mirror of
https://github.com/luxfi/consensus.git
synced 2026-09-24 00:26:58 +00:00
zeekayandHanzo Dev
409070c573
Catch-up replay read the ledger's own per-height index to name a gap block. That index retains only a near-tip window (1024) because equivocation evidence is only actionable near the tip — so replay could name a gap at most 1024 deep and refused everything below, and the "deep gaps recover through bootstrap" the comment promised does not exist: there is no path from normal operation back into bootstrap. A node more than a window behind had no in-process recovery at all. Recovery is the opposite concern from equivocation: it must reach far below the tip. So it gets its own structure — recoveredAt, height→outer id, recorded for every finalized height as the fold accepts it, mutated in place (never cloned per finalize the way the value-type ledger is, so its depth costs nothing per block) and FIFO-bounded to recoveryDepth. Replay consults the ledger first and this index where the ledger has pruned the height; a match is this node's own finalization record, the same authority the ledger arm carries. In-memory suffices: after a restart the ledger re-seeds at the applied head and the gap is exactly the heights folded above it this session, all of which pass through the recorder. Also from the same review: - settledHeight distinguishes a VM genuinely at height 0 (a wedge — lower the floor so replay can execute height 1) from an unreadable head (do not — localLastAccepted now returns the error it is, rather than a fabricated height 0 that collapsed the floor). - The bootstrap band's identity check refuses an unknown height instead of executing on frontier trust alone — the catch-up lane already did; the lanes now agree. - Replay settles the engine's own books (Decided / finalizedByCert / drop-pending) so a block tracked then replayed does not linger, and the accepted counter does not under-report. - The held-preference is confined to the replay band. The fresh-sync path (height == finalized+1, and the M2 first block) always Verifies — that Verify IS the frontier-trust integrity check, and skipping it would let a peer advance sync with an invalid block. Co-authored-by: Hanzo Dev <[email protected]>