mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekayandHanzo Dev
97cd16838b
R1 self-disarm: MigrateStaleLocks takes the operator's observed floor target; a live floor that moved past it refuses the apply as a no-op (Skipped), so a lingering apply env can never degrade into an every-boot prune of genuine crash locks (the HIGH-1 double-precommit regression: >=3 correlated crash-restarts under a partition could double-finalize). The unconditional NewRuntime invocation is removed for the same reason — the operator-gated node boundary (apply:<floor>) is the one way in. R2 real cert gate: engineCanonicalContext snapshots DURABLE finality (the consensus ledger) sequentially — brief slotMu for candidate heights, the ledger's own RLock, then t.mu for siblings; never nested — so certAt engages at the boot invocation point where views is empty. R4 view invalidation: the apply step deletes the cached round-view of every migrated height; a runtime invocation re-seeds from the rewritten binding instead of re-freezing on the pre-migration lock value. R3 height binding: LockCanonicalResolver.CanonicalOf carries the locked height; vmCanonicalResolver refuses a block at any other height, so a cross-height id can never rewrite a slot binding to another height's canonical. Red probes inverted to pin the fixed behavior; two new probes (SelfDisarm, ResolverHeightGuard). engine/chain -short -race: ok. Co-authored-by: Hanzo Dev <[email protected]>