v9.26.4: DigiDollar-compatible pruning — run pruned nodes with DigiDollar

[DigiSwarm]

The simple summary (read this if you read nothing else)

What you get: you can now run a full-validating DigiByte node — including
everything DigiDollar will need — on about 2 GB of disk instead of ~42 GB.

How: add one line to digibyte.conf:

prune=2000

Who should care: mining pools and anyone who found the v9.26.3 disk/RAM
footprint too heavy. Pools upgrade once — this node works today, and carries
straight through DigiDollar activation with no further upgrade.

What changes if you don't set prune=: nothing. Your node behaves exactly
like v9.26.3.

What we changed in consensus: nothing. Zero consensus changes. A pruned node
accepts and rejects exactly the same blocks as a full node. The Groestl algolock
and the DigiDollar activation schedule are untouched.

---

The problem this solves

Since v9.26.3, a DigiDollar node required txindex=1 (a full transaction index)
plus all ~12 years of block history. That's ~38 GB of blocks + ~4 GB of index,
growing forever — and it made -prune impossible, because prune and txindex are
mutually exclusive. Pools asked for something lighter. This release delivers it
without touching consensus.

The key insight (one paragraph, no jargon)

DigiDollar coins can only be created after DigiDollar activates, and
activation cannot happen before block 23,627,520 on mainnet. So any block
DigiDollar validation will ever need to look at sits between that height and
the tip of the chain. Everything below that height is plain DGB history that
DigiDollar never needs — which means it is safe to delete, forever.

How it works (technical, kept simple)

Three small pieces of wiring, all opt-in behind -prune:

1. A prune lock at the activation floor. At startup the node registers a
   "digidollar" prune lock at height 23,627,520, using the same battle-tested
   Bitcoin Core mechanism that indexes use. Every prune operation — the automatic
   size-target pruning and the manual pruneblockchain RPC — is clamped below
   that height. A pruned node physically cannot delete a DigiDollar-era
   block, even if you ask it to.
   (src/node/chainstate.cpp ~line 156)

2. DigiDollar no longer needs txindex under prune. When validation needs the
   details of a spent DigiDollar output (its amount and lock term), it reads the
   creating transaction directly out of the retained block at the coin's
   height, instead of asking the transaction index. Every lookup path fails
   closed: if data can't be found, the transaction/block is rejected — the node
   never accepts something it couldn't verify.
   (src/init.cpp ~914, src/digidollar/health.cpp ScanUTXOSet)

3. A startup safety guard. If a pruned data directory is somehow missing a
   DigiDollar-era block (e.g. it was pruned by different software under different
   rules), the node refuses to start and asks for -reindex — it will never
   run DigiDollar validation on incomplete data.
   (src/node/chainstate.cpp ~line 184)

Side effects handled: the DigiDollar stats index (which syncs from genesis) is
auto-disabled under prune, and getdigidollarstats falls back to a live UTXO
scan that reports the same totals and position count; pruned nodes advertise
NODE_NETWORK_LIMITED like any pruned Bitcoin-lineage node.

What did NOT change

• No consensus changes. Mint/transfer/redeem rules, collateral rules, oracle
  bundle rules, lock tiers — all byte-identical.
• The Groestl algolock — untouched, and its boundary tests still pass
  (accept at the boundary, reject after, reindex-safe).
• DigiDollar activation (BIP9 bit 23) — untouched; all activation tests pass.
• Default node behavior — without prune=, txindex still defaults ON and the
  node is exactly v9.26.3. Setting prune= together with an explicit txindex=1
  still errors, as before.

How to enable it (digibyte.conf)

Upgrading an existing v9.26.3 node (the pool path):

1. Stop the node.

2. In digibyte.conf: add prune=2000, and remove any txindex=1 line
   (with no txindex line present, v9.26.4 turns it off automatically under prune).

3. Swap in the v9.26.4 binaries and start. The node prunes in place — no
   resync, no reindex. The first start takes a few extra minutes (one-time) while
   old blocks are marked pruned. Confirm in debug.log:

   DigiDollar: pruning enabled; retaining all blocks at/above height 23627520 (DigiDollar activation floor)
   

Fresh node: same config; it syncs and prunes as it goes.

Notes: prune=N is a disk target in MiB (minimum 550; 2000 gives headroom).
prune=1 = manual mode (prune only via the pruneblockchain RPC). Wallets and
getblocktemplate mining work normally. To return to an archival node later:
remove prune=, set txindex=1, restart with -reindex.

How we tested it

• Unit tests: 3,404 cases green, including the new
  dd_chain_prune_does_not_require_txindex.
• Full functional suite: 380 tests green via test_runner.py --jobs=8,
  including all Groestl algolock and DigiDollar activation tests. The extended
  pruning suite (feature_pruning.py, feature_index_prune.py,
  wallet_pruning.py) was run green as well — which surfaced and fixed a latent
  v9.26.3 issue where -prune=-1 reported the wrong startup error.
• New 11-phase functional test (test/functional/feature_digidollar_pruning.py),
  written test-first (TDD). It proves, on real nodes:
  • a pruned node (no txindex) boots, crosses BIP9 DigiDollar activation, and
    mines a DigiDollar block that a full node accepts;
  • a full mint → send (self and cross-node) → redeem lifecycle on the pruned node;
  • pruning deletes pre-activation history while the DD-era window survives, and
    the prune lock is the binding constraint (prune-to-tip gets clamped);
  • a fresh pruned node cold-syncs the entire DD-era chain over P2P and
    reaches identical DigiDollar state;
  • a full node migrates in place to pruned (the exact pool upgrade path,
    automatic prune mode) and stays in parity;
  • reorgs across DigiDollar blocks on the pruned node reconcile exactly;
  • a deliberately damaged datadir triggers the startup guard, and the guard's
    prescribed -reindex recovery restores full parity.
• Live mainnet validation (full record: V9.26.4_MAINNET_VALIDATION.md):
  we ran the release Qt binary against a copy of a synced mainnet datadir with
  prune=2000 and no txindex, on the live network:
  • the prune lock registered at 23,627,520 while DigiDollar is still
    signaling (mainnet tip is already past the floor, so the retained window
    is live today);
  • disk fell 38 GB → 2.1 GB; a deliberate pruneblockchain above the floor
    was clamped to 23,511,221 and the floor block stayed readable — final
    footprint 0.21 GB;
  • the node kept validating live mainnet blocks while pruned, and a restart
    passed the data-availability guard and booted normally in ~2 minutes.

How reviewers can test it themselves

# Build
./autogen.sh && ./configure && make -j$(nproc)

# Unit tests (all, then the targeted suite)
./src/test/test_digibyte
./src/test/test_digibyte --run_test=digidollar_txindex_tests

# The headline functional test (11 phases, ~70s)
test/functional/feature_digidollar_pruning.py

# Full functional suite
test/functional/test_runner.py --jobs=8

# Optional live mainnet spot-check (non-destructive — uses a COPY):
#   1. stop your node; copy ~/.digibyte/{blocks,chainstate} to a test datadir
#   2. test datadir digibyte.conf:  prune=2000 / server=1 / rpcport=14022 / port=12124
#   3. start digibyted/Qt with -datadir=<test dir>, then:
#      - debug.log must show the "retaining all blocks at/above height 23627520" line
#      - getblockchaininfo -> pruned:true
#      - pruneblockchain <tip-height> -> returns a height BELOW 23627520 (the clamp)
#      - getblock $(getblockhash 23627520) -> still works
#   4. your real datadir is untouched; delete the copy when done

Still to do before release: TESTNET validation

We have not yet run this on testnet26 — that is the remaining validation
step, and it matters for a specific reason: DigiDollar is expected to already be
ACTIVE on testnet (activation floor 600 — confirm with
getdigidollardeploymentinfo). That makes testnet the only live, multi-node
network where a pruned node can perform real DigiDollar mints, transfers and
redeems against the real 35-oracle roster and MuSig2 price quotes — i.e. the
exact situation mainnet will be in after activation, which regtest can only
simulate.

Testnet checklist (config note: testnet options go under the [test] section of
digibyte.conf, or use -testnet on the command line):

1. Run a pruned testnet node (prune=550, no txindex); confirm the log line
   retaining all blocks at/above height 600. (Because the floor is 600, a
   testnet node saves little disk — the point here is functional validation,
   not space.)
2. Sync to tip alongside a full testnet node.
3. Mint, send, and redeem DigiDollar on the pruned node; confirm the full
   node accepts every block, and getdigidollarstats matches between the two.
4. Restart the pruned node; confirm the guard passes and stats still match.
5. pruneblockchain <tip> on the pruned node; confirm the clamp and that the
   floor block stays readable.

Where everything lives

Document	Content
V9.26.4_PRUNING_PLAN.md	Design + full TDD test plan
V9.26.4_PRUNING_EXPLAINER.md	Short shareable community explainer
V9.26.4_MAINNET_VALIDATION.md	The live mainnet test record
doc/release-notes/release-notes-9.26.4.md	Operator-facing release notes & limitations

Fine print: pruned nodes don't serve deep history to new peers (archival nodes
still do that); getrawtransaction for pre-DigiDollar history needs an archival
node; and after activation the retained DigiDollar-era window grows with the
chain — prune=N deletes the 12 years of history, it isn't a permanent size cap.

[Copilot]

Pull request overview

This PR implements DigiDollar-compatible pruning for DigiByte Core v9.26.4, enabling pruned nodes to fully validate DigiDollar without requiring txindex, by retaining the DigiDollar-era block window and guarding against incomplete pruned data directories. It also adds extensive functional/regression coverage and operator-facing documentation for the new pruning behavior.

Changes:

• Add a DigiDollar activation-floor prune lock and a startup data-availability guard for pruned nodes.
• Rewire DigiDollar UTXO scanning/amount resolution to work without txindex by reading creating transactions from retained blocks.
• Add new functional/regression tests + release notes and bump the client build version to 9.26.4.

Reviewed changes

Copilot reviewed 16 out of 38 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
V9.26.4_PRUNING_PLAN.md	New design + TDD plan documenting the pruning approach and verification strategy.
V9.26.4_PRUNING_EXPLAINER.md	New short explainer describing pruning behavior and how it was proven.
V9.26.4_PR_EXPLAINER.md	New PR explainer mirroring the operator/reviewer narrative for the changes.
V9.26.4_MAINNET_VALIDATION.md	New mainnet validation record for pruned/no-txindex operation.
test/functional/feature_digidollar_pruning.py	New end-to-end functional test covering activation, mint/send/redeem, pruning, restart parity, IBD, reorg, and guard behavior.
test/functional/test_runner.py	Registers the new pruning functional test in the functional suite list.
test/functional/rpc_getblockreward.py	Adds a functional test for the getblockreward RPC (currently not wired into the runner list).
test/functional/digidollar_verifychain_cache_side_effect.py	Regression test ensuring verifychain doesn’t mutate live DigiDollar/oracle caches.
test/functional/digidollar_transaction_fees.py	Regression test ensuring DigiDollar send fee reporting is non-zero.
test/functional/digidollar_testnet26_oracle_roster_rpc.py	Regression test for testnet26 oracle roster/name exposure via RPC.
test/functional/digidollar_stats_reorg.py	Regression test for DigiDollar stats index rewind correctness across reorg.
test/functional/digidollar_stats_reordered_mint.py	Regression test for mint output ordering edge cases affecting wallet/index accounting.
test/functional/digidollar_send.py	Regression test covering send response schema and sub-dollar/fractional input handling.
test/functional/digidollar_rpc_amount_filters.py	Regression test for DigiDollar RPC amount parsing, filters, and boundary defaults.
test/functional/digidollar_protection_status.py	Regression test ensuring getprotectionstatus matches getdigidollarstats health.
test/functional/digidollar_pending_position_status.py	Regression test for pending mint position reporting when walletbroadcast is disabled.
test/functional/digidollar_oracle_signers.py	Regression test for exposing decoded MuSig2 bundle participants via RPC.
test/functional/digidollar_oracle_price.py	Regression test for oracle price precision and non-hardcoded volatility/high-low fields.
test/functional/digidollar_listunspent.py	Regression test pinning DigiDollar list-unspent semantics and filters.
test/functional/digidollar_listoracle_schema.py	Regression test pinning listoracle schema when a local oracle is running.
test/functional/digidollar_health_restart_consensus.py	Regression test ensuring system health reconstruction survives restart (consensus safety).
test/functional/wallet_digidollar_reorg.py	Wallet regression test covering DigiDollar bookkeeping across disconnect/restart flows.
test/functional/wallet_digidollar_transfer_reorg.py	Wallet regression test ensuring abandoned disconnected transfers restore original DD UTXOs.
test/functional/wallet_digidollar_transfer_ancestor_reorg.py	Wallet regression test ensuring descendants don’t resurrect via stale txindex after reorg.
test/functional/wallet_digidollar_rc33_regressions.py	Wallet regression coverage for several RC33-reported mint/send/redeem edge cases.
test/functional/wallet_digidollar_mixed_output_accounting.py	Wallet regression test for multi-recipient send output accounting order.
test/functional/wallet_digidollar_encrypted_received_redeem.py	Wallet regression test for redeeming collateral using received DD in an encrypted wallet.
src/init.cpp	Disables -txindex/DD stats index under prune by default and relaxes DigiDollar txindex requirement in prune mode.
src/node/chainstate.cpp	Registers the "digidollar" prune lock and adds the pruned-datadir DigiDollar window guard.
src/digidollar/health.h	Extends ScanUTXOSet signature and metrics to track active position count and support chain/consensus inputs.
src/digidollar/health.cpp	Implements prune-compatible UTXO scan by skipping pre-floor coins and using block-db transaction reads.
src/rpc/digidollar.cpp	Passes chain/consensus into UTXO scan and provides active position count fallback when stats index is disabled.
src/oracle/bundle_manager.cpp	Enhances handling/logging for startup block read failures during oracle price reconstruction.
src/test/digidollar_txindex_tests.cpp	Adds unit coverage proving txindex is not required under prune for DigiDollar nodes.
doc/release-notes/release-notes-9.26.4.md	New operator-facing release notes documenting prune mode behavior/limitations.
DIGIDOLLAR_ARCHITECTURE.md	Updates architecture documentation to reflect prune-compatible UTXO scanning.
configure.ac	Bumps build version from 9.26.3 to 9.26.4.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[DigiSwarm]

v9.26.4 pruning — testnet26 test results 🍃

— DigiSwarm, DGB AI dev team · live testnet26, 2026-07-02

We ran the v9.26.4 pruned build against live testnet26, where DigiDollar is
already ACTIVE (since block 600). That's the important part: testnet is the
only live network where a pruned node does real DigiDollar validation against
real on-chain positions and the real oracle roster — basically a dress rehearsal
for post-activation mainnet.

Setup: two nodes from the same synced testnet26 data — one full (txindex,
reference) and one pruned (prune=550, no txindex) — side by side on the
live network.

What we confirmed

1. It boots correctly. The pruned node auto-turned-off txindex and the stats
   index, and logged retaining all blocks at/above height 600 (the DigiDollar
   activation floor). DigiDollar shows ACTIVE. Advertises as a limited (pruned)
   peer, as expected.

2. Pruned = full, to the penny. Live side-by-side, the pruned node's
   DigiDollar stats matched the full node exactly: $4,720.77 DD supply, 18
   active positions, 6.63M DGB collateral, 335% health, oracle available —
   identical block hashes at the same tip, both validating new blocks as they
   arrived. The pruned node computes this from a live UTXO scan (no index), and
   it lands on the same numbers.

3. Restart is safe. Stopped/restarted the pruned node — the startup
   data-availability guard passed and the DigiDollar numbers came back identical.
   No drift.

4. Reindex works. Ran -reindex on the pruned node; it rebuilt and came back
   to the exact same DigiDollar state.

5. Damaged data fails safe. Truncated a block file — the node refused to
   start and told us to -reindex; running -reindex fully recovered it to
   identical state. It never ran on bad data.

6. Rescan works. Loaded our DigiSwarm oracle wallet ($1.00 DD, 6
   positions, 1.58M testnet DGB) and rescanned — DD balance preserved.

7. A pruned node runs the real oracle. Imported the actual DigiSwarm
   slot-15 testnet key on the pruned node — its pubkey matches the live
   testnet26 roster — and startoracle reported it running. A pruned node
   can operate a production oracle (it only needs a wallet key + live prices +
   P2P, never old blocks or the txindex).

One honest caveat about testnet

testnet26's entire chain is tiny (~24 MB, a single block file), so it is below
the 550 MiB minimum prune size — meaning no blocks actually get deleted there. So
testnet proves the functional side (a pruned node validates / mints / redeems
DigiDollar correctly and stays in lockstep with full nodes), while the
disk-saving side was proven on mainnet separately: 38 GB → 0.21 GB,
with the node refusing to delete any DigiDollar-era block even when explicitly
asked (see V9.26.4_MAINNET_VALIDATION.md).

Every scenario we ran (all passed)

#	Test	Result
1	Boots pruned: txindex/stats-index off, prune lock @600, DD active	✅
2	Full-vs-pruned DigiDollar stats parity (live)	✅ identical
3	Normal restart: guard passes, no drift	✅
4	-reindex: rebuild, parity restored	✅
5	Damaged block file: refuses to start, -reindex recovers	✅ fail-safe
6	Rescan preserves DD balance	✅
7	Runs the real DigiSwarm slot-15 oracle	✅ running

Nothing is left on the testnet list. The only behavior testnet can't show is
physical block deletion (its chain is a single ~24 MB file, under the 550 MiB
prune floor) — and that is proven separately on mainnet: 38 GB → 0.21 GB,
with the node refusing to delete any DigiDollar-era block even when explicitly
asked (V9.26.4_MAINNET_VALIDATION.md). Our automated regtest suite adds 15
more pruning scenarios (reindex recovery, fail-closed-on-damaged-data, offline
miner reorg, oracle-on-pruned, etc.).

Bottom line

A pruned v9.26.4 node on the live, DigiDollar-active testnet validates
identically to a full node (to the penny), survives restarts and reindex,
refuses to run on damaged data and recovers cleanly, serves wallets with real
DigiDollar, and runs the real DigiSwarm oracle. Ready for pools.

[JaredTate]

ACK I have tested on main net and testnet, it looks good to go.

[ycagel]

cACK

[gto90]

utACK

[ycagel]

cACK

[gto90]

utACK

[ycagel]

cACK