B2a holds direct and proposal-carried Export frames on every link until
validated sequence passes the publication window, with gate timeouts and
no witness. Releasing that material is admitted as publication-expired.
A later intent from the same owner witnesses once.
Require submit/pre-heal own releases to be zero, unauthorized releases
zero on every validator through recovery, and recovered ledgers at
stallValid to match the saved accepted hash. Drop the unproven expiry
replacement; this origin must validate and witness in the bounded heal.
B5 no-quorum leg: isolate validator 2, confirm configured quorum is 3,
and show survivors close while validated seq stalls. A fresh Export
enters that speculative closed history with zero own releases. After
heal, authoritative history is compatible and the origin is witnessed
once.
B7 now waits for the honest encoding to be admitted on the observer,
checks that observer's validated latch is still live, and sends one
forged frame on the observer's peer. The observer extension journal
must contain a single collector-commit record for that wire hash with
signatureVerified=false and AdmitResult::invalid.
Pre-commit leak finder hits protobuf TMExportShares::shares(); wire
field name, not audited-hook vocabulary.
B7 injects a parseable share with a corrupted committee signature
through real PeerImp after an honest contribution, while the origin
is still pending. The collector keeps the honest encoding and the
cohort still produces one matching witness.
Pre-commit leak finder hit protobuf TMExportShares::shares(); that is
the wire field name, not audited-hook vocabulary.
The first origin can already be witnessed before stop, so observer
hasEligiblePendingExports is not current evidence. B4 keeps lagged
validatedLedgerWork after isolate/flush, requires the gap origin pending
on a live validator, and checks the restarted observer's replay cursor.
Codex B4: current observer validatedLedgerWork after isolate/flush, not
combined with post-flush pending-origin state. Gap witness is taken from
a live validator while the observer is down. Restart stays before the
stale deadline; catch-up runs past it. Peer metadata matches by origin.
laggedPendingJobCount is per-node/name and drops when the job runs.
B4 now checks that count after isolate/flush, restarts before the old
deadline, and requires a witness created while the observer was down.
Delay observer validatedLedgerWork until Export work is queued, isolate
and stop it while validators continue, then restart/reconnect. Old
scheduled actions must not run past the lag horizon; the replacement
stays keyless and acquires the witness history.
Parse errors, wrong sidecar type, missing identity fields, or duplicate
committee positions abort the candidate count. Clear the job observer
after the passive phase.
Origin A uses committee {0,1} (qC=2); B uses {0,1,2} (qC=3). Drop only
validator 2's B frames toward the observer. At a real job boundary the
observer's existing sidecar map must show A=2 and B below qC. Validators
may still witness B; the observer may acquire.
Whole-frame drop of starved-carrying frames also starves complete
origins from those validators. Exclusive drops leave proposal-carried
shares filling qC. Obstacle, not a new transport selector.
Whole-frame drop of starved-carrying proposals/direct batches also
removes complete origins' material from those validators. Exclusive
drops leave proposal-carried shares filling qC. Cannot isolate one
origin below qC without stripping signed fields.
Drop validators 1-2 whole frames that carry the starved origin. Mid-run
asserts the collector holds it below qC with no witness; complete origins
still emit once. Heal then check no repeated or unexpected witnesses.
B1 records send/receive batch identities and requires a real inversion.
B3 scans every ledger, compares witness bytes/metadata across nodes, and
requires the observer locally built those ledgers. Below-qC stays open.
Delay by sender id toward the observer so even frames overtake node 0
without a global counter. Overlapping origins keep three distinct
witnesses; below-qC isolation needs per-origin proposal surgery and is
left as a gap.
B1 delays odd direct Export frames so even frames overtake them, with
an inversion counter. B3 submits two owners / three tickets and starves
one origin to one validator contribution. Three replays each. No
production changes.
The N=3 target-4 trace gains two validatedLedgerWork events at 42.010s on nodes 0 and 1. Removing only those events reproduces the prior 330-event fingerprint exactly. Retain all replay, hash-agreement and weighted-pressure assertions.
Merge a992572b70; retain validator identity fields, phase locking, manual heartbeat control and extension polling. Share the send observation hook across immediate and delayed transport sends.
