Keep canonical accounting within the moving chain tip budget

PlasticDigits commented

2026-10-14 13:49:17 +00:00

Owner

Canonical accounting was correct, but sequential BSC reads and ordinary catch-up sleeps let the real chain tip outrun the unchanged readiness budget. Paired production sampling reproduced 38 unready frames in 240 observations (BSC lag18 or Terra lag3).

BSC now chooses each bounded range from a fresh pinned provider head, overlaps eight header requests with end/log reads, reuses validated hashes, and repeats same-source network/head/end checks after accounting SQL. Actual selected ends govern cursor and baseline certification. Successful work beyond the existing lag limit yields and immediately continues bounded catch-up; failures retain backoff. Invariants, operations and third-party agent guidance document the bounds.

Verification: Rust1.88.0 full fresh-SCRAM disposable release13 PASS: 74 unit/supervisor,121 integration (66 ledger hardening),245 API-schema and146 frontend tests, production build, both nginx checks and Gitleaks (see linked report). Added moving-head 90ms/450ms regression publishes true-tip lag16–17, four post-SQL provider faults roll back all accounting/metadata, and an actual ledger child clears three Terra chunks in1.21s despite a5000ms normal interval. Independent invariant review passed. Release12 exposed a fixture race around an already-pending supervised database exit; the test now observes at most one late restart throughout recovery and demands fresh post-restoration observations and sustained readiness. Four independent reset repetitions and the full fresh rerun pass. No finality, completeness or readiness threshold was relaxed. Exact-code deployment and sustained paired public/private checks follow merge.

Refs #36 #37 #38 #39. Release report, failed live reproduction.

Canonical accounting was correct, but sequential BSC reads and ordinary catch-up sleeps let the real chain tip outrun the unchanged readiness budget. Paired production sampling reproduced 38 unready frames in 240 observations (BSC lag18 or Terra lag3). BSC now chooses each bounded range from a fresh pinned provider head, overlaps eight header requests with end/log reads, reuses validated hashes, and repeats same-source network/head/end checks after accounting SQL. Actual selected ends govern cursor and baseline certification. Successful work beyond the existing lag limit yields and immediately continues bounded catch-up; failures retain backoff. Invariants, operations and third-party agent guidance document the bounds. Verification: Rust1.88.0 full fresh-SCRAM disposable release13 PASS: 74 unit/supervisor,121 integration (66 ledger hardening),245 API-schema and146 frontend tests, production build, both nginx checks and Gitleaks (see linked report). Added moving-head 90ms/450ms regression publishes true-tip lag16–17, four post-SQL provider faults roll back all accounting/metadata, and an actual ledger child clears three Terra chunks in1.21s despite a5000ms normal interval. Independent invariant review passed. Release12 exposed a fixture race around an already-pending supervised database exit; the test now observes at most one late restart throughout recovery and demands fresh post-restoration observations and sustained readiness. Four independent reset repetitions and the full fresh rerun pass. No finality, completeness or readiness threshold was relaxed. Exact-code deployment and sustained paired public/private checks follow merge. Refs #36 #37 #38 #39. [Release report](https://git.cl8y.com/code/voting/src/branch/main/docs/verification/2026-10-14-issues-36-43.md), [failed live reproduction](https://git.cl8y.com/code/voting/src/branch/main/docs/verification/2026-10-14-lag-budget-reproduction.json).

PlasticDigits added 3 commits

2026-10-14 13:49:17 +00:00

fix(ledger): keep bounded accounting close to moving chain tips a96c6be6bc

Plan each BSC range from its validated pinned head, share header validation with log identities, and combine final same-source head and end checks after accounting SQL. Certify only baselines through the selected end and retain the true final observed tip. Yield into immediate bounded catch-up after successful progress beyond the readiness lag budget. Add production-latency moving-head, post-SQL atomic fault and actual process backlog regressions.

test(ledger): observe late supervised restart during database recovery 061c9cf4ef

Keep the database-loss recovery wait bounded while handling at most one late nonzero supervisor exit after admission returns. Require new successful chain observations and an intent heartbeat after restoration, sustained readiness, and the original exact accounting assertions.

docs: record moving tip failure and complete throughput verification

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

547828884a

PlasticDigits merged commit 5cd9363307 into main

2026-10-14 13:52:49 +00:00

PlasticDigits referenced this pull request

2026-10-14 14:19:41 +00:00

fix(ledger): validate complete Terra execution responses and BSC provider events #36

PlasticDigits referenced this pull request

2026-10-14 14:19:47 +00:00

fix(ledger): make transfer accounting exactly once across registration and concurrent writers #37