backport: [easy] bitcoin#27895, bitcoin#28028, bitcoin#28557, bitcoin#26780

[DCG-Claude]

⚠️ Easy batch, but not every commit is faithful any more (a later rebase or fix changed one). Read the review column before merging.

Issue being fixed or feature implemented

Backports 4 Bitcoin Core v0.26 pull request(s) that the Dash queue selected, including any discovered prerequisites: bitcoin#27895, bitcoin#28028, bitcoin#28557, bitcoin#26780.

What was done?

upstream	commit	review	gates	notes
bitcoin#28028	5e002d178c	🟡 light	build:pass mech:warn pick:pass tests:pass tree:pass verify:pass	This faithfully backports bitcoin#28028: the expected_stderr check moves from stop_node() into is_node_stopped
bitcoin#27895	4eda3493f9	🟢 faithful	build:pass mech:pass pick:pass tests:warn tree:pass verify:pass	clean cherry-pick
bitcoin#28557	058184e0a0	🟢 faithful	build:pass mech:pass pick:pass tests:warn tree:pass verify:pass	clean cherry-pick
bitcoin#26780	072d502f21	🟢 faithful	build:pass ci_fork:pass mech:pass pick:pass tests:pass tree:pass verify:pass	clean cherry-pick

Each commit keeps the upstream subject (partial Merge … only where a hunk is deferred to a prerequisite still to be backported, named in the commit body; a hunk Dash intentionally never wants is recorded in the commit body or the reviewer's note above and does not make the backport partial). Conflicts were resolved commit by commit; commits that needed no resolution were cherry-picked unchanged.

How Has This Been Tested?

Recorded per commit, at that commit's own sha, not once for the branch:

• built at each commit, reusing the worktree build cache
• the test suites touched by each diff run at that commit, where the diff selected one
• a mechanical diff-of-diffs against the upstream patch (every upstream hunk present, no added line without an upstream counterpart, no Dash-specific line dropped)
• an independent verification pass on 4 commit(s) that needed adaptation
• CI green on the fork gate PR backport: v0.26 bitcoin#27895, bitcoin#28028, bitcoin#28557, bitcoin#26780 thepastaclaw/dash#89 at 072d502f21, which is this branch's head

Gates that did not come back clean — please weigh these:

• test: clean up is node stopped bitcoin/bitcoin#27895 tests: warn — no test selected for this diff
• test: Check expected_stderr after stop bitcoin/bitcoin#28028 mech: warn — 1 invented line(s)
• bench: remove NO_THREAD_SAFETY_ANALYSIS usage bitcoin/bitcoin#28557 tests: warn — no test selected for this diff

Breaking Changes

None beyond the upstream changes themselves.

Checklist:

Left for the reviewer; backportsys does not tick boxes on its own behalf.

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation
• I have assigned this pull request to a milestone

---

Maintainer controls

Tick a box and backportsys acts on it within a few minutes, then clears the box. For anything else — a hunk to drop, a resolution to redo, a question — just leave a review comment; nothing here needs a box.

• 🔒 Hands off — stop every automated update to this branch
• 🔄 Rebase onto current develop
• ❌ Close — abandon this batch and release its items

[thepastaclaw]

🕓 Review not started yet because the new head is waiting for the 30-minute push debounce.

• Request normal review — click when the PR is ready for review.
• Request priority review — click to move this review to the front of the queue.

Commit 971341b. Normal review starts when eligible; priority review starts as soon as a slot is available.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (2)

AGENTS.md — auto-discovered
doc/developer-notes.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9ab3cb2e-1335-481d-a345-10ac61a5bc94

📥 Commits

Reviewing files that changed from the base of the PR and between 8819507 and 072d502.

📒 Files selected for processing (6)

• src/bench/disconnected_transactions.cpp
• src/rpc/blockchain.cpp
• test/functional/feature_abortnode.py
• test/functional/rpc_blockchain.py
• test/functional/rpc_scanblocks.py
• test/functional/test_framework/test_node.py

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

The scanblocks RPC now scans inclusive chunks of up to 10,000 blocks and returns a completed field with its result. Shutdown checks in the functional test framework now validate expected exit codes and optional stderr. Related functional tests check the expected shutdown messages and scan completion. The disconnected-transaction benchmark callbacks no longer use NO_THREAD_SAFETY_ANALYSIS.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant scanblocks RPC
  participant Active chain
  participant Block filter
  Client->>scanblocks RPC: Start scan with height range
  scanblocks RPC->>Active chain: Resolve start and stop heights
  Active chain-->>scanblocks RPC: Return block indices
  loop Inclusive ranges of up to 10,000 blocks
    scanblocks RPC->>Block filter: Check filters in current range
    Block filter-->>scanblocks RPC: Return matching results
  end
  scanblocks RPC-->>Client: Return results, last endpoint, and completed status

Loading

Merge Risk: ⚪ Minimal · up to 072d5

The change chunks scanblocks ranges, tightens shutdown checks in the functional tests, and removes thread-safety annotations from the benchmark callbacks. No concrete merge-blocking risk was identified.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 072d5

Chunked scans can lose a consistent chain view during a reorganization. Results may combine different branches, and a sufficiently shortened chain can cause node-wide failure. Existing access paths are unchanged; production exposure and downstream consequences remain uncertain.

Retained concerns

• Medium · reliability · inferred: Chunk endpoints are not anchored to one chain ancestry. A concurrent reorganization can mix branch results, while sufficient chain shortening can produce a null endpoint and fail the node process. The former membership-checked traversal contained these transitions more safely. Security impact beyond node availability and scan-result integrity is not established.

Security review details

Security Blast Radius

• inferred — The supported exposure is scan-output integrity and availability of the node process executing the scan. A null endpoint can escape scan-local failure containment. Cross-service, tenant, financial, or persistent-data consequences are not established.

Security Findings and Attack Paths

• inferred — The conditional failure path requires an admitted scan request overlapping a chain transition. Changing ancestry can mix results; shortening below a selected intermediate height can fail the process. Ordinary request parameters alone do not establish an exploit, and practical attacker control over that chain transition remains unverified.

Trust Boundaries and Controls

• observed — Filter-type validation, index availability checks, active-chain height validation, and exclusive reservation constrain scanning. These controls do not preserve endpoint ancestry throughout the operation. Production RPC authentication and deployment ACLs were not established by the inspected evidence.

Hardening Proposals

• proposed — Anchor chunk endpoints to the captured stop block's ancestry, or explicitly detect chain invalidation and terminate safely. Keep abort reporting distinct from successful range-read coverage so callers can distinguish cancellation, invalidation, and incomplete reads.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 54.55% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 11 functions across 6 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title identifies this as a backport and lists the four upstream pull requests covered by the changes.
Description check	✅ Passed	The description explains the four backports, summarizes their changes, and reports testing and review notes relevant to the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

Final validation — Phase 1 + Phase 2

Verified all six changed files and the four backport commits at head 072d502 against their upstream diffs and relevant Dash callers; no actionable in-scope defects or missing upstream hunks were found. The shutdown changes preserve caller compatibility and correctly account for Dash’s governance-pruning warning, while the scanblocks refactor retains special-transaction matching. Static whitespace validation passed; no builds or tests were run locally, and the supplied CI snapshot shows successful lint and completed platform builds, with three Linux test jobs, the ASan build, and multiprocess dependency build still pending.

Review provenance

Source: reviewer 1: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: backport-reviewer); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: dash-core-commit-history); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: normal by gpt-6.1-sol (effort low) — The batch changes scanblocks RPC iteration, progress and completion reporting alongside shared test-node shutdown checks, making it an ordinary logic change rather than a trivial cleanup or a change to a critical surface.
• Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer
• Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 15% left, 5h 100% left), glm-5.3-flash (not used above high effort; tier asks max)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort high); agent phase2-reviewer, gpt-6.1-sol — backport-reviewer (completed, effort high); agent phase2-reviewer, gpt-6.1-sol — dash-core-commit-history (completed, effort high); agent phase2-reviewer

[PastaPastaPasta]

utACK 072d502