From 254fe94680795c28d13dd0b81574af28c222de5e Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 3 Nov 2026 04:42:03 +0000
Subject: [PATCH 1/6] Merge bitcoin/bitcoin#33212: index: Don't commit state in
 BaseIndex::Rewind

a602f6fb7bf5f9e57299f4d6e246c82379fad8d2 test: index with an unclean restart after a reorg (Martin Zumsande)
01b95ac6f496e24e525b2fc9d69ee8b543da65ff index: don't commit state in BaseIndex::Rewind (Martin Zumsande)

Pull request description:

  The committed state of an index should never be ahead of the flushed chainstate.
  Otherwise, in the case of an unclean shutdown, the blocks necessary to revert
  from the prematurely committed state are not be available, which would corrupt the coinstatsindex in particular.
  Instead, the index state will be committed with the next ChainStateFlushed notification.

  Fixes #33208

ACKs for top commit:
  achow101:
    ACK a602f6fb7bf5f9e57299f4d6e246c82379fad8d2
  stickies-v:
    re-ACK a602f6fb7bf5f9e57299f4d6e246c82379fad8d2

Tree-SHA512: 2559ea3fe066caf746a54ad7daac5031332f3976848e937c3dc8b35fa2ce925674115d8742458bf3703b3916f04f851c26523b6b94aeb1da651ba5a1b167a419

BACKPORT NOTE:
The unclean-restart scenario calls syncwithvalidationinterfacequeue before the kill: the index stays
"synced" across the reorg, so without it the kill can land before Rewind() and the test passes without the fix.
Dash's TestNode has no kill_process(), so the functional test kills the process directly and
expects the same exit code (-9, or 1 on Windows) that upstream's helper checks.
---
 src/index/base.cpp                        |  9 ++-------
 test/functional/feature_coinstatsindex.py | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/src/index/base.cpp b/src/index/base.cpp
index 42f6f12df59c..b655fa4e552f 100644
--- a/src/index/base.cpp
+++ b/src/index/base.cpp
@@ -274,18 +274,13 @@ bool BaseIndex::Rewind(const CBlockIndex* current_tip, const CBlockIndex* new_ti
         return false;
     }
 
-    // In the case of a reorg, ensure persisted block locator is not stale.
+    // Don't commit here - the committed index state must never be ahead of the
+    // flushed chainstate, otherwise unclean restarts would lead to index corruption.
     // Pruning has a minimum of 288 blocks-to-keep and getting the index
     // out of sync may be possible but a users fault.
     // In case we reorg beyond the pruned depth, ReadBlockFromDisk would
     // throw and lead to a graceful shutdown
     SetBestBlockIndex(new_tip);
-    if (!Commit()) {
-        // If commit fails, revert the best block index to avoid corruption.
-        SetBestBlockIndex(current_tip);
-        return false;
-    }
-
     return true;
 }
 
diff --git a/test/functional/feature_coinstatsindex.py b/test/functional/feature_coinstatsindex.py
index ba5b44635d25..164ab1f81c39 100755
--- a/test/functional/feature_coinstatsindex.py
+++ b/test/functional/feature_coinstatsindex.py
@@ -12,6 +12,7 @@
 import struct
 
 from decimal import Decimal
+import platform
 
 from test_framework.blocktools import (
     create_block,
@@ -333,6 +334,25 @@ def _test_init_index_after_reorg(self):
         res1 = index_node.gettxoutsetinfo(hash_type='muhash', hash_or_height=None, use_index=True)
         assert_equal(res["muhash"], res1["muhash"])
 
+        self.log.info("Test index with an unclean restart after a reorg")
+        self.restart_node(1, extra_args=self.extra_args[1])
+        committed_height = index_node.getblockcount()
+        self.generate(index_node, 2, sync_fun=self.no_op)
+        self.sync_index_node()
+        block2 = index_node.getbestblockhash()
+        index_node.invalidateblock(block2)
+        self.generatetoaddress(index_node, 1, getnewdestination()[2], sync_fun=self.no_op)
+        self.sync_index_node()
+        # The index stays "synced" across the reorg, so make sure it has processed the rewind before the kill.
+        index_node.syncwithvalidationinterfacequeue()
+        index_node.process.kill()
+        index_node.process.wait()
+        assert index_node.is_node_stopped(expected_ret_code=1 if platform.system() == "Windows" else -9)
+        self.start_node(1, extra_args=self.extra_args[1])
+        self.sync_index_node()
+        # Because of the unclean shutdown above, indexes reset to the point we last committed them to disk.
+        assert_equal(index_node.getindexinfo()['coinstatsindex']['best_block_height'], committed_height)
+
 
 if __name__ == '__main__':
     CoinStatsIndexTest().main()

From 582821e4a4e96e546f8e13d306e3533977e68a19 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 3 Nov 2026 04:46:52 +0000
Subject: [PATCH 2/6] Merge bitcoin/bitcoin#34897: indexes: Don't commit ahead
 of the flushed chainstate

e9ed898a0da064715c8ef66a71ee72c3a35e008b validation: Don't use m_chain.Tip() in FlushStateToDisk (Martin Zumsande)
3679f1ecf5ec25d9a40a23e48797a8c22fa3cb99 index: Don't commit ahead of the flushed chainstate (Martin Zumsande)
65735728a5a9c1803f1f5517717936581a4aa125 index: Remove return value from Commit() (Martin Zumsande)
09c06960c6a2b4d037dedbf727dcd5eca53b7c7a validation: track last flushed block (Martin Zumsande)
13c02b5466d9bebb2b3f39deb0ab1ca06b52f4cf test: add test for index commits ahead of the last flushed block (Martin Zumsande)

Pull request description:

  If indexes commit their data ahead of the flushed chainstate, and there is an unclean shutdown, the index will be corrupted. This is especially the case for the coinstatsindex, which has state (the muhash) which can't easily be rolled back without access to the blocks. This was only partly fixed in #33212 (for reorg scenarios) but could still happen during initial sync.

  Fix this more thoroughly by having the node keep track of the last flushed block, and skipping index commits if the current block of the index is not an ancestor of the node's last flushed block (similar to the suggestion by stickies-v in https://github.com/bitcoin/bitcoin/pull/33212#pullrequestreview-31408570890.

  Fixes #33208
  Fixes #34261

ACKs for top commit:
  achow101:
    ACK e9ed898a0da064715c8ef66a71ee72c3a35e008b
  sedited:
    Re-ACK e9ed898a0da064715c8ef66a71ee72c3a35e008b
  fjahr:
    re-ACK e9ed898a0da064715c8ef66a71ee72c3a35e008b

Tree-SHA512: 7f4dc6fb942d6726587eb75dece24c79c679d8630320502aca9fa2d2b03b1d25999cd11255ec20344ebbb8985552747e2554e2557b9d2ad0c75db71652d615ab

BACKPORT NOTE:
- Commit() keeps Dash's existing LogError call; LogDebug becomes LogPrint(BCLog::COINDB, ...).
- In FlushStateToDisk the last flushed block is recorded right after the coins flush, as upstream does; Dash
  then commits EvoDB in the same flush before ChainStateFlushed is sent.
- src/test/chainstate_write_tests.cpp does not exist in Dash, so its two assertions are not ported.
- baseindex_tests uses Dash's index API: Init() and Sync() are private here, so the test starts the index
  and holds back the sync thread with g_indexes_ready_to_sync to read the committed best block.
---
 src/Makefile.test.include    |  1 +
 src/index/base.cpp           | 15 ++++++--
 src/index/base.h             | 12 ++----
 src/test/baseindex_tests.cpp | 73 ++++++++++++++++++++++++++++++++++++
 src/validation.cpp           |  5 ++-
 src/validation.h             |  4 ++
 6 files changed, 97 insertions(+), 13 deletions(-)
 create mode 100644 src/test/baseindex_tests.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index a145cbdec341..bbb90e659864 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -82,6 +82,7 @@ BITCOIN_TESTS =\
   test/base32_tests.cpp \
   test/base58_tests.cpp \
   test/base64_tests.cpp \
+  test/baseindex_tests.cpp \
   test/bech32_tests.cpp \
   test/bip32_tests.cpp \
   test/bip324_tests.cpp \
diff --git a/src/index/base.cpp b/src/index/base.cpp
index b655fa4e552f..e6643ec02a1e 100644
--- a/src/index/base.cpp
+++ b/src/index/base.cpp
@@ -245,12 +245,23 @@ void BaseIndex::ThreadSync()
     }
 }
 
-bool BaseIndex::Commit()
+void BaseIndex::Commit()
 {
     // Don't commit anything if we haven't indexed any block yet
     // (this could happen if init is interrupted).
     bool ok = m_best_block_index != nullptr;
     if (ok) {
+        // Don't commit if the index best block is not an ancestor of the chainstate's last flushed
+        // block. Otherwise, after an unclean shutdown, the index could be
+        // persisted ahead of a chainstate it can no longer roll back to, which
+        // would corrupt indexes with state (e.g. coinstatsindex).
+        const CBlockIndex* index_tip = m_best_block_index.load();
+        const CBlockIndex* last_flushed = WITH_LOCK(::cs_main, return m_chainstate->GetLastFlushedBlock());
+        if (!last_flushed || last_flushed->GetAncestor(index_tip->nHeight) != index_tip) {
+            LogPrint(BCLog::COINDB, "Skipping commit, index is ahead of flushed chainstate (index height %d, last flush at height %d)\n",
+                     index_tip->nHeight, last_flushed ? last_flushed->nHeight : -1);
+            return;
+        }
         CDBBatch batch(GetDB());
         ok = CustomCommit(batch);
         if (ok) {
@@ -260,9 +271,7 @@ bool BaseIndex::Commit()
     }
     if (!ok) {
         LogError("%s: Failed to commit latest %s state\n", __func__, GetName());
-        return false;
     }
-    return true;
 }
 
 bool BaseIndex::Rewind(const CBlockIndex* current_tip, const CBlockIndex* new_tip)
diff --git a/src/index/base.h b/src/index/base.h
index db67924d9e75..1a6e5344ce35 100644
--- a/src/index/base.h
+++ b/src/index/base.h
@@ -82,14 +82,10 @@ class BaseIndex : public CValidationInterface
     void ThreadSync();
 
     /// Write the current index state (eg. chain block locator and subclass-specific items) to disk.
-    ///
-    /// Recommendations for error handling:
-    /// If called on a successor of the previous committed best block in the index, the index can
-    /// continue processing without risk of corruption, though the index state will need to catch up
-    /// from further behind on reboot. If the new state is not a successor of the previous state (due
-    /// to a chain reorganization), the index must halt until Commit succeeds or else it could end up
-    /// getting corrupted.
-    bool Commit();
+    /// Will skip the commit if no block has been indexed yet or if the index's best block is
+    /// ahead of the chainstate's last flushed block. This avoids persisting state an unclean shutdown
+    /// could not roll back from. A later call commits when the chainstate has flushed far enough.
+    void Commit();
 
     /// Loop over disconnected blocks and call CustomRewind.
     bool Rewind(const CBlockIndex* current_tip, const CBlockIndex* new_tip);
diff --git a/src/test/baseindex_tests.cpp b/src/test/baseindex_tests.cpp
new file mode 100644
index 000000000000..6f60fb935cd1
--- /dev/null
+++ b/src/test/baseindex_tests.cpp
@@ -0,0 +1,73 @@
+// Copyright (c) 2020-present The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <index/coinstatsindex.h>
+#include <interfaces/chain.h>
+#include <node/blockstorage.h>
+#include <script/script.h>
+#include <test/util/index.h>
+#include <test/util/setup_common.h>
+#include <util/check.h>
+#include <validation.h>
+#include <validationinterface.h>
+
+#include <boost/test/unit_test.hpp>
+
+// Tests of generic BaseIndex functionality that is independent of which
+// concrete index is being used. CoinStatsIndex is used here merely as a
+// convenient instantiation of BaseIndex.
+BOOST_AUTO_TEST_SUITE(baseindex_tests)
+
+// Test that the index does not commit ahead of the chainstate's last
+// flushed block. If it did, a subsequent unclean shutdown would corrupt
+// the index, because during reverting it would require blocks that were
+// never flushed to disk.
+BOOST_FIXTURE_TEST_CASE(baseindex_no_commit_ahead_of_flush, TestChain100Setup)
+{
+    Chainstate& chainstate = Assert(m_node.chainman)->ActiveChainstate();
+    auto sync_index = [&](bool do_flush, int expected_sync_height, int expected_commit_height) {
+        {
+            CoinStatsIndex index{interfaces::MakeChain(m_node), /*n_cache_size=*/1 << 20};
+            BOOST_REQUIRE(index.Start());
+            IndexWaitSynced(index);
+            if (do_flush) {
+                chainstate.ForceFlushStateToDisk();
+                SyncWithValidationInterfaceQueue();
+            }
+            BOOST_CHECK_EQUAL(index.GetSummary().best_block_height, expected_sync_height);
+            index.Stop();
+        }
+        // Reload index to see which block data was actually committed. Hold back the
+        // sync thread so the loaded best block is not advanced before it is read.
+        node::g_indexes_ready_to_sync = false;
+        {
+            CoinStatsIndex index{interfaces::MakeChain(m_node), /*n_cache_size=*/1 << 20};
+            BOOST_REQUIRE(index.Start());
+            BOOST_CHECK_EQUAL(index.GetSummary().best_block_height, expected_commit_height);
+            index.Interrupt();
+            index.Stop();
+        }
+        node::g_indexes_ready_to_sync = true;
+    };
+
+    // Part 1: Sync, then "crash" (stop without flushing). Models a node that
+    // started up, had its index catch up, but never flushed before going down.
+    // The end-of-sync Commit() runs at chain tip (height 100) but the last
+    // flushed block is behind it, so it is skipped.
+    sync_index(false, 100, 0);
+
+    // Part 2: Restart cleanly. Sync, force a chainstate flush, and drain the
+    // validation queue so the index's ChainStateFlushed callback runs.
+    // Now the last flushed block == tip == 100 and the index can commit.
+    sync_index(true, 100, 100);
+
+    // Part 3: Connect a new block on the chain without flushing
+    // (the last flushed block stays at 100). For a real node this would happen
+    // in parallel with Sync(). Here we do it before Sync() to make the race
+    // state deterministic.
+    CreateAndProcessBlock({}, CScript() << OP_TRUE);
+    sync_index(false, 101, 100);
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index c0934f9271e0..aac9744fea9b 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -3317,6 +3317,7 @@ bool Chainstate::FlushStateToDisk(
                 // Flush the chainstate (which may refer to block index entries).
                 if (!CoinsTip().Flush())
                     return AbortNode(state, "Failed to write to coin database");
+                m_last_flushed_block = m_blockman.LookupBlockIndex(CoinsTip().GetBestBlock());
             }
             {
                 LOG_TIME_SECONDS("write evodb cache to disk");
@@ -3335,9 +3336,8 @@ bool Chainstate::FlushStateToDisk(
         }
     }
     if (full_flush_completed && this == &m_chainman.ActiveChainstate()) {
-        // Update best block in wallet (so we can detect restored wallets).
         // TODO(assumeutxo): upstream tags this notification with ChainstateRole instead of suppressing; adopt when backporting index/wallet assumeutxo support.
-        GetMainSignals().ChainStateFlushed(m_chain.GetLocator());
+        GetMainSignals().ChainStateFlushed(GetLocator(m_last_flushed_block));
     }
     } catch (const std::runtime_error& e) {
         return AbortNode(state, std::string("System error while flushing: ") + e.what());
@@ -5232,6 +5232,7 @@ bool Chainstate::LoadChainTip()
         return false;
     }
     m_chain.SetTip(*pindex);
+    m_last_flushed_block = pindex;
     PruneBlockIndexCandidates();
 
     tip = m_chain.Tip();
diff --git a/src/validation.h b/src/validation.h
index 255451d0d926..c51a7d710bcd 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -777,6 +777,9 @@ class Chainstate
 
     std::string ToString() EXCLUSIVE_LOCKS_REQUIRED(::cs_main);
 
+    //! Get the last block that was flushed to disk.
+    const CBlockIndex* GetLastFlushedBlock() const EXCLUSIVE_LOCKS_REQUIRED(::cs_main) { return m_last_flushed_block; }
+
     //! Indirection necessary to make lock annotations work with an optional mempool.
     RecursiveMutex* MempoolMutex() const LOCK_RETURNED(m_mempool->cs)
     {
@@ -825,6 +828,7 @@ class Chainstate
 
     SteadyClock::time_point m_last_write{};
     SteadyClock::time_point m_last_flush{};
+    const CBlockIndex* m_last_flushed_block GUARDED_BY(::cs_main){nullptr};
 
     /**
      * In case of an invalid snapshot, rename the coins leveldb directory so

From 319074f5c08f517b9ae3ab91e6f0a60f88216745 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 3 Nov 2026 04:48:15 +0000
Subject: [PATCH 3/6] test: blocks orphaned while the address index is disabled
 are removed from it

A node that runs without -addressindex across a reorg and then enables it
again must rewind the index past the orphaned blocks instead of keeping
their entries. Before bitcoin#25193 (85885880a22) the index resumed from
the fork point of its locator and never removed them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/functional/feature_addressindex.py | 26 ++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/test/functional/feature_addressindex.py b/test/functional/feature_addressindex.py
index 8986d4a15930..e14c23de942e 100755
--- a/test/functional/feature_addressindex.py
+++ b/test/functional/feature_addressindex.py
@@ -19,7 +19,8 @@
     keyhash_to_p2pkh_script,
     scripthash_to_p2sh_script,
 )
-from test_framework.util import assert_equal
+from test_framework.util import assert_equal, assert_greater_than
+from test_framework.wallet import getnewdestination
 
 class AddressIndexTest(BitcoinTestFramework):
     def add_options(self, parser):
@@ -341,8 +342,31 @@ def run_test(self):
         mempool_deltas = self.nodes[2].getaddressmempool({"addresses": [address1]})
         assert_equal(len(mempool_deltas), 2)
 
+        self.test_reorg_while_disabled()
+
         self.log.info("Passed")
 
+    def wait_index_synced(self, node):
+        self.wait_until(lambda: node.getindexinfo()["addressindex"] == {"synced": True, "best_block_height": node.getblockcount()})
+
+    def test_reorg_while_disabled(self):
+        self.log.info("Test that blocks orphaned while the index was disabled are removed from it")
+        node = self.nodes[3]
+        self.disconnect_nodes(0, 3)
+        orphan_address = getnewdestination()[2]
+        orphan_block = self.generatetoaddress(node, 1, orphan_address, sync_fun=self.no_op)[0]
+        self.wait_index_synced(node)
+        assert_greater_than(node.getaddressbalance(orphan_address)["received"], 0)
+
+        self.restart_node(3, ["-addressindex=0"])
+        node.invalidateblock(orphan_block)
+        self.generatetoaddress(node, 2, getnewdestination()[2], sync_fun=self.no_op)
+
+        self.restart_node(3, ["-addressindex"])
+        self.wait_index_synced(node)
+        assert_equal(node.getaddressbalance(orphan_address)["received"], 0)
+        assert_equal(node.getaddresstxids(orphan_address), [])
+
 
 if __name__ == '__main__':
     AddressIndexTest().main()

From c05252f825b9f733814ae12f2faa54d3a462e773 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 3 Nov 2026 05:08:58 +0000
Subject: [PATCH 4/6] fix(index): don't let the governance collateral index
 persist a rewind ahead of the flush

GovCollateralIndex::CustomRewind writes the rewound locator in the same batch as the
erased collaterals. Like the commit bitcoin#33212 removed from BaseIndex::Rewind, that
locator can name a block that is not in the on-disk block index yet. After an unclean
shutdown the index then fails BaseIndex::Init with "best block of the index not found",
and since this index is always on, the node does not start.

Write the locator only when the new tip is an ancestor of the chainstate's last flushed
block, the same condition bitcoin#34897 adds to BaseIndex::Commit().

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/index/govcollateralindex.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/index/govcollateralindex.cpp b/src/index/govcollateralindex.cpp
index cab00c694e1c..5264cda1e1fe 100644
--- a/src/index/govcollateralindex.cpp
+++ b/src/index/govcollateralindex.cpp
@@ -117,7 +117,12 @@ bool GovCollateralIndex::CustomRewind(const interfaces::BlockKey& current_tip, c
             m_db->EraseCollateral(batch, txid);
         }
     }
-    m_db->WriteBestBlock(batch, GetLocator(new_tip_index));
+    // Like BaseIndex::Commit(), never persist a locator ahead of the chainstate's last flushed block: after an
+    // unclean shutdown the block index might not know it, and the index would refuse to load.
+    const CBlockIndex* last_flushed{WITH_LOCK(::cs_main, return m_chainstate->GetLastFlushedBlock())};
+    if (last_flushed && last_flushed->GetAncestor(new_tip_index->nHeight) == new_tip_index) {
+        m_db->WriteBestBlock(batch, GetLocator(new_tip_index));
+    }
     return m_db->WriteBatch(batch);
 }
 

From e8325a1ab0736674a71e7e1ffaf83a3983aac1b6 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 3 Nov 2026 06:51:39 +0000
Subject: [PATCH 5/6] fix(validation): don't announce a flushed block before it
 is connected

bitcoin#34897 announces the last flushed block in ChainStateFlushed. Upstream
only indexes listen to that signal, since bitcoin#30221 stopped the wallet from
storing its locator. Dash's wallet still writes the announced locator as its
best block. A flush inside ConnectTip() happens after the coins are updated but
before the block is part of m_chain and before its BlockConnected is queued, so
the wallet could record the block it is about to scan as the chain tip. A crash
in that window would skip the rescan on restart and miss the block's
transactions.

Announce the most recent flushed block that is part of the active chain. That
is the parent while ConnectTip() is connecting a block, which is what was
announced before bitcoin#34897, and the flushed parent after DisconnectTip(),
which keeps the upstream fix for that case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/test/validation_flush_tests.cpp | 49 +++++++++++++++++++++++++++++
 src/validation.cpp                  |  7 ++++-
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/src/test/validation_flush_tests.cpp b/src/test/validation_flush_tests.cpp
index 3e377d851c9b..0159069b2195 100644
--- a/src/test/validation_flush_tests.cpp
+++ b/src/test/validation_flush_tests.cpp
@@ -8,6 +8,7 @@
 #include <test/util/random.h>
 #include <test/util/setup_common.h>
 #include <validation.h>
+#include <validationinterface.h>
 
 #include <boost/test/unit_test.hpp>
 
@@ -155,4 +156,52 @@ BOOST_AUTO_TEST_CASE(getcoinscachesizestate)
         CoinsCacheSizeState::OK);
 }
 
+namespace {
+struct FlushOrderSubscriber final : public CValidationInterface {
+    std::set<uint256> m_connected;
+    bool m_new_block_connected{false};
+    int m_flushes_before_connect{0};
+    bool m_flushed_unconnected{false};
+
+    void BlockConnected(const std::shared_ptr<const CBlock>&, const CBlockIndex* pindex) override
+    {
+        if (m_connected.insert(pindex->GetBlockHash()).second) m_new_block_connected = true;
+    }
+    void ChainStateFlushed(const CBlockLocator& locator) override
+    {
+        if (!m_new_block_connected) ++m_flushes_before_connect;
+        if (!m_connected.count(locator.vHave.front())) m_flushed_unconnected = true;
+    }
+};
+
+struct CriticalCacheSetup : public TestChainSetup {
+    CriticalCacheSetup() :
+        TestChainSetup{100, CBaseChainParams::REGTEST, {"-maxmempool=0"}}
+    {
+    }
+};
+} // namespace
+
+//! A flush inside ConnectTip() must not announce the block being connected before its BlockConnected
+//! notification, since the wallet stores the announced locator as the point it has scanned up to.
+BOOST_FIXTURE_TEST_CASE(chainstate_flushed_after_block_connected, CriticalCacheSetup)
+{
+    Chainstate& chainstate{m_node.chainman->ActiveChainstate()};
+    auto sub{std::make_shared<FlushOrderSubscriber>()};
+    WITH_LOCK(::cs_main, for (const CBlockIndex* pindex{chainstate.m_chain.Tip()}; pindex; pindex = pindex->pprev) {
+        sub->m_connected.insert(pindex->GetBlockHash());
+    });
+    RegisterSharedValidationInterface(sub);
+    // With no coins cache budget and no mempool allowance, every ConnectTip() flushes.
+    WITH_LOCK(::cs_main, chainstate.m_coinstip_cache_size_bytes = 0);
+
+    CreateAndProcessBlock({}, CScript() << OP_TRUE);
+    SyncWithValidationInterfaceQueue();
+    UnregisterSharedValidationInterface(sub);
+
+    // ConnectTip() flushed before the new block's BlockConnected was delivered.
+    BOOST_CHECK_GT(sub->m_flushes_before_connect, 0);
+    BOOST_CHECK(!sub->m_flushed_unconnected);
+}
+
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index aac9744fea9b..8e826568b673 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -3337,7 +3337,12 @@ bool Chainstate::FlushStateToDisk(
     }
     if (full_flush_completed && this == &m_chainman.ActiveChainstate()) {
         // TODO(assumeutxo): upstream tags this notification with ChainstateRole instead of suppressing; adopt when backporting index/wallet assumeutxo support.
-        GetMainSignals().ChainStateFlushed(GetLocator(m_last_flushed_block));
+        // Dash's wallet still persists this locator as its best block (bitcoin#30221 removed that upstream).
+        // ConnectTip() can flush before the new block is part of m_chain, so announce the last flushed
+        // block that is.
+        if (const CBlockIndex* flushed_in_chain{m_chain.FindFork(m_last_flushed_block)}) {
+            GetMainSignals().ChainStateFlushed(GetLocator(flushed_in_chain));
+        }
     }
     } catch (const std::runtime_error& e) {
         return AbortNode(state, std::string("System error while flushing: ") + e.what());

From 337c464064f5d97f437a85f12c2e723ed5cd5181 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 3 Nov 2026 07:20:09 +0000
Subject: [PATCH 6/6] fix(index): don't leave the locator above the entries a
 rewind erases

The address, spent, timestamp and governance collateral indexes erase the
entries of rewound blocks in CustomRewind. Since bitcoin#33212 a rewind no
longer commits its locator, and since bitcoin#34897 a later commit only writes
it once the index tip is an ancestor of the last flushed block. If the
chainstate's last flush is below the rewind target, the erasures
were persisted while the committed locator stayed above them, on the rewound
branch. After an unclean restart in which that branch wins again, the index
resumed from the old locator and never appended the erased blocks again. The
governance collateral index used to write its locator in the same batch as the
erasures; skipping it there opened the same gap.

When the committed locator is above the new tip on the same branch, move it to
the new tip. The committed tip was an ancestor of a flushed block when it was
written, so the new tip below it is in the block index after a restart. The
locator then matches what the index holds, whichever branch wins afterwards. A
committed locator at or below the new tip, or on another branch, is left alone:
a restart resumes or rewinds from it correctly. The governance collateral index
writes it in the same batch as its erasures, the others right after theirs, as
the full commit did before bitcoin#33212. This also covers a rewind whose new
tip is already flushed, so BaseIndex::Rewind() stays as upstream left it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/index/addressindex.cpp       |   4 +-
 src/index/base.cpp               |  12 +++
 src/index/base.h                 |   5 +
 src/index/govcollateralindex.cpp |   9 +-
 src/index/spentindex.cpp         |   4 +-
 src/index/timestampindex.cpp     |   4 +-
 src/test/baseindex_tests.cpp     | 165 +++++++++++++++++++++++++++++++
 7 files changed, 194 insertions(+), 9 deletions(-)

diff --git a/src/index/addressindex.cpp b/src/index/addressindex.cpp
index 342de4e359d6..86886a9272f6 100644
--- a/src/index/addressindex.cpp
+++ b/src/index/addressindex.cpp
@@ -398,7 +398,9 @@ bool AddressIndex::CustomRewind(const interfaces::BlockKey& current_tip, const i
         }
     }
 
-    return true;
+    CDBBatch locator_batch(GetDB());
+    WriteRewindLocator(locator_batch, new_tip_index);
+    return GetDB().WriteBatch(locator_batch);
 }
 
 BaseIndex::DB& AddressIndex::GetDB() const { return *m_db; }
diff --git a/src/index/base.cpp b/src/index/base.cpp
index e6643ec02a1e..977c95561bd6 100644
--- a/src/index/base.cpp
+++ b/src/index/base.cpp
@@ -274,6 +274,18 @@ void BaseIndex::Commit()
     }
 }
 
+void BaseIndex::WriteRewindLocator(CDBBatch& batch, const CBlockIndex* new_tip) const
+{
+    CBlockLocator locator;
+    if (!GetDB().ReadBestBlock(locator) || locator.IsNull()) return;
+    const CBlockIndex* committed = WITH_LOCK(::cs_main, return m_chainstate->m_blockman.LookupBlockIndex(locator.vHave.front()));
+    // The committed tip was an ancestor of a flushed block when it was written, so it and new_tip below it are in
+    // the block index after a restart. A committed tip at or below new_tip, or on another branch, needs no change.
+    if (committed && committed->nHeight > new_tip->nHeight && committed->GetAncestor(new_tip->nHeight) == new_tip) {
+        GetDB().WriteBestBlock(batch, GetLocator(*m_chain, new_tip->GetBlockHash()));
+    }
+}
+
 bool BaseIndex::Rewind(const CBlockIndex* current_tip, const CBlockIndex* new_tip)
 {
     assert(current_tip == m_best_block_index);
diff --git a/src/index/base.h b/src/index/base.h
index 1a6e5344ce35..92bb7df9914c 100644
--- a/src/index/base.h
+++ b/src/index/base.h
@@ -117,6 +117,11 @@ class BaseIndex : public CValidationInterface
     /// be an ancestor of the current best block.
     [[nodiscard]] virtual bool CustomRewind(const interfaces::BlockKey& current_tip, const interfaces::BlockKey& new_tip) { return true; }
 
+    /// For indexes whose CustomRewind() erases entries: if the committed locator is above new_tip on the same
+    /// branch, move it to new_tip. Commit() may not write new_tip yet (it can be ahead of the last flush), but
+    /// leaving the old locator above erased entries would make an unclean restart resume past them.
+    void WriteRewindLocator(CDBBatch& batch, const CBlockIndex* new_tip) const;
+
     virtual DB& GetDB() const = 0;
 
     /// Get the name of the index for display in logs.
diff --git a/src/index/govcollateralindex.cpp b/src/index/govcollateralindex.cpp
index 5264cda1e1fe..eeaf660a7d9b 100644
--- a/src/index/govcollateralindex.cpp
+++ b/src/index/govcollateralindex.cpp
@@ -117,12 +117,9 @@ bool GovCollateralIndex::CustomRewind(const interfaces::BlockKey& current_tip, c
             m_db->EraseCollateral(batch, txid);
         }
     }
-    // Like BaseIndex::Commit(), never persist a locator ahead of the chainstate's last flushed block: after an
-    // unclean shutdown the block index might not know it, and the index would refuse to load.
-    const CBlockIndex* last_flushed{WITH_LOCK(::cs_main, return m_chainstate->GetLastFlushedBlock())};
-    if (last_flushed && last_flushed->GetAncestor(new_tip_index->nHeight) == new_tip_index) {
-        m_db->WriteBestBlock(batch, GetLocator(new_tip_index));
-    }
+    // Never persist a locator ahead of the chainstate's last flushed block (after an unclean shutdown the block
+    // index might not know it, and the index would refuse to load), but don't leave it above the erasures either.
+    WriteRewindLocator(batch, new_tip_index);
     return m_db->WriteBatch(batch);
 }
 
diff --git a/src/index/spentindex.cpp b/src/index/spentindex.cpp
index 64c373a151ff..afeb4191f655 100644
--- a/src/index/spentindex.cpp
+++ b/src/index/spentindex.cpp
@@ -158,7 +158,9 @@ bool SpentIndex::CustomRewind(const interfaces::BlockKey& current_tip, const int
         }
     }
 
-    return true;
+    CDBBatch locator_batch(GetDB());
+    WriteRewindLocator(locator_batch, new_tip_index);
+    return GetDB().WriteBatch(locator_batch);
 }
 
 BaseIndex::DB& SpentIndex::GetDB() const { return *m_db; }
diff --git a/src/index/timestampindex.cpp b/src/index/timestampindex.cpp
index 6f1d9af18952..69573472b5ae 100644
--- a/src/index/timestampindex.cpp
+++ b/src/index/timestampindex.cpp
@@ -85,7 +85,9 @@ bool TimestampIndex::CustomRewind(const interfaces::BlockKey& current_tip, const
         }
     }
 
-    return true;
+    CDBBatch locator_batch(GetDB());
+    WriteRewindLocator(locator_batch, new_tip_index);
+    return GetDB().WriteBatch(locator_batch);
 }
 
 BaseIndex::DB& TimestampIndex::GetDB() const { return *m_db; }
diff --git a/src/test/baseindex_tests.cpp b/src/test/baseindex_tests.cpp
index 6f60fb935cd1..710011a5857b 100644
--- a/src/test/baseindex_tests.cpp
+++ b/src/test/baseindex_tests.cpp
@@ -2,6 +2,8 @@
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
+#include <chain.h>
+#include <consensus/validation.h>
 #include <index/coinstatsindex.h>
 #include <interfaces/chain.h>
 #include <node/blockstorage.h>
@@ -14,6 +16,83 @@
 
 #include <boost/test/unit_test.hpp>
 
+namespace {
+//! A minimal index that, like Dash's address, spent and timestamp indexes, keeps one entry per block and erases the
+//! entries of rewound blocks in CustomRewind(). The rewind hooks are exposed so a test can leave the on-disk state
+//! that an unclean shutdown in the middle of a reorg would leave, without having to time an actual crash.
+class ErasingIndex final : public BaseIndex
+{
+    const std::unique_ptr<BaseIndex::DB> m_db;
+
+public:
+    explicit ErasingIndex(std::unique_ptr<interfaces::Chain> chain)
+        : BaseIndex(std::move(chain), "erasing test index"),
+          m_db{std::make_unique<BaseIndex::DB>(gArgs.GetDataDirNet() / "indexes" / "erasingtest", /*n_cache_size=*/1 << 20)}
+    {
+    }
+    ~ErasingIndex() override { BaseIndex::Stop(); }
+
+    bool Indexed(const CBlockIndex* block) const { return m_db->Exists(std::make_pair(uint8_t{'e'}, block->GetBlockHash())); }
+    bool RewindTo(const CBlockIndex* current_tip, const CBlockIndex* new_tip)
+    {
+        return CustomRewind({current_tip->GetBlockHash(), current_tip->nHeight}, {new_tip->GetBlockHash(), new_tip->nHeight});
+    }
+    void CommitLocator(const CBlockIndex* tip)
+    {
+        CDBBatch batch(*m_db);
+        m_db->WriteBestBlock(batch, GetLocator(tip));
+        BOOST_REQUIRE(m_db->WriteBatch(batch));
+    }
+    void RewindLocatorTo(const CBlockIndex* new_tip)
+    {
+        CDBBatch batch(*m_db);
+        WriteRewindLocator(batch, new_tip);
+        BOOST_REQUIRE(m_db->WriteBatch(batch));
+    }
+    uint256 CommittedTip() const
+    {
+        CBlockLocator locator;
+        BOOST_REQUIRE(m_db->ReadBestBlock(locator) && !locator.IsNull());
+        return locator.vHave.front();
+    }
+
+protected:
+    bool CustomAppend(const interfaces::BlockInfo& block) override { return m_db->Write(std::make_pair(uint8_t{'e'}, block.hash), true); }
+    bool CustomRewind(const interfaces::BlockKey& current_tip, const interfaces::BlockKey& new_tip) override
+    {
+        const CBlockIndex* new_tip_index{WITH_LOCK(::cs_main, return m_chainstate->m_blockman.LookupBlockIndex(new_tip.hash))};
+        for (const CBlockIndex* pindex{WITH_LOCK(::cs_main, return m_chainstate->m_blockman.LookupBlockIndex(current_tip.hash))};
+             pindex != new_tip_index; pindex = pindex->pprev) {
+            if (!m_db->Erase(std::make_pair(uint8_t{'e'}, pindex->GetBlockHash()))) return false;
+        }
+        CDBBatch batch(*m_db);
+        WriteRewindLocator(batch, new_tip_index);
+        return m_db->WriteBatch(batch);
+    }
+    BaseIndex::DB& GetDB() const override { return *m_db; }
+    bool AllowPrune() const override { return true; }
+};
+
+const CBlockIndex* AtHeight(ChainstateManager& chainman, int height)
+{
+    return WITH_LOCK(::cs_main, return chainman.ActiveChain()[height]);
+}
+
+//! Makes the chainstate's last flushed block `height`, below the current tip, by flushing while the blocks above
+//! are disconnected and then connecting them again without a flush.
+void LowerLastFlushedBlock(ChainstateManager& chainman, int height)
+{
+    Chainstate& chainstate{chainman.ActiveChainstate()};
+    CBlockIndex* first_disconnected{WITH_LOCK(::cs_main, return chainman.ActiveChain()[height + 1])};
+    BlockValidationState state;
+    BOOST_REQUIRE(chainstate.InvalidateBlock(state, first_disconnected));
+    chainstate.ForceFlushStateToDisk();
+    WITH_LOCK(::cs_main, chainstate.ResetBlockFailureFlags(first_disconnected));
+    BOOST_REQUIRE(chainstate.ActivateBestChain(state));
+    BOOST_REQUIRE_EQUAL(WITH_LOCK(::cs_main, return chainstate.GetLastFlushedBlock()->nHeight), height);
+}
+} // namespace
+
 // Tests of generic BaseIndex functionality that is independent of which
 // concrete index is being used. CoinStatsIndex is used here merely as a
 // convenient instantiation of BaseIndex.
@@ -70,4 +149,90 @@ BOOST_FIXTURE_TEST_CASE(baseindex_no_commit_ahead_of_flush, TestChain100Setup)
     sync_index(false, 101, 100);
 }
 
+// An index that erases entries when it rewinds must not leave its committed locator above them, even while the
+// rewound tip is ahead of the last flush and Commit() can't write it.
+BOOST_FIXTURE_TEST_CASE(rewind_locator_follows_erased_entries, TestChain100Setup)
+{
+    ChainstateManager& chainman{*Assert(m_node.chainman)};
+    Chainstate& chainstate{chainman.ActiveChainstate()};
+
+    // A competing block at height 98 that stays off the active chain
+    CBlockIndex* old_98{WITH_LOCK(::cs_main, return chainman.ActiveChain()[98])};
+    BlockValidationState state;
+    BOOST_REQUIRE(chainstate.InvalidateBlock(state, old_98));
+    const uint256 competing_98{CreateAndProcessBlock({}, CScript() << OP_TRUE).GetHash()};
+    WITH_LOCK(::cs_main, chainstate.ResetBlockFailureFlags(old_98));
+    BOOST_REQUIRE(chainstate.ActivateBestChain(state));
+    const CBlockIndex* competing{WITH_LOCK(::cs_main, return chainman.m_blockman.LookupBlockIndex(competing_98))};
+    BOOST_REQUIRE_EQUAL(AtHeight(chainman, 100)->nHeight, 100);
+    chainstate.ForceFlushStateToDisk();
+    BOOST_REQUIRE_EQUAL(WITH_LOCK(::cs_main, return chainstate.GetLastFlushedBlock()->nHeight), 100);
+
+    node::g_indexes_ready_to_sync = false;
+    ErasingIndex index{interfaces::MakeChain(m_node)};
+    BOOST_REQUIRE(index.Start());
+
+    // Committed tip above the target on the same branch: the locator moves down to the target
+    index.CommitLocator(AtHeight(chainman, 100));
+    index.RewindLocatorTo(AtHeight(chainman, 97));
+    BOOST_CHECK(index.CommittedTip() == AtHeight(chainman, 97)->GetBlockHash());
+
+    // Committed tip equal to the target: unchanged
+    index.CommitLocator(AtHeight(chainman, 100));
+    index.RewindLocatorTo(AtHeight(chainman, 100));
+    BOOST_CHECK(index.CommittedTip() == AtHeight(chainman, 100)->GetBlockHash());
+
+    // Target on another branch: unchanged, never lowered to a common ancestor below entries that stay
+    index.RewindLocatorTo(competing);
+    BOOST_CHECK(index.CommittedTip() == AtHeight(chainman, 100)->GetBlockHash());
+
+    // Committed tip below the target: unchanged, a restart re-appends from it
+    index.CommitLocator(AtHeight(chainman, 95));
+    index.RewindLocatorTo(AtHeight(chainman, 97));
+    BOOST_CHECK(index.CommittedTip() == AtHeight(chainman, 95)->GetBlockHash());
+
+    index.Interrupt();
+    index.Stop();
+    node::g_indexes_ready_to_sync = true;
+}
+
+// A rewind persists its erasures right away. If the node then stops before the rewound tip is flushed and the
+// rewound blocks are back on the active chain, the next start must index them again.
+BOOST_FIXTURE_TEST_CASE(restart_after_rewind_reindexes_erased_blocks, TestChain100Setup)
+{
+    ChainstateManager& chainman{*Assert(m_node.chainman)};
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        IndexWaitSynced(index);
+        chainman.ActiveChainstate().ForceFlushStateToDisk();
+        SyncWithValidationInterfaceQueue();
+        index.Stop();
+    }
+    // The rewind target (97) is now ahead of the last flush (95), so Commit() could not persist it
+    LowerLastFlushedBlock(chainman, 95);
+    const CBlockIndex* tip{AtHeight(chainman, 100)};
+
+    node::g_indexes_ready_to_sync = false;
+    {
+        ErasingIndex index{interfaces::MakeChain(m_node)};
+        BOOST_REQUIRE(index.Start());
+        BOOST_CHECK(index.CommittedTip() == tip->GetBlockHash());
+        BOOST_REQUIRE(index.RewindTo(tip, AtHeight(chainman, 97)));
+        BOOST_CHECK(!index.Indexed(tip));
+        index.Interrupt();
+        index.Stop();
+    }
+    node::g_indexes_ready_to_sync = true;
+
+    // The rewound blocks are still the active chain, as after a restart in which their branch wins again
+    ErasingIndex index{interfaces::MakeChain(m_node)};
+    BOOST_REQUIRE(index.Start());
+    IndexWaitSynced(index);
+    for (int height{98}; height <= 100; ++height) {
+        BOOST_CHECK_MESSAGE(index.Indexed(AtHeight(chainman, height)), "block " << height << " was not indexed again");
+    }
+    index.Stop();
+}
+
 BOOST_AUTO_TEST_SUITE_END()