From a956abb2d189f66ea1229c027df1004b9e321cd9 Mon Sep 17 00:00:00 2001 From: Nicholas Dudfield Date: Tue, 28 Apr 2026 08:56:53 +0700 Subject: [PATCH] docs(consensus): clarify export sig quorum gates --- src/xrpld/app/consensus/ConsensusExtensions.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/xrpld/app/consensus/ConsensusExtensions.cpp b/src/xrpld/app/consensus/ConsensusExtensions.cpp index ac5a4e1cd..6b2fa7fed 100644 --- a/src/xrpld/app/consensus/ConsensusExtensions.cpp +++ b/src/xrpld/app/consensus/ConsensusExtensions.cpp @@ -679,6 +679,9 @@ ConsensusExtensions::buildExportSigSet(LedgerIndex seq) for (auto const& [txHash, valSigs] : allSigs) { + // Candidate membership is the deterministic publication gate. A sig + // may have been verified earlier from the open ledger, but it only + // enters the sidecar hash if the same tx hash is in the converged set. if (consensusExportTxns_.find(txHash) == consensusExportTxns_.end()) continue; @@ -1904,7 +1907,8 @@ ConsensusExtensions::onTrustedPeerMessage( return; // The active view is pinned to one parent ledger. Do not let a proposal - // for another parent feed signatures into this round's export collector. + // for another parent feed signatures into this round's export collector; + // build, merge, and apply all count against this same parent-ledger view. if (validatorView->sourceLedgerHash) { if (wireMsg.previousledger().size() != uint256::size()) @@ -1941,7 +1945,8 @@ ConsensusExtensions::onTrustedPeerMessage( // Pass 2: opportunistically verify using the open ledger. The consensus // candidate tx set later upgrades still-unverified signatures before - // they can enter an exportSigSetHash. + // they can enter an exportSigSetHash; early open-ledger verification is + // still gated by the candidate tx hash before sidecar publication. auto const exportTxns = buildOpenLedgerExportTxnLookup(app_); auto const currentSeq = currentClosedLedgerSeq(app_);