fix(node): honor disabled optional indexes

[metaphorics]

Keep txindex and compact-filter index handles optional so disabled indexes are neither opened nor advertised, while RPC lookup paths preserve Core-compatible disabled-index behavior.

Verification:

• cargo fmt --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml --all -- --check

• cargo test --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml -p bitcoin-rs-rpc --lib --no-fail-fast

• cargo test --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml -p bitcoin-rs-rpc --test handler_smoke --no-fail-fast

• FEATURES=rocksdb,fjall,redb,mdbx,bitcoinconsensus cargo test --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml -p bitcoin-rs-node --lib --no-default-features --features $FEATURES --no-fail-fast

• FEATURES=rocksdb,fjall,redb,mdbx,bitcoinconsensus cargo test --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml -p bitcoin-rs-node --test state_storage --no-default-features --features $FEATURES --no-fail-fast

• FEATURES=rocksdb,fjall,redb,mdbx,bitcoinconsensus cargo test --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml -p bitcoin-rs-node --test rpc_wiring --no-default-features --features $FEATURES --no-fail-fast

• FEATURES=rocksdb,fjall,redb,mdbx,bitcoinconsensus cargo test --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml -p bitcoin-rs-node --test sync_smoke --no-default-features --features $FEATURES --no-fail-fast

• FEATURES=rocksdb,fjall,redb,mdbx,bitcoinconsensus cargo clippy --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml -p bitcoin-rs --all-targets --no-default-features --features $FEATURES -- -D warnings

• FEATURES=rocksdb,fjall,redb,mdbx,bitcoinconsensus cargo test --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml -p bitcoin-rs --no-default-features --features $FEATURES --no-fail-fast

• cargo test --manifest-path /home/alpha/dev/bitcoin-rs/bitcoin-rs/Cargo.toml --workspace --no-fail-fast

Op: correct

Restores: spec: optional txindex/blockfilterindex disabled semantics

[metaphorics]

@codex review

[gemini-code-assist]

Code Review

This pull request introduces sharded tracking for CoinStatsListener to improve performance, adds a headers-only synchronization mode, and makes txindex and blockfilterindex optional. It also adds transaction verification profiling and several benchmark suites. The review feedback highlights a critical bug in apply_signed_delta where large positive deltas cause incorrect decrements, and suggests optimization opportunities such as lazily serializing transactions for Taproot inputs and removing redundant timers in block application.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Serializing the transaction eagerly before the input loop is inefficient when all inputs are Taproot (P2TR), as Taproot script verification bypasses bitcoinconsensus and uses the local interpreter directly. We can lazily serialize the transaction only when a non-Taproot input is encountered by passing a &mut Option<Vec<u8>> to verify_input_script.

Suggested change

	#[cfg(feature = "bitcoinconsensus")]
	let serialized_tx = encode::serialize(tx);
	for (input_index, (input, prevout)) in tx.input.iter().zip(input_prevouts.iter()).enumerate() {
	#[cfg(feature = "bitcoinconsensus")]
	verify_input_script(
	input_index,
	input,
	prevout,
	tx,
	serialized_tx.as_slice(),
	flags,
	)?;
	#[cfg(feature = "bitcoinconsensus")]
	let mut serialized_tx = None;
	for (input_index, (input, prevout)) in tx.input.iter().zip(input_prevouts.iter()).enumerate() {
	#[cfg(feature = "bitcoinconsensus")]
	verify_input_script(
	input_index,
	input,
	prevout,
	tx,
	&mut serialized_tx,
	flags,
	)?;

[gemini-code-assist]

Update verify_input_script to accept &mut Option<Vec<u8>> and lazily serialize the transaction using get_or_insert_with only when a non-Taproot input is verified.

fn verify_input_script(
    input_index: usize,
    input: &bitcoin::TxIn,
    prevout: &bitcoin::TxOut,
    tx: &bitcoin::Transaction,
    serialized_tx: &mut Option<Vec<u8>>,
    flags: VerifyFlags,
) -> Result<(), ConsensusError> {
    let script = Script::from_bytes(prevout.script_pubkey.as_bytes());
    if script.is_p2tr() && flags.contains(VerifyFlags::TAPROOT) {
        return verify_input_script_with_interpreter(input_index, input, prevout, tx, flags);
    }

    let tx_bytes = serialized_tx.get_or_insert_with(|| encode::serialize(tx));
    script
        .verify_with_flags(
            input_index,
            prevout.value,
            tx_bytes,
            flags.consensus_bits(),
        )
        .map_err(|error| ConsensusError::Script {
            input_index,
            reason: format!("script verification failed: {error}"),
        })
}

[gemini-code-assist]

If delta is positive but larger than u64::MAX, u64::try_from(delta) will fail, causing the function to fall through to the negative delta handling logic. In that block, delta.saturating_neg() will be negative, its conversion to u64 will fail, and it will default to u64::MAX, resulting in a decrement of value instead of an addition. Explicitly checking if delta >= 0 ensures correctness for all possible values of delta.

Suggested change

	fn apply_signed_delta(value: &mut u64, delta: i128) {
	if let Ok(increment) = u64::try_from(delta) {
	*value = value.saturating_add(increment);
	return;
	}
	let decrement = u64::try_from(delta.saturating_neg()).unwrap_or(u64::MAX);
	*value = value.saturating_sub(decrement);
	}
	fn apply_signed_delta(value: &mut u64, delta: i128) {
	if delta >= 0 {
	let increment = u64::try_from(delta).unwrap_or(u64::MAX);
	*value = value.saturating_add(increment);
	} else {
	let decrement = u64::try_from(delta.saturating_neg()).unwrap_or(u64::MAX);
	*value = value.saturating_sub(decrement);
	}
	}

[gemini-code-assist]

The block_transactions_started and block_transactions_dur timers are redundant as they measure the exact same block of code as script_verify_started and script_verify_dur. We can eliminate the extra timer and reuse script_verify_dur.

    let script_verify_started = quanta::Instant::now();
    let script_verify_result = 
        verify_block_transactions(handles, block, height, locktime_cutoff, verify_flags);
    let script_verify_dur = script_verify_started.elapsed();
    metrics::histogram!("node.apply_block.script_verify_seconds")
        .record(script_verify_dur.as_secs_f64());
    let script_verify_profile = script_verify_result?;
    if script_verify_dur.as_micros() >= SCRIPT_VERIFY_OUTLIER_BLOCK_US {
        let verify_block_transactions_us = script_verify_dur.as_micros();

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f3e04e2d82

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate the in-memory transaction cache with txindex

When running with the new default txindex = false, this guard skips the persistent txindex ingest, but the loop immediately above still inserts every confirmed transaction into handles.transactions unconditionally. During a normal full sync with txindex disabled, the node will still retain all confirmed transactions in RAM even though getrawtransaction now refuses to use that cache without ctx.indexer, so disabling the optional index does not actually avoid the largest resource cost. Please skip or bound that confirmed transaction cache when handles.tx_index is None.

Useful? React with 👍 / 👎.

[Copilot]

Pull request overview

This PR primarily restores Bitcoin Core-compatible behavior for optional indexes (txindex / basic block filter index) so that when disabled they are not opened, not advertised via RPC, and related RPCs fail with Core-like “index disabled” errors. The PR also includes additional changes around headers-only sync, coinstats listener concurrency, script verification profiling, and new Criterion benchmarks.

Changes:

• Make txindex and compact-filter index handles truly optional across node state, apply pipeline, and RPC context/handlers (including Core-compatible disabled-index RPC behavior).
• Add/expand headers-only sync mode wiring (config + sync behavior + tests) and extend RPC getblockhash behavior to use active headers when block records are missing/stale.
• Introduce performance/profiling instrumentation and Criterion benchmarks (script interpreter, consensus tx verification, UTXO/coinstats commit).

Reviewed changes

Copilot reviewed 26 out of 27 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/utxo/src/set.rs	Optimizes UTXO commits by tracking and processing only dirty shards.
crates/utxo/benches/utxo_commit.rs	Improves synthetic txid distribution and asserts shard coverage in benchmarks.
crates/script/Cargo.toml	Adds Criterion bench configuration for script crate.
crates/script/benches/interpreter_execute_profile.rs	Adds diagnostic benchmark for Interpreter::execute boundary costs.
crates/rpc/tests/handler_smoke.rs	Adds/updates RPC smoke tests for disabled indexes and header-first getblockhash.
crates/rpc/src/handlers/tx.rs	Gates confirmed-tx lookup for getrawtransaction on txindex being enabled.
crates/rpc/src/handlers/chain.rs	Returns “index disabled” for getblockfilter; updates getindexinfo to omit disabled indexes and use Core-style names.
crates/rpc/src/error.rs	Introduces RpcError::IndexDisabled with Core-like -1 error code.
crates/rpc/src/context.rs	Makes filter_index optional; prefers active header chain for height→hash lookups.
crates/node/tests/sync_smoke.rs	Extends sync smoke tests and adds ignored profiling harnesses; updates ApplyHandles optional index hooks.
crates/node/tests/state_storage.rs	Tests that optional indexes aren’t opened/created when disabled; validates Electrum requires txindex.
crates/node/tests/rpc_wiring.rs	Updates wiring test for optional index handles (Option-wrapped).
crates/node/tests/config_layered.rs	Adds layered-config test coverage for headers_only.
crates/node/src/sync.rs	Adds headers-only mode behavior (no getdata, drop inbound blocks, genesis header bootstrapping).
crates/node/src/state.rs	Makes txindex/filterindex handles optional; Electrum helpers now return Result and require txindex storage.
crates/node/src/run.rs	Wires Electrum startup through fallible txindex-dependent helpers; passes optional txindex to RPC context.
crates/node/src/config.rs	Adds headers_only configuration, CLI/env layering, and Electrum→txindex validation.
crates/node/src/apply.rs	Makes optional indexes best-effort (skip when disabled); adds script verification profiling attribution.
crates/consensus/src/verify_tx.rs	Refactors input script verification to use bitcoinconsensus for non-taproot and local fallback for taproot; adds tests.
crates/consensus/Cargo.toml	Adds Criterion bench configuration for consensus crate.
crates/consensus/benches/verify_transaction_profile.rs	Adds diagnostic benchmark for production tx verification path.
crates/coinstats/tests/snapshot_with_muhash.rs	Adds extensive tests around listener correctness under commit/undo and mid-block snapshots.
crates/coinstats/src/stats.rs	Reworks coinstats listener into sharded deltas with linearized folding/snapshotting.
crates/coinstats/Cargo.toml	Adds Criterion bench configuration for coinstats crate.
crates/coinstats/benches/utxo_commit_coinstats.rs	Adds synthetic benchmark comparing listener strategies and coinstats overhead.
Cargo.lock	Adds Criterion dependencies to affected crates.
bin/bitcoin-rs/tests/gates/g01_headers_only_sync.rs	Reworks ignored gate test to validate externally collected headers-only evidence bound to git HEAD.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.