feat(framework): remove --keystore-factory support from FullNode

common/src/main/java/org/tron/common/parameter/CommonParameter.java

@@ -176,12 +176,6 @@ public class CommonParameter {
   @Setter
   public boolean solidityNode = false;
 
-  // If you are running KeystoreFactory,
-  // this flag is set to true
-  @Getter
-  @Setter
-  public boolean keystoreFactory = false;
-
   // -- RPC / HTTP --
   @Getter
   @Setter

crypto/src/main/java/org/tron/keystore/WalletUtils.java

@@ -201,13 +201,10 @@ public static boolean passwordValid(String password) {
 
   /**
    * Lazily-initialized Scanner shared across successive
-   * {@link #inputPassword()} calls on the non-TTY path so that
-   * {@link #inputPassword2Twice()} can read two lines in sequence
-   * without losing data. Each call to {@code new Scanner(System.in)}
-   * internally buffers bytes from the underlying {@link BufferedReader};
-   * constructing a second Scanner after the first has been discarded
-   * drops any buffered bytes the first pulled from stdin, causing
-   * {@code NoSuchElementException}.
+   * {@link #inputPassword()} calls on the non-TTY path. Each call to
+   * {@code new Scanner(System.in)} buffers ahead from stdin; constructing
+   * a second Scanner after the first has been discarded drops any bytes
+   * the first pulled, causing {@code NoSuchElementException}.
    */
   private static Scanner sharedStdinScanner;
 
@@ -250,18 +247,4 @@ public static String inputPassword() {
     }
   }
 
-  public static String inputPassword2Twice() {
-    String password0;
-    while (true) {
-      System.out.println("Please input password.");
-      password0 = inputPassword();
-      System.out.println("Please input password again.");
-      String password1 = inputPassword();
-      if (password0.equals(password1)) {
-        break;
-      }
-      System.out.println("Two passwords do not match, please input again.");
-    }
-    return password0;
-  }
 }

framework/src/main/java/org/tron/core/config/args/Args.java

@@ -159,6 +159,20 @@ public static void setParam(final String[] args, final String confFileName) {
       Args.printHelp(jc);
       exit(0);
     }
+    // Check assignment, not the field value: JCommander toggles arity-0 booleans
+    // per occurrence, so a repeated flag parses back to false.
+    boolean keystoreFactoryPassed = jc.getParameters().stream()
+        .filter(pd -> "--keystore-factory".equals(pd.getLongestName()))
+        .anyMatch(ParameterDescription::isAssigned);
+    if (keystoreFactoryPassed) {
+      // stderr, not logger: the default logback config has no console appender
+      System.err.println("--keystore-factory was removed.");
+      System.err.println("Use: java -jar Toolkit.jar keystore <new|import|list|update>");
+      System.err.println("SM2 nodes (crypto.engine = 'sm2'): append --sm2 to commands that create "
+          + "or modify a keystore.");
+      throw new TronError("--keystore-factory was removed; use Toolkit.jar keystore",
+          TronError.ErrCode.PARAMETER_INIT);
+    }
 
     // Resolve config file path
     configFilePath = StringUtils.isNoneBlank(cmd.shellConfFileName)
@@ -858,9 +872,6 @@ private static void applyCLIParams(CLIParameter cmd, JCommander jc) {
     if (assigned.contains("--solidity")) {
       PARAMETER.solidityNode = cmd.solidityNode;
     }
-    if (assigned.contains("--keystore-factory")) {
-      PARAMETER.keystoreFactory = cmd.keystoreFactory;
-    }
     if (assigned.contains("--rpc-thread")) {
       PARAMETER.rpcThreadNum = cmd.rpcThreadNum;
     }
@@ -1292,7 +1303,7 @@ private static String getCommitIdAbbrev() {
 
   private static Map<String, String[]> getOptionGroup() {
     String[] tronOption = new String[] {"version", "help", "shellConfFileName", "logbackPath",
-        "eventSubscribe", "solidityNode", "keystoreFactory"};
+        "eventSubscribe", "solidityNode"};
     String[] dbOption = new String[] {"outputDirectory"};
     String[] witnessOption = new String[] {"witness", "privateKey"};
     String[] vmOption = new String[] {"debug"};

framework/src/main/java/org/tron/core/config/args/CLIParameter.java

@@ -50,7 +50,12 @@ public class CLIParameter {
   @Parameter(names = {"--solidity"}, description = "running a solidity node for java tron")
   public boolean solidityNode;
 
-  @Parameter(names = {"--keystore-factory"}, description = "running KeystoreFactory")
+  /**
+   * Tombstone for the removed --keystore-factory: Args.setParam exits with migration
+   * guidance. Keep declared — undeclared, JCommander parses the flag into seedNodes.
+   */
+  @Deprecated
+  @Parameter(names = {"--keystore-factory"}, description = "removed; use Toolkit.jar keystore")
   public boolean keystoreFactory;
 
   @Deprecated

framework/src/main/java/org/tron/core/config/args/WitnessInitializer.java

@@ -97,8 +97,8 @@ public static LocalWitnesses initFromKeystore(
             "Tip: keystores created via `FullNode.jar --keystore-factory` in "
                 + "non-TTY mode were encrypted with only the first "
                 + "whitespace-separated word of the password. Try restarting "
-                + "with only that first word as `-p`, then reset the password "
-                + "via `java -jar Toolkit.jar keystore update`.");
+                + "with only that first word as the password, then reset the "
+                + "password via `java -jar Toolkit.jar keystore update`.");
       }
       throw new TronError(e, TronError.ErrCode.WITNESS_KEYSTORE_LOAD);
     }

framework/src/main/java/org/tron/program/FullNode.java

@@ -29,10 +29,6 @@ public static void main(String[] args) {
 
     LogService.load(parameter.getLogbackPath());
 
-    if (parameter.isKeystoreFactory()) {
-      KeystoreFactory.start();
-      return;
-    }
     if (parameter.isSolidityNode()) {
       logger.info("Solidity node is running.");
       if (StringUtils.isEmpty(parameter.getTrustNodeAddr())) {

framework/src/test/java/org/tron/core/config/args/ArgsTest.java

@@ -20,13 +20,16 @@
 import com.typesafe.config.ConfigFactory;
 import io.grpc.internal.GrpcUtil;
 import io.grpc.netty.NettyServerBuilder;
+import java.io.ByteArrayOutputStream;
+import java.io.PrintStream;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.net.InetAddress;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.Map;
 import lombok.extern.slf4j.Slf4j;
+import org.junit.After;
 import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
@@ -48,9 +51,56 @@ public class ArgsTest {
   @Rule
   public ExpectedException thrown = ExpectedException.none();
 
+  @After
+  public void tearDown() {
+    Args.clearParam();
+  }
+
+  @Test
+  public void testRemovedKeystoreFactoryExitsWithMigrationGuidance() throws Exception {
+    ByteArrayOutputStream errorOutput = new ByteArrayOutputStream();
+    PrintStream capturedError = new PrintStream(errorOutput, true, "UTF-8");
+    PrintStream originalError = System.err;
+
+    try {
+      System.setErr(capturedError);
+
+      TronError exception = Assert.assertThrows(TronError.class,
+          () -> Args.setParam(new String[] {"--keystore-factory"}, TestConstants.TEST_CONF));
+
+      Assert.assertEquals(TronError.ErrCode.PARAMETER_INIT, exception.getErrCode());
+    } finally {
+      System.setErr(originalError);
+      capturedError.close();
+    }
+
+    String errorMessage = errorOutput.toString("UTF-8");
+    Assert.assertTrue(errorMessage.contains("--keystore-factory was removed."));
+    Assert.assertTrue(errorMessage.contains("Toolkit.jar keystore <new|import|list|update>"));
+    Assert.assertTrue(errorMessage.contains(
+        "SM2 nodes (crypto.engine = 'sm2'): append --sm2 to commands that create or modify "
+            + "a keystore."));
+  }
+
+  @Test
+  public void testRemovedKeystoreFactoryRepeatedFlagStillExits() {
+    Assert.assertThrows(TronError.class,
+        () -> Args.setParam(new String[] {"--keystore-factory", "--keystore-factory"},
+            TestConstants.TEST_CONF));
+  }
+
+  @Test
+  public void testRemovedKeystoreFactoryTakesPrecedenceOverInvalidConfig() {
+    TronError exception = Assert.assertThrows(TronError.class,
+        () -> Args.setParam(new String[] {"--keystore-factory", "-c", "no-such-file.conf"},
+            TestConstants.TEST_CONF));
+
+    Assert.assertEquals(TronError.ErrCode.PARAMETER_INIT, exception.getErrCode());
+  }
+
   @Test
   public void get() {
-    Args.setParam(new String[] {"--keystore-factory"}, TestConstants.TEST_CONF);
+    Args.setParam(new String[] {}, TestConstants.TEST_CONF);
 
     CommonParameter parameter = Args.getInstance();
 
@@ -122,8 +172,6 @@ public void get() {
     Assert.assertEquals(address,
         ByteArray.toHexString(Args.getLocalWitnesses()
             .getWitnessAccountAddress()));
-
-    Assert.assertTrue(parameter.isKeystoreFactory());
   }
 
   @Test

framework/src/test/java/org/tron/keystore/WalletUtilsInputPasswordTest.java

@@ -95,23 +95,6 @@ public void testInputPasswordPreservesLeadingAndTrailingSpaces() {
         "  with spaces  ", pw);
   }
 
-  @Test(timeout = 10000)
-  public void testInputPassword2TwicePipedPreservesInternalWhitespace() {
-    // M1: verifies the double-read path (inputPassword2Twice → inputPassword()
-    // called twice) works correctly when both lines arrive on the same
-    // piped stdin. Guards against regressions from Scanner lifecycle issues
-    // where a newly-constructed Scanner could miss bytes buffered by an
-    // earlier Scanner on the same InputStream.
-    System.setIn(new ByteArrayInputStream(
-        ("correct horse battery staple\n"
-            + "correct horse battery staple\n").getBytes(StandardCharsets.UTF_8)));
-
-    String pw = WalletUtils.inputPassword2Twice();
-
-    assertEquals("Full passphrase must survive the double-read path",
-        "correct horse battery staple", pw);
-  }
-
   // ---------- stripPasswordLine() direct unit tests (M3) ----------
 
   @Test