fix: keep block data that evo and LLMQ validation read when pruning

doc/release-notes-7882.md

@@ -0,0 +1,14 @@
+Pruning
+-------
+
+- Pruned nodes now keep the blocks that block validation reads back from disk
+  for the credit pool and for quorum members. From V20 on that is at least the
+  last 2074 blocks on mainnet, testnet and devnet, instead of 288. Before, a
+  node pruned below that could reject a valid block and stop following the
+  chain. At current mainnet block sizes this is far below the minimum `-prune`
+  target, so it mostly affects manual pruning: `pruneblockchain` now returns a
+  lower height when the requested height is within that range. A pruned node
+  now refuses to start, and asks to restart with `-reindex`, if blocks that it
+  needs to validate the next blocks were already pruned, for example by an
+  earlier release. A node that has already rejected a valid block this way also
+  needs `-reindex`. (#7882)

src/Makefile.test.include

@@ -118,6 +118,7 @@ BITCOIN_TESTS =\
   test/evo_mnauth_tests.cpp \
   test/evo_mnhf_tests.cpp \
   test/evo_netinfo_tests.cpp \
+  test/evo_prune_tests.cpp \
   test/evo_sharedmn_tests.cpp \
   test/evo_simplifiedmns_tests.cpp \
   test/evo_snapshot_tests.cpp \

src/evo/creditpool.h

@@ -123,9 +123,9 @@ class CCreditPoolManager
     CEvoDB& evoDb;
     const ChainstateManager& m_chainman;
 
+public:
     static constexpr int DISK_SNAPSHOT_PERIOD = 576; // once per day
 
-public:
     static constexpr CAmount LimitAmountLow = 100 * COIN;
     static constexpr CAmount LimitAmountHigh = 1000 * COIN;
     static constexpr CAmount LimitAmountV22 = 2000 * COIN;

src/evo/specialtxman.cpp

@@ -18,6 +18,7 @@
 #include <llmq/blockprocessor.h>
 #include <llmq/commitment.h>
 #include <llmq/quorumsman.h>
+#include <llmq/snapshot.h>
 #include <llmq/utils.h>
 #include <messagesigner.h>
 
@@ -50,6 +51,26 @@ CSpecialTxProcessor::CSpecialTxProcessor(CEvoDB& evodb, CDeterministicMNManager&
 
 CSpecialTxProcessor::~CSpecialTxProcessor() = default;
 
+int GetEvoPruneLockHeight(const CChainParams& chainparams, int tip_height)
+{
+    // On a cold cache the credit pool is rebuilt from the last disk snapshot, up to DISK_SNAPSHOT_PERIOD blocks back
+    // (the snapshot of a block is only written once the next block connects), reading every block on the way and the
+    // block CreditPoolPeriodBlocks before each of them
+    int depth{CCreditPoolManager::DISK_SNAPSHOT_PERIOD + chainparams.CreditPoolPeriodBlocks()};
+    for (const auto& llmq_params : chainparams.GetConsensus().llmqs) {
+        // Quorum members depend on the coinbase ChainLock in the work block of the quorum. Rotated quorum members
+        // also depend on the work blocks of the three previous cycles, and are stored as a snapshot that the next
+        // three cycles build on. Members and their snapshot are built and stored again whenever they are not cached,
+        // so keep the work blocks of a cycle and of the three cycles before it until the last commitment of the third
+        // cycle after it can be mined.
+        const int cycles{llmq_params.useRotation ? 6 : 0};
+        const int llmq_depth{cycles * llmq_params.dkgInterval + llmq_params.dkgMiningWindowEnd + llmq::WORK_DIFF_DEPTH};
+        depth = std::max(depth, llmq_depth);
+    }
+    // Nothing before the credit pool window of the first V20 block is read
+    return std::max(tip_height - depth, chainparams.GetConsensus().V20Height - chainparams.CreditPoolPeriodBlocks());
+}
+
 static bool AddNetInfoEntries(const std::shared_ptr<NetInfoInterface>& net_info, NetInfoPurpose purpose,
                               const NetInfoList& entries, BlockValidationState& state)
 {

src/evo/specialtxman.h

@@ -19,6 +19,7 @@ class CBlock;
 class CBlockIndex;
 class CCbTx;
 class CChain;
+class CChainParams;
 class CCoinsViewCache;
 class CCreditPoolManager;
 class CDeterministicMNList;
@@ -115,6 +116,12 @@ class CSpecialTxProcessor
                                      CAmount blockSubsidy, BlockValidationState& state) EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
 };
 
+/**
+ * Lowest height whose block data the credit pool and quorum member code may read back from disk while
+ * validating the blocks after tip_height. Pruning has to keep these blocks, see Chainstate::FlushStateToDisk().
+ */
+[[nodiscard]] int GetEvoPruneLockHeight(const CChainParams& chainparams, int tip_height);
+
 /**
  * This helper does some trivial validations that doesn't depends on collateral and
  * masternode list. Use CheckPro*Tx for the full validation of transaction,

src/init.cpp

@@ -597,6 +597,7 @@ void SetupServerArgs(ArgsManager& argsman)
 #endif
     argsman.AddArg("-assumevalid=<hex>", strprintf("If this block is in the chain assume that it and its ancestors are valid and potentially skip their script verification (0 to verify all, default: %s, testnet: %s, devnet: %s)", defaultChainParams->GetConsensus().defaultAssumeValid.GetHex(), testnetChainParams->GetConsensus().defaultAssumeValid.GetHex(), devnetChainParams->GetConsensus().defaultAssumeValid.GetHex()), ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
     argsman.AddArg("-blocksdir=<dir>", "Specify directory to hold blocks subdirectory for *.dat files (default: <datadir>)", ArgsManager::ALLOW_ANY, OptionsCategory::OPTIONS);
+    argsman.AddArg("-evoprunelock", strprintf("Keep the blocks that evo validation reads back from disk when pruning, only disable it for testing (default: %u)", DEFAULT_EVO_PRUNE_LOCK), ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::DEBUG_TEST);
     argsman.AddArg("-fastprune", "Use smaller block files and lower minimum prune height for testing purposes", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::DEBUG_TEST);
     argsman.AddArg("-tinyblk", "Use smaller block files for testing purposes", ArgsManager::ALLOW_ANY | ArgsManager::DEBUG_ONLY, OptionsCategory::DEBUG_TEST);
 #if HAVE_SYSTEM
@@ -2134,7 +2135,7 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
             if (!options.reindex) {
                 bool fRet = uiInterface.ThreadSafeQuestion(
                     error + Untranslated(".\n\n") + _("Do you want to rebuild the block database now?"),
-                    error.original + ".\nPlease restart with -reindex or -reindex-chainstate to recover.",
+                    error.original + (args.GetIntArg("-prune", 0) ? ".\nPlease restart with -reindex to recover." : ".\nPlease restart with -reindex or -reindex-chainstate to recover."),
                     "", CClientUIInterface::MSG_ERROR | CClientUIInterface::BTN_ABORT);
                 if (fRet) {
                     fReindex = true;

src/kernel/chainstatemanager_opts.h

@@ -20,6 +20,7 @@ struct SuperblockStatus;
 
 static constexpr bool DEFAULT_CHECKPOINTS_ENABLED{true};
 static constexpr auto DEFAULT_MAX_TIP_AGE{6h}; // ~144 blocks behind -> 2 x fork detection time, was 24h in bitcoin
+static constexpr bool DEFAULT_EVO_PRUNE_LOCK{true};
 
 namespace kernel {
 
@@ -38,6 +39,9 @@ struct ChainstateManagerOpts {
     std::optional<uint256> assumed_valid_block{};
     //! If the tip is older than this, the node is considered to be in initial block download.
     std::chrono::seconds max_tip_age{DEFAULT_MAX_TIP_AGE};
+    //! Dash: keep the blocks evo validation reads back from disk when pruning, see GetEvoPruneLockHeight(). Only
+    //! disabled in tests, to get a datadir pruned without them.
+    bool evo_prune_lock{DEFAULT_EVO_PRUNE_LOCK};
     //! Dash: governance's superblock status for a block height, consulted by
     //! block validation and the miner. Unset means superblock validation is disabled.
     std::function<SuperblockStatus(const CDeterministicMNList& mn_list, int nBlockHeight)> superblock_status{};

src/node/blockstorage.h

@@ -149,7 +149,8 @@ class BlockManager
     std::set<int> m_dirty_fileinfo;
 
     /**
-     * Map from external index name to oldest block that must not be pruned.
+     * Map from external index name (or "evo", see Chainstate::FlushStateToDisk()) to oldest block that must not be
+     * pruned.
      *
      * @note Internally, only blocks at height (height_first - PRUNE_LOCK_BUFFER - 1) and
      * below will be pruned, but callers should avoid assuming any particular buffer size.

src/node/chainstate.cpp

@@ -262,6 +262,19 @@ static ChainstateLoadResult CompleteChainstateInitialization(ChainstateManager&
         }
     }
 
+    // Blocks pruned without the "evo" prune lock, e.g. by an earlier release, may be missing blocks that validating the
+    // next blocks reads. A snapshot chainstate has no blocks below its base, -reindex can't help it.
+    if (chainman.m_blockman.m_have_pruned && !chainman.IsSnapshotActive() &&
+        !is_coinsview_empty(&chainman.ActiveChainstate())) {
+        const CBlockIndex* missing{FindMissingEvoBlockData(chainman.GetParams(), chainman.ActiveTip())};
+        if (missing) {
+            return {ChainstateLoadStatus::FAILURE,
+                    strprintf(_("Block %d, which is needed to validate new blocks, has been pruned. You need to "
+                                "rebuild the database using -reindex. This will redownload the entire blockchain"),
+                              missing->nHeight)};
+        }
+    }
+
     if (!special_tx.m_mnhfman->ForceSignalDBUpdate(chainman.ActiveTip())) {
         return {ChainstateLoadStatus::FAILURE, _("Error upgrading evo database for EHF")};
     }

src/node/chainstatemanager_args.cpp

@@ -34,6 +34,8 @@ std::optional<bilingual_str> ApplyArgsManOptions(const ArgsManager& args, Chains
 
     if (auto value{args.GetIntArg("-maxtipage")}) opts.max_tip_age = std::chrono::seconds{*value};
 
+    if (auto value{args.GetBoolArg("-evoprunelock")}) opts.evo_prune_lock = *value;
+
     return std::nullopt;
 }
 } // namespace node

src/test/evo_prune_tests.cpp

@@ -0,0 +1,162 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <test/util/setup_common.h>
+
+#include <chain.h>
+#include <chainparams.h>
+#include <chainparamsbase.h>
+#include <evo/creditpool.h>
+#include <evo/specialtxman.h>
+#include <llmq/snapshot.h>
+#include <util/system.h>
+#include <validation.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <string>
+
+BOOST_FIXTURE_TEST_SUITE(evo_prune_tests, BasicTestingSetup)
+
+BOOST_AUTO_TEST_CASE(evo_prune_lock_depth)
+{
+    // Mainnet, testnet and devnet: rebuilding LLMQ_60_75 members (dkgInterval 288, dkgMiningWindowEnd 50) dominates.
+    // Regtest: rebuilding the credit pool (snapshot period 576, CreditPoolPeriodBlocks 100) dominates.
+    const std::pair<std::string, int> expected_depths[]{
+        {CBaseChainParams::MAIN, 6 * 288 + 50 + 8},
+        {CBaseChainParams::TESTNET, 6 * 288 + 50 + 8},
+        {CBaseChainParams::DEVNET, 6 * 288 + 50 + 8},
+        {CBaseChainParams::REGTEST, 576 + 100},
+    };
+    for (const auto& [chain, depth] : expected_depths) {
+        const auto params{CreateChainParams(ArgsManager{}, chain)};
+        const int tip{params->GetConsensus().V20Height + 10'000};
+        BOOST_CHECK_EQUAL(GetEvoPruneLockHeight(*params, tip), tip - depth);
+    }
+}
+
+BOOST_AUTO_TEST_CASE(evo_prune_lock_keeps_rotated_quorum_work_blocks)
+{
+    for (const auto& chain :
+         {CBaseChainParams::MAIN, CBaseChainParams::TESTNET, CBaseChainParams::DEVNET, CBaseChainParams::REGTEST}) {
+        const auto params{CreateChainParams(ArgsManager{}, chain)};
+        const auto& consensus{params->GetConsensus()};
+        for (const auto& llmq_params : consensus.llmqs) {
+            if (!llmq_params.useRotation) continue;
+            const int interval{llmq_params.dkgInterval};
+            const int cycle_base{(consensus.V20Height / interval + 10) * interval};
+            // The last block that can carry a commitment of the cycle connects on top of this tip
+            const int tip{cycle_base + llmq_params.dkgMiningWindowEnd - 1};
+            // Its members are built from the work blocks of the cycle and of the three previous cycles, and the
+            // members of the oldest of these cycles were built from the work blocks of the three cycles before it
+            const int oldest_work_block{cycle_base - 6 * interval - llmq::WORK_DIFF_DEPTH};
+            BOOST_CHECK_LE(GetEvoPruneLockHeight(*params, tip), oldest_work_block);
+        }
+    }
+}
+
+BOOST_AUTO_TEST_CASE(evo_prune_lock_keeps_credit_pool_blocks)
+{
+    for (const auto& chain :
+         {CBaseChainParams::MAIN, CBaseChainParams::TESTNET, CBaseChainParams::DEVNET, CBaseChainParams::REGTEST}) {
+        const auto params{CreateChainParams(ArgsManager{}, chain)};
+        const int period{CCreditPoolManager::DISK_SNAPSHOT_PERIOD};
+        // A rebuild on a cold cache starts furthest back when the tip is at a disk snapshot height, as the snapshot of
+        // the tip is only written once the next block connects
+        const int tip{(params->GetConsensus().V20Height / period + 10) * period};
+        // The first block after the previous snapshot reads the block CreditPoolPeriodBlocks before it
+        const int oldest_read{tip - period + 1 - params->CreditPoolPeriodBlocks()};
+        BOOST_CHECK_LE(GetEvoPruneLockHeight(*params, tip), oldest_read);
+    }
+}
+
+struct RegTestV20At2000Setup : public BasicTestingSetup {
+    RegTestV20At2000Setup() :
+        BasicTestingSetup{CBaseChainParams::REGTEST, {"-testactivationheight=v20@2000", "-testactivationheight=mn_rr@2000"}}
+    {
+    }
+};
+
+BOOST_FIXTURE_TEST_CASE(evo_prune_lock_before_v20, RegTestV20At2000Setup)
+{
+    const CChainParams& params{Params()};
+    BOOST_REQUIRE_EQUAL(params.GetConsensus().V20Height, 2000);
+    // Nothing before the credit pool window of the first V20 block is read
+    BOOST_CHECK_EQUAL(GetEvoPruneLockHeight(params, 1000), 2000 - 100);
+    BOOST_CHECK_EQUAL(GetEvoPruneLockHeight(params, 2000 + 576), 2000 - 100);
+    BOOST_CHECK_EQUAL(GetEvoPruneLockHeight(params, 2000 + 576 + 1), 2000 - 100 + 1);
+    BOOST_CHECK_EQUAL(GetEvoPruneLockHeight(params, 5000), 5000 - (576 + 100));
+}
+
+// Link blocks into a chain of block indexes from first_height on, all with data
+static void MakeChain(std::vector<CBlockIndex>& blocks, int first_height) EXCLUSIVE_LOCKS_REQUIRED(::cs_main)
+{
+    for (size_t i{0}; i < blocks.size(); ++i) {
+        blocks[i].nHeight = first_height + static_cast<int>(i);
+        blocks[i].pprev = i > 0 ? &blocks[i - 1] : nullptr;
+        blocks[i].nStatus = BLOCK_HAVE_DATA;
+    }
+}
+
+// The height of the block FindMissingEvoBlockData() reports for the last block when only the block at missing_height
+// has no data, or -1 for none
+static int FindMissingWith(const CChainParams& params, std::vector<CBlockIndex>& blocks, int missing_height)
+    EXCLUSIVE_LOCKS_REQUIRED(::cs_main)
+{
+    CBlockIndex& missing{blocks.at(missing_height - blocks.front().nHeight)};
+    missing.nStatus &= ~BLOCK_HAVE_DATA;
+    const CBlockIndex* found{FindMissingEvoBlockData(params, &blocks.back())};
+    missing.nStatus |= BLOCK_HAVE_DATA;
+    return found ? found->nHeight : -1;
+}
+
+BOOST_AUTO_TEST_CASE(evo_prune_find_missing_block_data)
+{
+    LOCK(cs_main);
+    const auto params{CreateChainParams(ArgsManager{}, CBaseChainParams::MAIN)};
+    const auto llmq_params{params->GetLLMQ(Consensus::LLMQType::LLMQ_60_75)};
+    BOOST_REQUIRE(llmq_params && llmq_params->useRotation);
+    const int interval{llmq_params->dkgInterval};
+    const int period{CCreditPoolManager::DISK_SNAPSHOT_PERIOD};
+    // A cycle of rotated quorums that starts at a credit pool snapshot height, with a commitment mined on top of tip
+    const int cycle_base{(params->GetConsensus().V20Height / period + 10) * period};
+    BOOST_REQUIRE_EQUAL(cycle_base % interval, 0);
+    const int tip{cycle_base + 40};
+    // Its members are built from the work block of the third cycle before it, which is older than any block that the
+    // credit pool reads for the next block (from the snapshot of cycle_base on)
+    const int work_block{cycle_base - 3 * interval - llmq::WORK_DIFF_DEPTH};
+    BOOST_REQUIRE_LT(work_block, cycle_base + 1 - params->CreditPoolPeriodBlocks());
+
+    const int height_first{GetEvoPruneLockHeight(*params, tip)};
+    BOOST_CHECK_EQUAL(height_first, tip - (6 * 288 + 50 + 8));
+    // The lock keeps more blocks below them for a reorg, which a rewound tip may have used up, so these aren't checked
+    const int lock_first{GetEvoPruneLockHeightForTip(*params, tip)};
+    BOOST_CHECK_EQUAL(lock_first, height_first - static_cast<int>(MIN_BLOCKS_TO_KEEP));
+    std::vector<CBlockIndex> blocks(tip - (lock_first - 10) + 1);
+    MakeChain(blocks, lock_first - 10);
+    BOOST_CHECK(FindMissingEvoBlockData(*params, &blocks.back()) == nullptr);
+    BOOST_CHECK_EQUAL(FindMissingWith(*params, blocks, work_block), work_block);
+    BOOST_CHECK_EQUAL(FindMissingWith(*params, blocks, tip), tip);
+    BOOST_CHECK_EQUAL(FindMissingWith(*params, blocks, height_first), height_first);
+    BOOST_CHECK_EQUAL(FindMissingWith(*params, blocks, height_first - 1), -1);
+    BOOST_CHECK_EQUAL(FindMissingWith(*params, blocks, lock_first), -1);
+}
+
+BOOST_AUTO_TEST_CASE(evo_prune_find_missing_block_data_before_v20)
+{
+    LOCK(cs_main);
+    const auto params{CreateChainParams(ArgsManager{}, CBaseChainParams::REGTEST)};
+    // Nothing before the credit pool window of the V20 activation block is kept or checked
+    const int floor{params->GetConsensus().V20Height - params->CreditPoolPeriodBlocks()};
+    std::vector<CBlockIndex> blocks(floor + 11);
+    MakeChain(blocks, 0);
+    BOOST_CHECK_EQUAL(FindMissingWith(*params, blocks, floor), floor);
+    BOOST_CHECK_EQUAL(FindMissingWith(*params, blocks, floor - 1), -1);
+    // A chain that ends below it isn't checked at all
+    std::vector<CBlockIndex> short_blocks(floor);
+    MakeChain(short_blocks, 0);
+    BOOST_CHECK_EQUAL(FindMissingWith(*params, short_blocks, floor - 1), -1);
+}
+
+BOOST_AUTO_TEST_SUITE_END()

src/validation.cpp

@@ -3191,6 +3191,11 @@ bool Chainstate::FlushStateToDisk(
         CoinsCacheSizeState cache_state = GetCoinsCacheSizeState();
         LOCK(m_blockman.cs_LastBlockFile);
         if (m_blockman.IsPruneMode() && (m_blockman.m_check_for_pruning || nManualPruneHeight > 0) && !fReindex) {
+            if (m_chainman.m_options.evo_prune_lock) {
+                m_blockman.UpdatePruneLock("evo", {.height_first = GetEvoPruneLockHeightForTip(m_chainman.GetParams(),
+                                                                                               m_chain.Height())});
+            }
+
             // make sure we don't prune above any of the prune locks bestblocks
             // pruning is height-based
             int last_prune{m_chain.Height()}; // last height we can prune
@@ -5186,6 +5191,26 @@ void PruneBlockFilesManual(Chainstate& active_chainstate, int nManualPruneHeight
     }
 }
 
+int GetEvoPruneLockHeightForTip(const CChainParams& chainparams, int tip_height)
+{
+    // evo and LLMQ validation reads blocks from disk further back than MIN_BLOCKS_TO_KEEP, also for the blocks
+    // connected after a reorg of up to MIN_BLOCKS_TO_KEEP blocks
+    return GetEvoPruneLockHeight(chainparams, tip_height - static_cast<int>(MIN_BLOCKS_TO_KEEP));
+}
+
+const CBlockIndex* FindMissingEvoBlockData(const CChainParams& chainparams, const CBlockIndex* tip)
+{
+    AssertLockHeld(::cs_main);
+    if (tip == nullptr) return nullptr;
+    // The blocks that validating the next blocks reads. The lock keeps more below them for a reorg, but a node that
+    // rewound its tip, e.g. with invalidateblock, may have used those up and can still connect the next blocks.
+    const int height_first{GetEvoPruneLockHeight(chainparams, tip->nHeight)};
+    for (const CBlockIndex* pindex{tip}; pindex != nullptr && pindex->nHeight >= height_first; pindex = pindex->pprev) {
+        if (!(pindex->nStatus & BLOCK_HAVE_DATA)) return pindex;
+    }
+    return nullptr;
+}
+
 void Chainstate::LoadMempool(const fs::path& load_path, FopenFn mockable_fopen_function)
 {
     if (!m_mempool) return;