mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekayandHanzo Dev
7a5d16d2b2
The catch-up/bootstrap replay executes a block the consensus ledger already finalized but the VM never applied. It had grown a second authority: where the ledger could not name a height (below its boot seed / pruning window), a "verified cert may vouch" branch. That branch could not be made both safe and functional. The fleet only ever assembles Nova certs; the sole Quasar QuorumCert is never marshaled, stored, or gossiped. Gating the branch on Quasar (to keep reorgable Nova out) made it inert in production — a behind node was served exactly the blocks it needed and refused every one. Allowing Nova instead reopened long-range authority: the cert was verified at the offered block's own P-chain epoch, which an adversary supplies, and which resolves to the genesis set on a P/X chain after restart. Both concerns collapse once separated. Re-executing a block the ledger decided and re-deciding a block from a cert are different operations; replay is only the first. So it now rests on the ledger alone — FinalizedAt names the block and it executes; names a different block and it is refused; cannot name it and the node recovers through the descent, not here. No cert, no epoch, no tier, no set-root: the whole authorization surface is gone. This loses no recovery that was real. On restart the ledger seeds at the VM's applied head and folds gap heights above it, so a shallow gap — a roll, a restart, an OOM — is entirely within the ledger's index and every height is named. A gap deeper than the pruning window is a node too far behind to replay in place; its path home is bootstrap. Both lanes share ONE floor (settledHeight) and ONE contiguity rule (height == applied+1 and parent == applied head, before Accept, because proposervm commits its outer envelope before the inner EVM refuses a non-child). The bootstrap lane had drifted — it re-derived the floor, checked height without parent, and re-verified a held block the comment said it would not. It now calls the shared function. Red's adversarial probes for the deleted cert attacks are removed with the code; the bootstrap-lane probes are kept green as isolators for each shared rule. Co-authored-by: Hanzo Dev <[email protected]>