#36542 AssumeUTXO: allow retrying loadtxoutset after an interrupted load

Configures snapshot coins database initialization to wipe existing data before opening during AssumeUTXO snapshot activation. This allows subsequent loadtxoutset calls to succeed after an interrupted snapshot load, without requiring manual deletion of the chainstate_snapshot directory, and adjusts the malformed directory warning log accordingly.

Problem: An interrupted loadtxoutset call can leave an incomplete chainstate_snapshot database without the base_blockhash marker file. Subsequent attempts to load a snapshot fail to open the database, requiring node operators to manually locate and delete the directory from disk.

Evidence of importance:

• PR description and commit 15a891d402: 'An interrupted loadtxoutset can leave an incomplete chainstate_snapshot database without its required base_blockhash marker. A later call can fail to open that database, requiring the operator to remove it manually before retrying.'

Risk of a mistake: medium (validation). A mistake when instructing LevelDB to wipe an existing coins database during snapshot activation could accidentally discard valid chainstate data if applied to the wrong chainstate.

Changed since the previous assessment: The PR has shifted scope completely: previously it handled removing stale chainstate_todelete directories during ValidatedSnapshotCleanup on node startup, whereas it now passes should_wipe=true when initializing the snapshot coins DB during loadtxoutset to recover from interrupted snapshot loads.

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

• author: answer cyb3ralbert's question about covering locked databases in tests 2026-10-29

Strong

substantive support, no open objection (cyb3ralbert)

Thread notes: Initial record. cyb3ralbert provided a Tested ACK with test details and asked whether regression testing should cover snapshot database locks.

Objections, suggestions, and questions:

Support:

• cyb3ralbert (contributor) (Tested ACK, 2026-10-29) [tested: feature_assumeutxo.py]: Tested on Linux aarch64 (Debian 13, GCC 14.2.0); verified restart and retry scenarios and feature_assumeutxo.py passed

Participants:

• cyb3ralbert (contributor, support, 1 statements 2026-10-29 to 2026-10-29): tested ACK with test results; asked if regression tests should cover a locked snapshot database

4 lines under test/bench/ci.

• src/node/utxo_snapshot.cpp +2/-2
• test/functional/feature_assumeutxo.py +4/-0
• src/validation.cpp +1/-1

The short text the ranking pass compares across PRs.

Allows loadtxoutset to retry cleanly after an interrupted AssumeUTXO snapshot load without requiring manual disk cleanup. When an interrupted load leaves an incomplete chainstate_snapshot database missing its base_blockhash marker, subsequent load attempts fail. The PR sets should_wipe to true when activating the snapshot coins database so that retry calls wipe and overwrite partial data, and updates the startup warning log to reflect the retry behavior.

P3 · bug fix (ranking pass: Moved up: removes a manual-intervention recovery step after interrupted snapshot loads, grouped with the other assumeutxo robustness fixes)

Allows retrying loadtxoutset after an interrupted snapshot load without requiring manual deletion of the chainstate_snapshot directory. An interrupted load previously left an incomplete snapshot database missing its marker file, blocking retry attempts until operator intervention.

Membership: Carries the Validation label and alters AssumeUTXO snapshot chainstate initialization in src/node/utxo_snapshot.cpp and src/validation.cpp.

Factors: security/stability 1, bug 1, performance 0, user value 1, leverage 0