From ef31df331a6f2c5161a9d60eee84b8fcbc58a737 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 7 Oct 2026 03:23:29 -0500
Subject: [PATCH 1/2] fix(evo): keep credit-pool history through pruning

Rebuilding a credit pool after a restart reads blocks back to one
withdrawal window before the latest disk snapshot, which can be far
older than the 288 blocks pruning keeps. Once those bodies were pruned,
the failed read was reported as a consensus failure and a canonical
block was permanently marked invalid.

Protect the history that reconstruction needs with a prune lock. The
lock is recomputed before every pruning decision from snapshots that are
already committed to disk, for the oldest parent any chainstate may still
need after a reorg or a restart. The EvoDB is synced before pruned files
are unlinked. A block body that is unavailable locally now stops the node
with a -reindex hint instead of invalidating the block.

Pruning tests that prune early regtest blocks postpone V20, as the other
pruning tests already do.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/evo/creditpool.cpp                        | 27 +++++-
 src/evo/creditpool.h                          | 11 +++
 src/evo/evodb.cpp                             |  7 ++
 src/evo/evodb.h                               |  3 +
 src/evo/specialtxman.cpp                      |  6 ++
 src/test/evo_assetlocks_tests.cpp             | 85 ++++++++++++++++++-
 src/validation.cpp                            | 34 ++++++++
 test/functional/feature_creditpool_pruning.py | 75 ++++++++++++++++
 .../feature_remove_pruned_files_on_startup.py |  7 +-
 test/functional/interface_usdt_utxocache.py   |  9 +-
 test/functional/rpc_getblockfrompeer.py       | 12 ++-
 test/functional/rpc_rawtransaction.py         |  6 ++
 test/functional/test_runner.py                |  1 +
 13 files changed, 274 insertions(+), 9 deletions(-)
 create mode 100755 test/functional/feature_creditpool_pruning.py

diff --git a/src/evo/creditpool.cpp b/src/evo/creditpool.cpp
index cafe65b023f4..a7400e044b0d 100644
--- a/src/evo/creditpool.cpp
+++ b/src/evo/creditpool.cpp
@@ -80,7 +80,8 @@ static std::optional<CreditPoolDataPerBlock> GetCreditDataFromBlock(const gsl::n
 
     CBlock block;
     if (!ReadBlockFromDisk(block, block_index, consensusParams)) {
-        throw std::runtime_error("failed-getcbforblock-read");
+        throw CreditPoolBlockReadError(strprintf("failed-getcbforblock-read: block %s at height %d is unavailable",
+                                                 block_index->GetBlockHash().ToString(), block_index->nHeight));
     }
 
     if (block.vtx.empty() || block.vtx[0]->vExtraPayload.empty() || !block.vtx[0]->IsSpecialTxVersion()) {
@@ -143,6 +144,26 @@ std::optional<CCreditPool> CCreditPoolManager::GetFromCache(const CBlockIndex& b
     return std::nullopt;
 }
 
+int CCreditPoolManager::GetPruneLockHeight(const CBlockIndex& oldest_parent)
+{
+    const auto& consensus = m_chainman.GetConsensus();
+    const int window = m_chainman.GetParams().CreditPoolPeriodBlocks();
+    // Pending snapshots cannot protect history: pruning unlinks files before
+    // the current coins and EvoDB overlays are committed.
+    int first_read = consensus.V20Height - window;
+    for (int height = oldest_parent.nHeight - oldest_parent.nHeight % DISK_SNAPSHOT_PERIOD;
+         height >= consensus.V20Height; height -= DISK_SNAPSHOT_PERIOD) {
+        CCreditPool pool;
+        if (evoDb.GetRawDB().Read(std::make_pair(DB_CREDITPOOL_SNAPSHOT, oldest_parent.GetAncestor(height)->GetBlockHash()),
+                                  pool)) {
+            first_read = height + 1 - window;
+            break;
+        }
+    }
+    // GetCreditDataFromBlock() never reads bodies from before DIP0003.
+    return std::max(consensus.DIP0003Height, first_read);
+}
+
 void CCreditPoolManager::MaybeWriteSnapshot(const uint256& block_hash, int height, const CCreditPool& pool)
 {
     // The disk snapshot is an optimization; skip it outside a block-scoped EvoDB transaction
@@ -413,6 +434,10 @@ std::optional<CCreditPoolDiff> GetCreditPoolDiffForBlock(CCreditPoolManager& cpo
             }
         }
         return creditPoolDiff;
+    } catch (const CreditPoolBlockReadError& e) {
+        // Missing local history is not a statement about the block.
+        AbortNode(state, strprintf("%s; restart with -reindex to restore it", e.what()));
+        return std::nullopt;
     } catch (const EvoDbInconsistencyError& e) {
         // Local EvoDB corruption (the node is already aborting): fail with
         // M_ERROR so the block is not marked invalid.
diff --git a/src/evo/creditpool.h b/src/evo/creditpool.h
index e7676beace54..39ed7bb226f1 100644
--- a/src/evo/creditpool.h
+++ b/src/evo/creditpool.h
@@ -20,6 +20,7 @@
 #include <algorithm>
 #include <limits>
 #include <optional>
+#include <stdexcept>
 #include <unordered_set>
 #include <vector>
 
@@ -36,6 +37,13 @@ namespace llmq {
 class CQuorumManager;
 } // namespace llmq
 
+/** Unavailable local block history must not invalidate a candidate block. */
+class CreditPoolBlockReadError : public std::runtime_error
+{
+public:
+    using std::runtime_error::runtime_error;
+};
+
 struct CCreditPool {
     CAmount locked{0};
 
@@ -175,6 +183,9 @@ class CCreditPoolManager
       */
     CCreditPool GetCreditPool(const CBlockIndex* block) EXCLUSIVE_LOCKS_REQUIRED(!cache_mutex);
 
+    /** First required body when reconstructing from a persisted snapshot at/before this parent. */
+    int GetPruneLockHeight(const CBlockIndex& oldest_parent);
+
 private:
     std::optional<CCreditPool> GetFromCache(const CBlockIndex& block_index) EXCLUSIVE_LOCKS_REQUIRED(!cache_mutex);
     void AddToCache(const uint256& block_hash, int height, const CCreditPool& pool) EXCLUSIVE_LOCKS_REQUIRED(!cache_mutex);
diff --git a/src/evo/evodb.cpp b/src/evo/evodb.cpp
index 99dbff46c5e6..40c1ab8fcd31 100644
--- a/src/evo/evodb.cpp
+++ b/src/evo/evodb.cpp
@@ -107,6 +107,13 @@ bool CEvoDB::CommitRootTransaction(EvoDbIdentity identity, bool sync)
     return ret;
 }
 
+bool CEvoDB::Sync()
+{
+    LOCK(cs);
+    CDBBatch batch{*db};
+    return db->WriteBatch(batch, /*fSync=*/true);
+}
+
 bool CEvoDB::ReadBestBlock(EvoDbIdentity identity, uint256& hash)
 {
     LOCK(cs);
diff --git a/src/evo/evodb.h b/src/evo/evodb.h
index f9485eb09b89..9107b36e178f 100644
--- a/src/evo/evodb.h
+++ b/src/evo/evodb.h
@@ -233,6 +233,9 @@ class CEvoDB
         return result;
     }
 
+    /** Sync committed records without committing any current/root overlay. */
+    bool Sync() EXCLUSIVE_LOCKS_REQUIRED(!cs);
+
     bool CommitRootTransaction(EvoDbIdentity identity = EvoDbIdentity::NORMAL, bool sync = false)
         EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs);
 
diff --git a/src/evo/specialtxman.cpp b/src/evo/specialtxman.cpp
index aef331c99d8d..9332c8d76952 100644
--- a/src/evo/specialtxman.cpp
+++ b/src/evo/specialtxman.cpp
@@ -28,6 +28,7 @@
 #include <deploymentstatus.h>
 #include <hash.h>
 #include <primitives/block.h>
+#include <shutdown.h>
 #include <util/system.h>
 
 CSpecialTxProcessor::CSpecialTxProcessor(CEvoDB& evodb, CDeterministicMNManager& dmnman,
@@ -1014,6 +1015,11 @@ bool CSpecialTxProcessor::ProcessSpecialTxsInBlock(Chainstate& chainstate, const
             bls::bls_legacy_scheme.store(false);
             LogPrintf("CSpecialTxProcessor::%s -- bls_legacy_scheme=%d\n", __func__, bls::bls_legacy_scheme.load());
         }
+    } catch (const CreditPoolBlockReadError& e) {
+        // Missing local history is not a statement about the block.
+        const std::string msg{strprintf("%s; restart with -reindex to restore it", e.what())};
+        AbortNode(msg);
+        return state.Error(msg);
     } catch (const EvoDbInconsistencyError& e) {
         // Local EvoDB corruption detected below (the node is already
         // aborting): fail with M_ERROR so the block is not marked invalid.
diff --git a/src/test/evo_assetlocks_tests.cpp b/src/test/evo_assetlocks_tests.cpp
index 8db84d70d92a..d3fc3ad2f20e 100644
--- a/src/test/evo_assetlocks_tests.cpp
+++ b/src/test/evo_assetlocks_tests.cpp
@@ -10,14 +10,17 @@
 #include <evo/assetlocktx.h>
 #include <evo/cbtx.h>
 #include <evo/creditpool.h>
-#include <evo/specialtxman.h>
+#include <evo/deterministicmns.h>
 #include <evo/evodb.h>
 #include <evo/specialtx.h>
+#include <evo/specialtxman.h>
 #include <llmq/context.h>
 #include <policy/policy.h>
+#include <pow.h>
 #include <script/script.h>
 #include <script/signingprovider.h>
 #include <script/standard.h>
+#include <shutdown.h>
 #include <test/util/txmempool.h>
 #include <txmempool.h>
 #include <util/ranges_set.h>
@@ -858,6 +861,86 @@ BOOST_FIXTURE_TEST_CASE(credit_pool_snapshot_persisted_after_transactionless_con
     BOOST_CHECK_EQUAL(snapshot.currentLimit, pool.currentLimit);
 }
 
+BOOST_FIXTURE_TEST_CASE(missing_credit_pool_history_is_local_error, TestChain100Setup)
+{
+    // A header without its body stands in for pruned history behind a credit-pool lookup.
+    const CScript coinbase_pk = GetScriptForRawPubKey(coinbaseKey.GetPubKey());
+    auto& chainman = *m_node.chainman;
+    auto& chainstate = chainman.ActiveChainstate();
+    while (WITH_LOCK(cs_main, return chainstate.m_chain.Height()) <= chainman.GetConsensus().V20Height) {
+        CreateAndProcessBlock({}, coinbase_pk);
+    }
+    CBlock missing_body = CreateBlock({}, coinbase_pk, chainstate);
+    missing_body.nTime += 60;
+    while (!CheckProofOfWork(missing_body.GetHash(), missing_body.nBits, chainman.GetConsensus())) {
+        ++missing_body.nNonce;
+    }
+    BlockValidationState header_state;
+    BOOST_REQUIRE(chainman.ProcessNewBlockHeaders({missing_body.GetBlockHeader()}, header_state));
+    const auto missing_index = WITH_LOCK(cs_main, return chainman.m_blockman.LookupBlockIndex(missing_body.GetHash()));
+    BOOST_REQUIRE(missing_index);
+    BOOST_REQUIRE(WITH_LOCK(cs_main, return !(missing_index->nStatus & BLOCK_HAVE_DATA)));
+
+    CBlock candidate = missing_body;
+    candidate.hashPrevBlock = missing_body.GetHash();
+    const uint256 candidate_hash = candidate.GetHash();
+    CBlockIndex candidate_index{candidate};
+    candidate_index.phashBlock = &candidate_hash;
+    candidate_index.pprev = missing_index;
+    candidate_index.nHeight = missing_index->nHeight + 1;
+
+    // Both entry points stop the node instead of marking the block invalid.
+    static std::atomic<int> exit_status{EXIT_SUCCESS};
+    BOOST_REQUIRE(InitShutdownState(exit_status));
+    struct ShutdownReset {
+        ~ShutdownReset() { AbortShutdown(); }
+    } shutdown_reset;
+
+    LOCK(cs_main);
+    auto& manager = *m_node.special_tx->m_cpoolman;
+    BlockValidationState diff_state;
+    BOOST_CHECK(!GetCreditPoolDiffForBlock(manager, candidate, missing_index, chainman.GetConsensus(),
+                                           GetBlockSubsidy(missing_index, chainman.GetConsensus()), diff_state));
+    BOOST_CHECK(diff_state.IsError());
+    BOOST_CHECK(!diff_state.IsInvalid());
+
+    const auto rules = GetSpecialTxRules(chainstate.m_chain.Tip(), chainman);
+    MNListUpdates updates;
+    BlockValidationState special_state;
+    BOOST_CHECK(!m_node.special_tx->ProcessSpecialTxsInBlock(
+        chainstate, chainstate.m_chain, candidate, &candidate_index, rules, chainstate.CoinsTip(),
+        GetBlockSubsidy(missing_index, chainman.GetConsensus()), /*fJustCheck=*/true,
+        /*fCheckCbTxMerkleRoots=*/false, special_state, updates));
+    BOOST_CHECK(special_state.IsError());
+    BOOST_CHECK(!special_state.IsInvalid());
+    BOOST_CHECK(ShutdownRequested());
+    BOOST_CHECK_EQUAL(exit_status.load(), EXIT_FAILURE);
+}
+
+BOOST_FIXTURE_TEST_CASE(credit_pool_prune_lock_waits_for_committed_snapshot, TestChain100Setup)
+{
+    // Pruning unlinks block files before the EvoDB overlays are committed, so a snapshot
+    // only protects history once it is on disk.
+    constexpr int SNAPSHOT_HEIGHT{576}; // CCreditPoolManager::DISK_SNAPSHOT_PERIOD
+    const CScript coinbase_pk = GetScriptForRawPubKey(coinbaseKey.GetPubKey());
+    auto& chainstate = m_node.chainman->ActiveChainstate();
+    while (WITH_LOCK(cs_main, return chainstate.m_chain.Height()) <= SNAPSHOT_HEIGHT) {
+        CreateAndProcessBlock({}, coinbase_pk);
+    }
+    const CBlockIndex* parent = WITH_LOCK(cs_main, return chainstate.m_chain.Tip());
+    const int window = Params().CreditPoolPeriodBlocks();
+    // Without a committed snapshot, reconstruction starts at V20 activation. Its window reaches back
+    // before DIP0003, where there is no CbTx and no body is read.
+    const int no_snapshot_height = m_node.chainman->GetConsensus().DIP0003Height;
+    BOOST_REQUIRE_LT(m_node.chainman->GetConsensus().V20Height - window, no_snapshot_height);
+    auto& manager = *m_node.special_tx->m_cpoolman;
+    BOOST_CHECK_EQUAL(manager.GetPruneLockHeight(*parent), no_snapshot_height);
+
+    chainstate.ForceFlushStateToDisk();
+    BOOST_CHECK_EQUAL(manager.GetPruneLockHeight(*parent), SNAPSHOT_HEIGHT + 1 - window);
+    BOOST_CHECK_EQUAL(manager.GetPruneLockHeight(*parent->GetAncestor(SNAPSHOT_HEIGHT - 1)), no_snapshot_height);
+}
+
 BOOST_AUTO_TEST_CASE(credit_pool_unlock_limit_v24)
 {
     // From v24 the limit is relative and net: 20% of the balance at the window start, never less
diff --git a/src/validation.cpp b/src/validation.cpp
index 4ad368546a03..edd10f622ee0 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -3169,6 +3169,34 @@ CoinsCacheSizeState Chainstate::GetCoinsCacheSizeState(
     return CoinsCacheSizeState::OK;
 }
 
+/** Earliest block body that any chainstate may need to rebuild a credit pool after a reorg or restart. */
+static int GetCreditPoolPruneLockHeight(ChainstateManager& chainman, CCreditPoolManager& cpoolman)
+    EXCLUSIVE_LOCKS_REQUIRED(::cs_main)
+{
+    const auto& params{chainman.GetParams()};
+    const auto& consensus{params.GetConsensus()};
+    int height_first{std::numeric_limits<int>::max()};
+    if (!DeploymentEnabled(consensus, Consensus::DEPLOYMENT_V20)) return height_first;
+    for (Chainstate* chainstate : chainman.GetAll()) {
+        if (!chainstate->CanFlushToDisk()) continue;
+        const uint256 live_hash{chainstate->CoinsTip().GetBestBlock()};
+        if (live_hash.IsNull()) continue;
+        const uint256 disk_hash{chainstate->CoinsDB().GetBestBlock()};
+        const CBlockIndex* live_tip{chainman.m_blockman.LookupBlockIndex(live_hash)};
+        const CBlockIndex* disk_tip{chainman.m_blockman.LookupBlockIndex(disk_hash)};
+        // Every coins best block is in the block index; if not, prune nothing.
+        if (!Assume(live_tip && (disk_hash.IsNull() || disk_tip))) return 0;
+        if (live_tip->nHeight < consensus.V20Height - params.CreditPoolPeriodBlocks()) continue;
+        // Restart recovery rolls forward from the fork between the on-disk and live coins tips,
+        // which can be deeper than the ordinary reorg range.
+        const int recovery_height{disk_tip ? LastCommonAncestor(live_tip, disk_tip)->nHeight : 0};
+        const int reorg_floor{std::max(0, live_tip->nHeight - static_cast<int>(MIN_BLOCKS_TO_KEEP))};
+        const int parent_height{std::min(reorg_floor, recovery_height)};
+        height_first = std::min(height_first, cpoolman.GetPruneLockHeight(*live_tip->GetAncestor(parent_height)));
+    }
+    return height_first;
+}
+
 bool Chainstate::FlushStateToDisk(
     BlockValidationState &state,
     FlushStateMode mode,
@@ -3190,6 +3218,9 @@ bool Chainstate::FlushStateToDisk(
         CoinsCacheSizeState cache_state = GetCoinsCacheSizeState();
         LOCK(m_blockman.cs_LastBlockFile);
         if (m_blockman.IsPruneMode() && (m_blockman.m_check_for_pruning || nManualPruneHeight > 0) && !fReindex) {
+            m_blockman.UpdatePruneLock("creditpool",
+                                       {GetCreditPoolPruneLockHeight(m_chainman, *m_special_tx.m_cpoolman)});
+
             // make sure we don't prune above any of the prune locks bestblocks
             // pruning is height-based
             int last_prune{m_chain.Height()}; // last height we can prune
@@ -3220,6 +3251,9 @@ bool Chainstate::FlushStateToDisk(
                 m_blockman.m_check_for_pruning = false;
             }
             if (!setFilesToPrune.empty()) {
+                // Make the snapshots used by the lock durable before recording
+                // prune marks and unlinking their reconstruction history.
+                if (!m_evoDb.Sync()) return AbortNode(state, "Failed to sync EvoDB before pruning");
                 fFlushForPrune = true;
                 if (!m_blockman.m_have_pruned) {
                     m_blockman.m_block_tree_db->WriteFlag("prunedblockfiles", true);
diff --git a/test/functional/feature_creditpool_pruning.py b/test/functional/feature_creditpool_pruning.py
new file mode 100755
index 000000000000..f81c60d34d41
--- /dev/null
+++ b/test/functional/feature_creditpool_pruning.py
@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Dash Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Retain credit-pool reconstruction history across manual pruning and restart."""
+
+from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import assert_equal, assert_raises_rpc_error
+
+# Node 1 starts unpruned: a -prune=1 node started on an empty chain trips an
+# unrelated UBSan overflow in the init-time disk space check.
+NODE1_ARGS = ["-fastprune", "-txindex=0", "-checkblocks=0", "-debug=prune"]
+PRUNE_ARGS = NODE1_ARGS + ["-prune=1", "-disablegovernance"]
+
+
+class CreditPoolPruningTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 2
+        self.extra_args = [[], NODE1_ARGS]
+
+    def restart_pruned(self):
+        expected_stderr = EXPECTED_STDERR_NO_GOV_PRUNE if self.nodes[1].getblockchaininfo()["pruned"] else ""
+        self.restart_node(1, extra_args=PRUNE_ARGS, expected_stderr=expected_stderr)
+        self.connect_nodes(0, 1)
+        self.sync_blocks()
+
+    def run_test(self):
+        full, pruned = self.nodes
+        self.generate(full, 1100)
+        assert_equal(full.getdeploymentinfo()["deployments"]["v20"]["active"], True)
+        first_block = full.getblockhash(1)
+        # Snapshot 576 plus one, less the regtest 100-block withdrawal window.
+        dependency = full.getblockhash(477)
+
+        self.log.info("Prune cold, before the first credit-pool lookup")
+        self.restart_pruned()
+        # The common lock keeps a ten-block buffer below the first required body.
+        with pruned.assert_debug_log(["creditpool limited pruning to height 466"]):
+            prune_height = pruned.pruneblockchain(1100)
+        assert prune_height < 477
+        assert_raises_rpc_error(-1, "Block not available (pruned data)", pruned.getblock, first_block)
+        assert_equal(pruned.getblock(dependency)["height"], 477)
+        self.generate(full, 1)
+        assert_equal(pruned.getcreditpoolinfo(), full.getcreditpoolinfo())
+
+        self.log.info("Advance retention once snapshot 1152 covers the supported reorg range")
+        self.generate(full, 1440 - full.getblockcount())
+        newer_dependency = full.getblockhash(1053)
+        self.restart_pruned()
+        with pruned.assert_debug_log(["creditpool limited pruning to height 1042"]):
+            prune_height = pruned.pruneblockchain(1440)
+        assert 477 < prune_height < 1053
+        assert_raises_rpc_error(-1, "Block not available (pruned data)", pruned.getblock, dependency)
+        assert_equal(pruned.getblock(newer_dependency)["height"], 1053)
+        self.generate(full, 1)
+        assert_equal(pruned.getcreditpoolinfo(), full.getcreditpoolinfo())
+
+        # Bodies below 1053 are already gone; this only checks the lock follows the lower tip.
+        self.log.info("Recompute retention after a short tip rollback")
+        disconnected = pruned.getblockhash(1438)
+        pruned.invalidateblock(disconnected)
+        assert_equal(pruned.getblockcount(), 1437)
+        with pruned.assert_debug_log(["creditpool limited pruning to height 466"]):
+            assert pruned.pruneblockchain(1437) < 1053
+        pruned.reconsiderblock(disconnected)
+        self.sync_blocks()
+        self.generate(full, 1)
+        assert_equal(pruned.getcreditpoolinfo(), full.getcreditpoolinfo())
+        self.stop_node(1, expected_stderr=EXPECTED_STDERR_NO_GOV_PRUNE)
+
+
+if __name__ == '__main__':
+    CreditPoolPruningTest().main()
diff --git a/test/functional/feature_remove_pruned_files_on_startup.py b/test/functional/feature_remove_pruned_files_on_startup.py
index 8ce4cd86c0e3..7ac1cf61545f 100755
--- a/test/functional/feature_remove_pruned_files_on_startup.py
+++ b/test/functional/feature_remove_pruned_files_on_startup.py
@@ -9,10 +9,15 @@
 from test_framework.governance import EXPECTED_STDERR_NO_GOV_PRUNE
 from test_framework.test_framework import BitcoinTestFramework
 
+# Credit-pool reconstruction keeps history from V20 activation until its first snapshot, so postpone V20
+# to let this test prune its early blocks.
+DEPLOYMENT_ARGS = ["-testactivationheight=v20@2000", "-testactivationheight=mn_rr@2000"]
+
+
 class FeatureRemovePrunedFilesOnStartupTest(BitcoinTestFramework):
     def set_test_params(self):
         self.num_nodes = 1
-        self.extra_args = [["-fastprune", "-prune=1"]]
+        self.extra_args = [["-fastprune", "-prune=1"] + DEPLOYMENT_ARGS]
 
     def mine_batches(self, blocks):
         n = blocks // 250
diff --git a/test/functional/interface_usdt_utxocache.py b/test/functional/interface_usdt_utxocache.py
index 338c9e589b43..8659fce5f063 100755
--- a/test/functional/interface_usdt_utxocache.py
+++ b/test/functional/interface_usdt_utxocache.py
@@ -131,11 +131,16 @@ def __repr__(self):
         return f"UTXOCacheFlush(duration={self.duration}, mode={FLUSHMODE_NAME[self.mode]}, size={self.size}, memory={self.memory}, for_prune={self.for_prune})"
 
 
+# Credit-pool reconstruction keeps history from V20 activation until its first snapshot, so postpone V20
+# to let this test prune its early blocks.
+DEPLOYMENT_ARGS = ["-testactivationheight=v20@2000", "-testactivationheight=mn_rr@2000"]
+
+
 class UTXOCacheTracepointTest(BitcoinTestFramework):
     def set_test_params(self):
         self.setup_clean_chain = False
         self.num_nodes = 1
-        self.extra_args = [["-txindex"]]
+        self.extra_args = [["-txindex"] + DEPLOYMENT_ARGS]
 
     def skip_test_if_missing_module(self):
         self.skip_if_platform_not_linux()
@@ -390,7 +395,7 @@ def handle_utxocache_flush(_, data, __):
         assert_equal(0, len(possible_cache_sizes))
 
         self.log.info("restart the node with -prune")
-        self.start_node(0, ["-fastprune=1", "-prune=1"])
+        self.start_node(0, ["-fastprune=1", "-prune=1"] + DEPLOYMENT_ARGS)
 
         BLOCKS_TO_MINE = 450
         self.log.info(f"mine {BLOCKS_TO_MINE} blocks to be able to prune")
diff --git a/test/functional/rpc_getblockfrompeer.py b/test/functional/rpc_getblockfrompeer.py
index e4c42459d055..6ce938a593e7 100755
--- a/test/functional/rpc_getblockfrompeer.py
+++ b/test/functional/rpc_getblockfrompeer.py
@@ -21,14 +21,18 @@
     assert_raises_rpc_error,
 )
 
+# Credit-pool reconstruction keeps history from V20 activation until its first snapshot, so postpone V20
+# to let this test prune its early blocks.
+DEPLOYMENT_ARGS = ["-testactivationheight=v20@3000", "-testactivationheight=mn_rr@3000"]
+
 
 class GetBlockFromPeerTest(BitcoinTestFramework):
     def set_test_params(self):
         self.num_nodes = 3
         self.extra_args = [
-            [],
-            [],
-            ["-fastprune", "-prune=1"]
+            DEPLOYMENT_ARGS,
+            DEPLOYMENT_ARGS,
+            ["-fastprune", "-prune=1"] + DEPLOYMENT_ARGS,
         ]
 
     def setup_network(self):
@@ -88,7 +92,7 @@ def run_test(self):
         self.log.info("Don't fetch blocks while the node has not synced past it yet")
         # For this test we need node 1 in prune mode and as a side effect this also disconnects
         # the nodes which is also necessary for the rest of the test.
-        self.restart_node(1, ["-prune=550"])
+        self.restart_node(1, ["-prune=550"] + DEPLOYMENT_ARGS)
 
         # Generate a block on the disconnected node that the pruning node is not connected to
         blockhash = self.generate(self.nodes[0], 1, sync_fun=self.no_op)[0]
diff --git a/test/functional/rpc_rawtransaction.py b/test/functional/rpc_rawtransaction.py
index 04aa11023052..b36a96c48088 100755
--- a/test/functional/rpc_rawtransaction.py
+++ b/test/functional/rpc_rawtransaction.py
@@ -54,6 +54,11 @@ def items(self):
         return self.x
 
 
+# Credit-pool reconstruction keeps history from V20 activation until its first snapshot, so postpone V20
+# to let this test prune its early blocks.
+DEPLOYMENT_ARGS = ["-testactivationheight=v20@2000", "-testactivationheight=mn_rr@2000"]
+
+
 class RawTransactionsTest(BitcoinTestFramework):
     def add_options(self, parser):
         self.add_wallet_options(parser, descriptors=False)
@@ -68,6 +73,7 @@ def set_test_params(self):
         # whitelist all peers to speed up tx relay / mempool sync
         for args in self.extra_args:
             args.append("-whitelist=noban@127.0.0.1")
+            args.extend(DEPLOYMENT_ARGS)
         self.supports_cli = False
 
     def setup_network(self):
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 4d6bee430d26..8a3c75db5830 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -153,6 +153,7 @@
     'p2p_tx_download.py',
     'wallet_avoidreuse.py --legacy-wallet',
     'wallet_avoidreuse.py --descriptors',
+    'feature_creditpool_pruning.py',
     'feature_abortnode.py',
     'wallet_basic.py --legacy-wallet',
     'wallet_basic.py --descriptors',

From db6bac6b727afd302ffd252c8b37bd52f8882043 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 7 Oct 2026 03:25:07 -0500
Subject: [PATCH 2/2] doc: add release notes for credit-pool history retention

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 doc/release-notes-7845.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 doc/release-notes-7845.md

diff --git a/doc/release-notes-7845.md b/doc/release-notes-7845.md
new file mode 100644
index 000000000000..a29b299d3133
--- /dev/null
+++ b/doc/release-notes-7845.md
@@ -0,0 +1,15 @@
+Pruning
+-------
+
+- Pruned nodes now keep the block history needed to rebuild the credit pool after a restart:
+  back to one withdrawal window (576 blocks on mainnet and testnet) before the newest
+  credit-pool snapshot on disk that is at or below the deepest block a reorg could return to.
+  This is typically around 1,400 blocks instead of 288, still far below the 550 MiB minimum
+  prune target. The kept range moves forward as the tip advances and new snapshots are written
+  to disk, so it can trail the tip by up to about a day of blocks.
+- A node that upgrades from a version before v24.0.0-rc.1 may have no recent credit-pool
+  snapshots on disk. Pruning then pauses until the next snapshot is written, which takes one to
+  two days.
+- If credit-pool history that the node needs has already been pruned, the node now stops with
+  an error asking for `-reindex`. Previously it marked a valid block as invalid and stopped
+  following the chain.