Windows) present"
+        daemon_version_guard "Windows" "$DRAGONXD_WIN/dragonxd.exe" "--win"
     else
         miss "dragonxd daemon (Windows) not built"
     fi
@@ -558,9 +609,11 @@ fi
 
 if ! $SETUP_MAC; then
     skip "dragonxd (macOS) — use --mac to cross-compile"
+    daemon_version_guard "macOS" "$DRAGONXD_MAC/dragonxd" "--mac"
 elif $CHECK_ONLY; then
     if [[ -f "$DRAGONXD_MAC/dragonxd" ]] || [[ -f "$DRAGONXD_MAC/hushd" ]]; then
         ok "dragonxd daemon (macOS) present"
+        daemon_version_guard "macOS" "$DRAGONXD_MAC/dragonxd" "--mac"
     else
         miss "dragonxd daemon (macOS) not built"
     fi
@@ -623,6 +676,14 @@ else
     fi
 fi
 
+# Prominent reminder if any prebuilt daemon drifted from the source — these are bundled verbatim
+# by build.sh, so a stale binary ships in the wallet (and shows an old version in the Network tab).
+if [[ "$STALE_DAEMON" -eq 1 ]]; then
+    warn "One or more prebuilt daemons are OLDER than the dragonx source (see above)."
+    warn "build.sh bundles them as-is, so rebuild the stale platform(s) before releasing:"
+    warn "  Linux: ./setup.sh   ·   Windows: ./setup.sh --win   ·   macOS: ./setup.sh --mac"
+fi
+
 # ── 7. xmrig-hac (mining binary) ────────────────────────────────────────────
 header "xmrig-hac Mining Binary"