Restore deterministic height-sync floor and heartbeat causality state from snapshots #1771

Open @anatoly-kuz-mntn opened 2026-09-15 02:00 UTC 0 comments Updated 2026-09-15 02:00 UTC

Description

Snapshot recovery does not always reconstruct the same derived height-sync state as live application of the diff journal.

Problem 1: sealed confirms are omitted during floor rebuild

During live application, a MsgConfirmStart is attributed while its inference record exists. During recovery, journal entries are processed against the final snapshot state. If the inference has been sealed, its record is absent and the confirm claim is skipped.

Affected code:

• Journal-based height-sync rebuild
• Confirm attribution depends on a live inference record

The executor can instead be derived from the deterministic group assignment using the inference ID.

Problem 2: snapshot fallback loses heartbeat causality

When GetDiffs fails, recovery installs the saved floor and calls SeedCompleted. This restores summary counters but not the tracker’s heartbeatAt mapping.

L3 subsequently rejects valid acknowledgements whose ref_nonce points to a heartbeat created before the snapshot.

Affected code:

• Snapshot-floor fallback
• SeedCompleted restores only summary state
• L3 requires the heartbeat-to-turn mapping

Expected behavior

A replica restored from a snapshot must produce the same floor and acknowledgement-causality decisions as a replica that applied the complete journal live.

Acceptance criteria

• Confirms belonging to sealed inferences are attributed during rebuild.
• HeightSyncFloorAsOf produces identical results before and after recovery.
• Snapshot data contains enough tracker state to validate retained pre-snapshot acknowledgements.
• Valid acknowledgements referencing pre-snapshot heartbeats pass L3.
• Recovery fails closed when neither the journal nor snapshot can reconstruct the required state.

---

🔄 Auto-synced from Issue #1771 every hour.