fix(economic): decode the 0x0032 bundle-acceptance leaf — a trader who settled could admit nothing again - #855
Merged
Conversation
…o settled could admit nothing again #852 made the bundle-acceptance leaf (0x0032) a mandatory part of every market settle's economic write set. It added the fifth EconomicLeafState arm's encoder, key, value, and even its arm in the pre-state match — but not its DECODER arm. read_leaf_state fell through to WrongClass for 0x0032. So since #852 every structure that decodes a settle's leaves failed: producer_tree_and_pre_state every admission rebuilds its pre-state from the leaf cache, which after a settle holds the acceptance leaf — so a trader who settled once could admit NOTHING again: no send, no second trade resume_pending_admission a crash-resumed settle could not decode its own frozen witness peer lineage walk any peer walking a trader THROUGH a settle read the undecodable witness as INVALID economic proof artifacts a settle's inclusion proof (the acceptance leaf is citable) did not decode The first is established by execution, not by reading. With the arm removed, the new end-to-end test fails on a genuine settle with: decode cached leaf state: unexpected object class 0x0032 Found while implementing the realization cutover (C2), whose walk and TA_B decoder both go through this function. Landed separately and first: it is a live defect on main and a separate topic. THE FIX mirrors the encoder exactly — envelope and two digest32, no rejection — because the encoder refuses nothing, and a decoder stricter than its encoder makes valid leaves unreadable. THE GUARD. every_leaf_class_round_trips_through_the_decoder matches every EconomicLeafState arm with no wildcard: a sixth arm fails to COMPILE there until a sample is added, and the sample fails at runtime until the decoder handles it. #852 slipped because no test ever decoded the leaf it added. Controls, each executed red with the arm removed, green with it: every_leaf_class_round_trips_through_the_decoder wire a_settle_witness_carrying_the_acceptance_leaf_decodes_to_itself REAL settle witness an_artifact_proving_a_bundle_acceptance_leaf_decodes_and_verifies proof artifact a_trader_that_settled_can_still_build_its_next_pre_state live route, end to end Dependent sweep: nothing asserted the old failure. Verification: economic_provenance_wire 18/18 trader_acceptance_producer 9/9 economic::proof_artifact 7/7 dlv_routes new end-to-end control 1/1 make lint exit 0 ci/production_safety_checks.sh exit 0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A live defect on
mainsince #852, found while implementing the C2 cutover. Landed separately and first: it is its own topic, and C2's walk depends on it.What broke
#852 made the bundle-acceptance leaf (
0x0032) mandatory in every market settle's write set, and added the fifthEconomicLeafStatearm's encoder, key, value — and even its arm in the pre-statematch— but not its decoder arm.read_leaf_statefell through toWrongClassfor0x0032.producer_tree_and_pre_stateresume_pending_admissionThe first row is established by execution. With the arm removed, the new end-to-end test fails on a genuine settle with:
The fix
The missing arm, mirroring the encoder exactly — envelope and two
digest32, no rejection. The encoder refuses nothing; a decoder stricter than its encoder makes valid leaves unreadable.The guard
every_leaf_class_round_trips_through_the_decodermatches everyEconomicLeafStatearm with no wildcard. A sixth arm fails to compile there until a sample is added, and the sample fails at runtime until the decoder handles it. #852 slipped because no test ever decoded the leaf it added.Controls — each executed red with the arm removed, green with it
every_leaf_class_round_trips_through_the_decodera_settle_witness_carrying_the_acceptance_leaf_decodes_to_itselfbuild_write_setan_artifact_proving_a_bundle_acceptance_leaf_decodes_and_verifiesa_trader_that_settled_can_still_build_its_next_pre_stateDependent sweep: nothing asserted the old failure.
Verification