@@ -111,6 +111,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   `key::Error::InvalidWifCompressionFlag`
 - Accept an IL of zero in `key-wallet` private child derivation
 - `transaction_sign_input` in `key-wallet-ffi` rejects flags above `0xff`
+- `dash-spv` drops the masternode lists, and the rotated quorum cycles, built
+  above a fork it follows, so they no longer answer for blocks that left the
+  chain
+- `dash-spv` no longer follows a fork that branches off below the newest
+  checkpoint its stored chain reaches
 
 ### Removed
 
 
@@ -269,28 +269,37 @@ impl<W: WalletInterface, N: NetworkManager> DashSpvClient<W, N> {
             self.stop_locked(forked).await;
 
             tracing::warn!("Fork at height {}, dropping the stored chain above it", fork_height);
-            // The wallets go first: a wallet refusing the fork leaves storage as
-            // it is, and storage failing after them keeps the fork unstored, so
-            // it is detected and retried.
-            let truncated = async {
-                self.wallet.write().await.truncate_above(fork_height)?;
-                let mut storage = self.storage.lock().await;
-                BlockHeaderStorage::truncate_above(&mut *storage, fork_height).await?;
-                FilterHeaderStorage::truncate_above(&mut *storage, fork_height).await?;
-                FilterStorage::truncate_above(&mut *storage, fork_height).await?;
-                BlockStorage::truncate_above(&mut *storage, fork_height).await?;
-                Ok::<_, Box<dyn std::error::Error + Send + Sync>>(())
-            }
-            .await;
-
-            if let Err(e) = truncated {
+            if let Err(e) = self.truncate_chain_above(fork_height).await {
                 tracing::warn!("Fork at height {} not followed: {}", fork_height, e);
             }
 
             self.run_locked(&mut sync_loop).await
         })
     }
 
+    /// Drops what the wallets, the stored chain and the masternode engine hold
+    /// above `height`.
+    ///
+    /// The wallets go first: a wallet refusing the fork leaves storage as it
+    /// is, and storage failing after them keeps the fork unstored, so it is
+    /// detected and retried. The engine goes right after the headers, which it
+    /// looks rotated cycles up in, so it never holds lists above the stored tip.
+    async fn truncate_chain_above(
+        &self,
+        height: u32,
+    ) -> std::result::Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        self.wallet.write().await.truncate_above(height)?;
+        BlockHeaderStorage::truncate_above(&mut *self.storage.lock().await, height).await?;
+        if let Some(engine) = &self.masternode_engine {
+            engine.write().await.truncate_above(height).await;
+        }
+        let mut storage = self.storage.lock().await;
+        FilterHeaderStorage::truncate_above(&mut *storage, height).await?;
+        FilterStorage::truncate_above(&mut *storage, height).await?;
+        BlockStorage::truncate_above(&mut *storage, height).await?;
+        Ok(())
+    }
+
     /// Stop `sync_loop` and everything it drives. The caller holds the lock.
     pub(super) async fn stop_locked(
         &self,
@@ -445,3 +454,40 @@ impl<W: WalletInterface, N: NetworkManager> DashSpvClient<W, N> {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::test_utils::MockNetworkManager;
+    use dashcore::sml::masternode_list::MasternodeList;
+    use dashcore::BlockHash;
+    use key_wallet::wallet::managed_wallet_info::ManagedWalletInfo;
+    use key_wallet_manager::WalletManager;
+    use tempfile::TempDir;
+
+    /// Following a fork drops the masternode lists built above it, so they stop
+    /// answering for blocks that left the chain.
+    #[tokio::test]
+    async fn following_a_fork_drops_the_masternode_lists_above_it() {
+        let temp_dir = TempDir::new().unwrap();
+        let mut config =
+            ClientConfig::mainnet().without_filters().with_storage_path(temp_dir.path());
+        config.start_from_height = Some(2_500_000);
+        let wallet = Arc::new(RwLock::new(WalletManager::<ManagedWalletInfo>::new(config.network)));
+        let client = DashSpvClient::new(config, MockNetworkManager::new(), wallet, vec![])
+            .await
+            .expect("client construction must succeed");
+        let fork = client.tip_header().await.expect("anchored at the checkpoint").height();
+
+        let engine = client.masternode_list_engine().expect("masternodes are enabled");
+        for height in [fork - 1, fork, fork + 1, fork + 2] {
+            let list = MasternodeList::empty(BlockHash::dummy(height), height);
+            engine.write().await.masternode_lists.insert(height, list);
+        }
+
+        client.truncate_chain_above(fork).await.expect("nothing refuses the fork");
+
+        let heights: Vec<_> = engine.read().await.masternode_lists.keys().copied().collect();
+        assert_eq!(heights, vec![fork - 1, fork]);
+    }
+}
@@ -81,6 +81,30 @@ impl<H: BlockHeaderStorage> MasternodeListEngine<H> {
         self.rotated_quorums_per_cycle.retain(|hash, _| !below_floor.contains(hash));
     }
 
+    /// Drops what the engine built on blocks above `height`, once the header
+    /// chain has dropped them for another branch: the lists above it, and the
+    /// rotated cycles whose base block left the chain or whose mining window
+    /// ends above it, since their commitments may have been mined on the
+    /// dropped branch.
+    pub(crate) async fn truncate_above(&mut self, height: CoreBlockHeight) {
+        if let Some(above) = height.checked_add(1) {
+            self.masternode_lists.split_off(&above);
+        }
+
+        let mining_window_end = self.network.isd_llmq_type().params().dkg_params.mining_window_end;
+        let mut dropped = BTreeSet::new();
+        for cycle_hash in self.rotated_quorums_per_cycle.keys() {
+            let mined_below = self
+                .height_of(cycle_hash)
+                .await
+                .is_some_and(|base| base.saturating_add(mining_window_end) <= height);
+            if !mined_below {
+                dropped.insert(*cycle_hash);
+            }
+        }
+        self.rotated_quorums_per_cycle.retain(|hash, _| !dropped.contains(hash));
+    }
+
     /// Sets the verification status of a quorum in every list holding it.
     /// Lists that shared a quorum map keep sharing the updated one.
     pub(super) fn set_quorum_status(
@@ -435,6 +459,35 @@ mod prune_tests {
         assert_eq!(heights(&engine), vec![floor, TIP, TIP + 1]);
     }
 
+    /// Once the header chain follows another branch at `fork`, nothing built on
+    /// the dropped blocks may answer for them: the lists above the fork go, and
+    /// so does a rotated cycle whose base left the chain or whose commitments
+    /// could have been mined above the fork.
+    #[tokio::test]
+    async fn truncating_above_a_fork_drops_what_the_dropped_blocks_built() {
+        let fork = TIP;
+        let window_end = Network::Mainnet.isd_llmq_type().params().dkg_params.mining_window_end;
+        let mut engine = TestEngine::dummy_with_lists(&[fork - 100, fork, fork + 1, fork + 50]);
+        let mined_below = fork - window_end;
+        let mined_above = mined_below + 1;
+        let left_the_chain = fork + 10;
+        for base in [mined_below, mined_above, left_the_chain] {
+            engine.feed_block_height(base, BlockHash::dummy(base));
+            engine.rotated_quorums_per_cycle.insert(BlockHash::dummy(base), Default::default());
+        }
+        for height in [fork + 1, left_the_chain, fork + 50] {
+            engine.forget_block(&BlockHash::dummy(height));
+        }
+
+        engine.truncate_above(fork).await;
+
+        assert_eq!(heights(&engine), vec![fork - 100, fork]);
+        assert_eq!(
+            engine.rotated_quorums_per_cycle.keys().collect::<Vec<_>>(),
+            vec![&BlockHash::dummy(mined_below)]
+        );
+    }
+
     /// As a legacy QRInfo or a batch of work-block lists does.
     #[tokio::test]
     async fn diffs_sharing_an_older_base_all_apply() {
 
@@ -45,6 +45,8 @@ pub struct BlockHeadersManager<H: BlockHeaderStorage, M: MetadataStorage> {
     pub(super) metadata_storage: Arc<RwLock<M>>,
     /// Pipeline for parallel header downloads (used for both initial sync and post-sync).
     pub(super) pipeline: HeadersPipeline,
+    /// Compiled-in checkpoints, which no fork may branch off below.
+    checkpoint_manager: Arc<CheckpointManager>,
     /// Pending block announcements waiting for headers message (post-sync).
     pub(super) pending_announcements: HashMap<BlockHash, Instant>,
     /// Peers we've sent a GetHeaders to after sync, so Dash Core knows our tip
@@ -90,7 +92,8 @@ impl<H: BlockHeaderStorage, M: MetadataStorage> BlockHeadersManager<H, M> {
             progress: initial_progress,
             header_storage,
             metadata_storage,
-            pipeline: HeadersPipeline::new(checkpoint_manager),
+            pipeline: HeadersPipeline::new(checkpoint_manager.clone()),
+            checkpoint_manager,
             pending_announcements: HashMap::new(),
             announced_peers: HashSet::new(),
         })
@@ -186,8 +189,8 @@ impl<H: BlockHeaderStorage, M: MetadataStorage> BlockHeadersManager<H, M> {
     }
 
     /// Height where `headers` branch off the stored chain below its tip, if they
-    /// do. A branch off below the best ChainLock is not followed: the blocks it
-    /// locks are final.
+    /// do. A branch off below the best ChainLock, or below the newest checkpoint
+    /// the stored chain reaches, is not followed: the blocks they fix are final.
     async fn fork_height(&self, headers: &[HashedBlockHeader]) -> SyncResult<Option<u32>> {
         let storage = self.header_storage.read().await;
 
@@ -204,6 +207,18 @@ impl<H: BlockHeaderStorage, M: MetadataStorage> BlockHeadersManager<H, M> {
                 return Ok(None);
             };
 
+            if let Some(checkpoint) = tip
+                .and_then(|tip| self.checkpoint_manager.last_checkpoint_before_height(tip))
+                .filter(|checkpoint| fork_height < checkpoint.height)
+            {
+                tracing::warn!(
+                    "Ignoring a fork at height {}, below the checkpoint at {}",
+                    fork_height,
+                    checkpoint.height
+                );
+                return Ok(None);
+            }
+
             let chain_lock = self
                 .metadata_storage
                 .read()
@@ -352,6 +367,7 @@ impl<H: BlockHeaderStorage, M: MetadataStorage> BlockHeadersManager<H, M> {
 mod tests {
     use super::*;
     use crate::chain::checkpoints::testnet_checkpoints;
+    use crate::chain::Checkpoint;
     use crate::network::{MessageType, NetworkEvent, NetworkRequest, RequestSender};
     use crate::storage::{
         DiskStorageManager, PersistentBlockHeaderStorage, PersistentMetadataStorage, StorageManager,
@@ -425,6 +441,43 @@ mod tests {
         );
     }
 
+    /// Blocks below the newest checkpoint the stored chain reaches are final, as
+    /// below the best ChainLock. A checkpoint above the tip fixes nothing yet,
+    /// or no fork could ever be followed before the chain reached it.
+    #[test_case(5, None; "below the checkpoint")]
+    #[test_case(6, Some(6); "at the checkpoint")]
+    #[test_case(7, Some(7); "above the checkpoint")]
+    #[tokio::test]
+    async fn a_branch_off_below_the_newest_reached_checkpoint_is_no_fork(
+        branch_off: u32,
+        expected: Option<u32>,
+    ) {
+        let mut storage = DiskStorageManager::with_temp_dir().await.unwrap();
+        let stored = Header::dummy_batch(0..10);
+        storage
+            .store_headers(&stored.iter().map(HashedBlockHeader::from).collect::<Vec<_>>())
+            .await
+            .unwrap();
+        let checkpoints = [0, 6, 20].map(Checkpoint::dummy).to_vec();
+        let manager = BlockHeadersManager::new(
+            storage.block_headers(),
+            storage.metadata(),
+            Arc::new(CheckpointManager::new(checkpoints)),
+        )
+        .await
+        .unwrap();
+
+        let branch = Header {
+            prev_blockhash: stored[branch_off as usize].block_hash(),
+            ..Header::dummy(1_000)
+        };
+
+        assert_eq!(
+            manager.fork_height(&[HashedBlockHeader::from(&branch)]).await.unwrap(),
+            expected
+        );
+    }
+
     /// Create a manager in synced state with an initialized pipeline.
     async fn create_synced_manager() -> TestBlockHeadersManager {
         let mut manager = create_test_manager().await;