mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekayandHanzo Dev
1294212c73
reconcileVMToCertified declines to crash when it cannot read the VM's head or its
last-accepted, and says so at both call sites: the finality ledger is already
correct, and leaving the VM head untouched orphans nothing. certifiedAtItsHeight
did not get the same treatment. It folded its GetBlock error into a bare `false`,
and `false` was the ONE value the caller routed to os.Exit(1) — so a block we
merely failed to READ was indistinguishable from a block the ledger PROVES is
uncertified.
A cancelled context reads as unreadable. lux-testnet luxd-0 crash-looped on
error VM accepted head is CONSENSUS-CERTIFIED and the finalized block is NOT on
the certified chain — refusing to orphan it orphanedHeight=12781
fatal SetPreference would orphan a CONSENSUS-CERTIFIED block — refusing
error="context canceled"
with every neighbouring VM call-out failing the same way: the engine was stopping.
An orderly shutdown became a fatal on a node whose ledger was never in question,
and any node whose engine context is cancelled mid-finalize could take that exit.
The predicate is now three-valued and the error is the third value, never folded
into the bool: (true,nil) certified, (false,nil) proven uncertified, (_,err)
unknown. Only the proven case may halt.
The safety property is UNCHANGED — a certified head is still dropped only for a
block our own ledger certifies on the same one chain, and only when we read it.
TestReconcile_CertifiedHead_HaltsFailClosed still halts with both blocks readable.
Co-authored-by: Hanzo Dev <[email protected]>