Codex B4: current observer validatedLedgerWork after isolate/flush, not
combined with post-flush pending-origin state. Gap witness is taken from
a live validator while the observer is down. Restart stays before the
stale deadline; catch-up runs past it. Peer metadata matches by origin.
laggedPendingJobCount is per-node/name and drops when the job runs.
B4 now checks that count after isolate/flush, restarts before the old
deadline, and requires a witness created while the observer was down.
Delay observer validatedLedgerWork until Export work is queued, isolate
and stop it while validators continue, then restart/reconnect. Old
scheduled actions must not run past the lag horizon; the replacement
stays keyless and acquires the witness history.
Parse errors, wrong sidecar type, missing identity fields, or duplicate
committee positions abort the candidate count. Clear the job observer
after the passive phase.
Origin A uses committee {0,1} (qC=2); B uses {0,1,2} (qC=3). Drop only
validator 2's B frames toward the observer. At a real job boundary the
observer's existing sidecar map must show A=2 and B below qC. Validators
may still witness B; the observer may acquire.
Whole-frame drop of starved-carrying frames also starves complete
origins from those validators. Exclusive drops leave proposal-carried
shares filling qC. Obstacle, not a new transport selector.
Whole-frame drop of starved-carrying proposals/direct batches also
removes complete origins' material from those validators. Exclusive
drops leave proposal-carried shares filling qC. Cannot isolate one
origin below qC without stripping signed fields.
Drop validators 1-2 whole frames that carry the starved origin. Mid-run
asserts the collector holds it below qC with no witness; complete origins
still emit once. Heal then check no repeated or unexpected witnesses.
B1 records send/receive batch identities and requires a real inversion.
B3 scans every ledger, compares witness bytes/metadata across nodes, and
requires the observer locally built those ledgers. Below-qC stays open.
Delay by sender id toward the observer so even frames overtake node 0
without a global counter. Overlapping origins keep three distinct
witnesses; below-qC isolation needs per-origin proposal surgery and is
left as a gap.
B1 delays odd direct Export frames so even frames overtake them, with
an inversion counter. B3 submits two owners / three tickets and starves
one origin to one validator contribution. Three replays each. No
production changes.
The N=3 target-4 trace gains two validatedLedgerWork events at 42.010s on nodes 0 and 1. Removing only those events reproduces the prior 330-event fingerprint exactly. Retain all replay, hash-agreement and weighted-pressure assertions.
Merge a992572b70; retain validator identity fields, phase locking, manual heartbeat control and extension polling. Share the send observation hook across immediate and delayed transport sends.
