Bitcoin Core

wallet: reject sendtoaddress and sendmany for external signers

The sendtoaddress and sendmany RPCs always go through SendMoney(), which
expects to sign internally. External signer wallets should use the PSBT
flow instead, via the send RPC.

Return a more specific error for external signer wallets and add
functional test coverage for both RPCs.

coins: compact chainstate in background

Full chainstate compaction can take minutes on large databases.
Move `CCoinsViewDB::CompactFull()` to a named `utxocompact` one-shot background thread so validation only schedules the work.

When validation selects compaction after a full flush, the chainstate was just written and another write is less likely to be needed immediately.
The coins view destructor waits for completion, and a mutex prevents compaction from using `m_db` while `ResizeCache()` replaces it.

Co-authored-by: Andrew Toth <andrewstoth@gmail.com>

validation: randomly compact chainstate

Full chainstate flushes are convenient maintenance points for long-term LevelDB cleanup because the chainstate was just written.
Randomize the trigger so nodes that flush near the same height do not compact together.

Add blocking chainstate compaction through `CCoinsViewDB::CompactFull()` and give each post-IBD full flush on the normal chainstate a 1/320 chance to start compaction.
With hourly flushes this averages roughly every two weeks and makes a six-month miss about one in a million.
This keeps the schedule stateless and leaves last-compaction height or timestamp bookkeeping out of chainstate metadata.

Co-authored-by: Andrew Toth <andrewstoth@gmail.com>

doc: add taproot descriptor to getdescriptors example

Wallets import descriptors for all supported address types in a
BIP44/49/84/86 compatible manner, so show the BIP86 tr() descriptor in
the example response as well.

doc: clarify which commands receive --chain, --fingerprint and --stdin

Bitcoin Core passes --chain and --fingerprint to every signer command
except enumerate, so mark them "(required except for enumerate)" and
name the current commands only as examples. Keep --stdin documented as
required for all commands so the interface stays flexible, noting that
Bitcoin Core currently only uses it for signtx.

Add the missing flags to the getdescriptors and displayaddress usage
examples and the corresponding doxygen comments, matching the order and
form of the actual invocations, add testnet4 to the chain name lists,
and drop the getaddressinfo implementation detail from the
walletdisplayaddress description.

doc: replace stale signtransaction wording with current signtx flow

The protocol documentation still described a "signtransaction" command
driven by sendtoaddress and sendmany. Those RPCs never gained external
signer support: it was effectively precluded by #21201, which was
merged a few days before external signer support landed in #16546, so
the interaction was missed in review (#33112 has a commit making the
rejection explicit). Spending from an external signer wallet uses
send/sendall (and bumpfee for fee-bumping), which invoke the signer
with `<cmd> --stdin` and pass the `signtx` subcommand and PSBT over
stdin.

Update the spending example and the protocol description accordingly,
using `bitcoin rpc` for the example since it enables -named by default.

doc, rpc: document enumerate model field and fingerprint deduplication

The external signer "enumerate" response uses the optional "model"
field, not "name". Document that Bitcoin Core maps it to the "name"
field of the enumeratesigners RPC result, and that signers with
duplicate master key fingerprints are skipped.

Also document that wallet operations require exactly one connected
signer.

Co-authored-by: optout <13562139+optout21@users.noreply.github.com>
Co-authored-by: naiyoma <lankas.aurelia@gmail.com>

coins: test chainstate flush baseline

Add `CDBWrapper::GetProperty()` and expose it through `CCoinsViewDB::GetDBProperty()` so coins tests can inspect LevelDB runtime properties through the coins view.
Use it in a coins DB flush baseline that records the LevelDB layout after flushing while keeping readback coverage for the flushed coin and best block.

Co-authored-by: Andrew Toth <andrewstoth@gmail.com>

test: ensure group data cluster pointers are live

ci: Alpine 3.24

test: add abortscan unit test

Co-authored-by: w0xlt <woltx@protonmail.com>

wallet: move fAbortRescan reset into WalletRescanReserver reserve()

Reserving the wallet rescan is the first thing done when starting a rescan.
As part of the reservation, clear any leftover state from previous
rescans (reset fAbortRescan). This prevents a race condition
where an abort request arrives before the rescan loop starts; without
this reset, the abort could be ignored and the rescan would proceed.

Co-authored-by: w0xlt <woltx@protonmail.com>

btcsignals: delete broken scoped_connection move assignment

The defaulted move assignment overwrites m_conn without disconnecting
it first, so the previous callback stays registered with the signal and
keeps firing, violating the RAII contract:

btcsignals::scoped_connection sc0 = sig.connect(IncrementCallback);
btcsignals::scoped_connection sc1 = sig.connect(SquareCallback);
sc0 = std::move(sc1);
val = 3; sig(val); // both callbacks fire: 16 instead of 9

Move assignment is unused in the codebase, so delete it rather than
fixing it. It can be implemented properly if a use case arises.

validation: check invariants when inserting into m_blocks_unlinked

For an entry A -> B in m_blocks_unlinked, the entry B was added into
m_blocks_unlinked either because:
- some ancestor of B was never received (or)
- some ancestor of B was pruned away.

Every insert must satisfy two invariants:
1. B has BLOCK_HAVE_DATA set.
2. No duplicate A -> B entries in m_blocks_unlinked (this is UB zone if
this entry gets popped twice in ReceivedBlockTransactions and
happens to be in setBlockIndexCandidates)

2 bugs (#35070 and #35168) discovered recently stemmed from the
m_blocks_unlinked insertion sites not enforcing these invariants.
So add a helper which wraps around insertion sites of m_blocks_unlinked
with these invariants.

Co-authored-by: Martin Zumsande <mzumsande@gmail.com>

test/doc: remove misleading comment and improve tests

remove misleading comment for m_blocks_unlinked since for
pruned nodes:
- usually A is the missing data (just like in non-pruned nodes)
- in PruneOneBlockFile, we remove entries once data for B is missing.

Co-authored-by: Martin Zumsande <mzumsande@gmail.com>

test: add coverage for UB caused by FindMostWorkChain

when pruned node2 finally receives the blocks from
node0, node2 will process duplicate entires in
ReceivedBlockTransactions twice but it will only
insert into setBlockIndexCandidates if the block has
more work that the current chain tip.

the duplicate entries in m_blocks_unlinked in this
test are from height 1171 to 1294.

before this commit
- we invalidated height 1320 and chain tip became
1319. so we won't add duplicate entries (all have
<1319) into setBlockIndexCandidates and won't
have coverage for this UB scenario.

with this commit
- we invalidate height 1295 and chain tip became
1294. so we will process the duplicate entry
1294 in m_blocks_unlinked and have coverage
for this UB.

Co-authored-by: Martin Zumsande <mzumsande@gmail.com>

validation: avoid duplicates in m_blocks_unlinked

In a pruned node undergoing a deep reorg, FindMostWorkChain can
insert duplicate entries into m_blocks_unlinked.

This can happen when:
- Traversing from one candidate tip to the fork point adds blocks
whose parents have been pruned.
- Traversing from another candidate tip over the same fork inserts
the same pairs again, since the blocks are shared across
both branches.

When we finally download the missing parent from our peer and call
ReceivedBlockTransactions to process m_blocks_unlinked, the same
entry may be processed multiple times.

This can lead to re-insertion into setBlockIndexCandidates with
a modified nSequenceId, violating its ordering invariants and
causing undefined behavior. So avoid duplicate insertions into
m_blocks_unlinked here.

Co-authored-by: Martin Zumsande <mzumsande@gmail.com>

fuzz: test non-max descriptor satisfaction weight

Also assert that the availability of the satisfaction weight estimate
does not depend on the signature-size assumption, and that assuming
non-max-size signatures never increases the estimate.

qa: Use custom assert_greater_than() over naked assert

Co-authored-by: DrahtBot <39886733+DrahtBot@users.noreply.github.com>

fuzz: improve dbwrapper_concurrent_reads performance

test: add coverage for importdescriptors when manually interrupting a wallet rescan

Co-authored-by: w0xlt <woltx@protonmail.com>

test: add coverage for importdescriptors errors when using assumeutxo

Co-authored-by: w0xlt <woltx@protonmail.com>

test: add coverage for importdescriptors while wallet is rescanning

Co-authored-by: w0xlt <woltx@protonmail.com>

test: updated different_key to be different_field and also used a single assert_equal with 3 args instead of multiple assert_equals

iwyu: Fix warnings in `src/bench` and treat them as error