Reject malformed RNG sidecar signing keys before PublicKey construction so fetched untrusted leaves cannot trigger an uncatchable LogicError abort. Also re-check proposal signatures at the extension harvest boundary so cluster-relayed invalid proposals cannot populate RNG or export sidecar state.
Encode fallback-vs-nonfallback as a ledger-defining decision, remove the prevProposers/bootstrap and visible-peer impossible-quorum shortcuts, and use proofed commit material for the timeout transition. Update unit/CSF/testnet coverage and document the remaining validation-backstopped timing residual.
Tests: x-run-tests --stop-on-fail ConsensusExtensions; x-run-tests --stop-on-fail ConsensusRng; x-format-changed; git diff --check
Thread the replay parent through ApplyOptions so export replay can rebuild the historical validator view without relying on LedgerMaster visibility for freshly replayed parents.
Harden ttEXPORT_SIGNATURES canonicality before witness indexing, validate witness signer accounts against their pubkeys, reject ambiguous absent NetworkID on low-ID source chains, and lock the consensus phase accessor.
Add focused regression coverage and clarify that destination SignerList/quorum compatibility is an operator/client contract.
State that clients expanding sfExportSignatureHash must match ExportResultBuilder's canonical signer ordering, empty SigningPubKey, and target-chain signer cap before hashing or submitting.
Validate ttEXPORT_SIGNATURES witness bindings in preflight, guard standalone witness synthesis against malformed inner transactions, and align ticket-path XPOP quorum with Export's ceiling threshold.
Regenerate the genesis hook sfcodes header and add it to generated-header verification so CI catches future drift.
Historical LedgerReplay now treats ttEXPORT_SIGNATURES witnesses as validated-history membership input, while still verifying signatures and threshold. Live build and validation keep the current manifest-backed active-signer check.
Harden witness handling by indexing only canonical same-ledger pseudos, dropping duplicate witnesses as ambiguous, and replacing pre-existing mismatched witnesses with the accepted sidecar witness during onPreBuild.
Document the lean witness-vs-XPOP proof distinction and cover the manifest-rotation replay case with an Export regression test.
Reveal sidecars intentionally omit proof blobs to keep entropySet hashes deterministic. Remove the write-only proposalProofs_ cache and update the surrounding comments to match the current sidecar format.
A second pending export for the same shadow-ticket key is a ledger-object conflict, not an internal failure. Return tecDUPLICATE and cover the live-latch case in Export_test.
Document that makeActiveValidatorView's null-ledger fallback is for startup, standalone, and diagnostics paths, while closed-ledger apply callers must fail closed before using it.
Document that shadow tickets are re-creatable latches rather than permanent tombstones, so import-callback hooks that move value must deduplicate same-XPOP replays themselves.
Require legacy consensus positions to use the exact 32-byte form. Extended encodings now need a nonzero known flag byte, preventing alternate wire encodings of the same tx-set hash.
Require wire-carried export signatures to match the signed ExtendedPosition digest before harvesting, and keep the per-blob size guard local to the helper.
Treat observedParticipantsHash as entropy extension material during proposal precheck, so disabled featureConsensusEntropy rejects diagnostic-only extension payloads too.
Network-mode Export apply must build its signer universe from the closed ledger's parent. If that parent ledger is unavailable, retry instead of falling back through makeActiveValidatorView to the node-local latest validated ledger.
Document that stalled, moved-on, and expired consensus exits are generic consensus-engine liveness behavior coordinated by software release, not amendment-gated ledger-rule behavior.
Bound proposal-carried export signature blobs before hashing them during proposal precheck, and apply the same size cap at export signature harvest as defense in depth.
Cap the unverified export-signature cache by distinct tx hash while leaving verified signatures and existing entries ungated, so real exports can still reach quorum.
Domain-separate Hook RNG using the actual strong/weak execution role at draw time, and document the residual commit/reveal withholding bias across all entropy tiers.
Require entropy injection and export apply to consume only sidecar roots accepted by their convergence gates. Local timeout state and later collector growth no longer participate in closed-ledger material once a sidecar root is accepted.
Also guard RCLConsensus::extensionsBusy() under the consensus mutex, cap exported multisig signer arrays to the protocol maximum after canonical signer sorting, and document the remaining accept-vs-timeout liveness tradeoff.
Add regressions for unaccepted export sidecar roots, late export collector mutation, entropy accepted-root handling, exported signer caps, and CSF accepted-sidecar behavior.
