[web3blind]

Summary

Follow-up audit of release 4.2.0 / HF16 (#181), based on d4fd4bcd.

• Require the signed certified child to carry its parent's QC before applying the two-chain finality rule. Adjacent cached QCs alone are insufficient when the late-QC grandparent fallback was used.
• Assemble the HF16 header against committed state before packing transactions. Include certificate/proof overhead and count-prefix growth in the budget; defer future-round evidence and discard evidence invalidated by membership/key changes.
• Bound accepted-vote relay caches and expiry work. Preserve independently validated local retry eligibility before gossip can yield; reject structurally malformed messages without blaming peers for ambiguous delegate refusals.
• Refresh validator signing-key snapshots synchronously before pending transactions are restored, including head identity, rather than incrementally applying deferred block contents across reorgs.
• Reject WebSocket upgrades on the HTTP-only admin listener.
• Abort snapshot restore before mutation when pause fails; stop after close failure and retain the production gate on immediate resume failure.
• Keep archive coverage/copy cursors monotonic across nested overlaps and use the highest endpoint as the default range end. This overlaps and extends the merge fix proposed in Run chain-level tests in CI, fix block-log tooling, add HF15 agent tests #178. The corruption-routing changes from fix(p2p): apply chain recovery policy to corrupted storage #180 are already present in the audited master and are not duplicated here.

Fork Docker builds now skip registry login/publication; internal PR image publication and master/release workflows are unchanged. This fixes the fork CI failure before compilation without requesting credentials.

Activation time, emission policy, operation IDs and wire formats are unchanged. No production deployment or chain operation was performed.

Verification

Local native testnet build: BUILD_TESTNET=ON, CHAIN_TESTNET_VALIDATORS=2, BUILD_CONSENSUS_TESTS=ON, Boost 1.83. Memory-heavy units used Clang with -O0 -g0; harness ASan/UBSan flags were retained. This is not an optimized full-node build.

• 45 native cases passed: HF16 boundary/production/committed-state suites (11), AgentKeys (23), key history plus no-contest fee (11).
• Five CTest executables passed: admin utilities/objects/HTTP transport, capped logging, IP counters.
• python3 tests/p2p/test_vote_ingress.py: 17 real-handler scenarios passed, also with ASan/UBSan. Baseline probe confirms quadratic dedup scanning; the eviction/interleaving regressions failed before their fixes.
• python3 tests/chain/test_snapshot_restore.py: 31 extracted-production-method tests passed; baseline had 16 failures.
• python3 tests/validator/test_signing_cache.py: passed; reverted-rotation and same-height stale-head checks fail against the release baseline.
• python3 tests/consensus_sim/production_safety_offline.py: 3 checks passed.
• node --test tests/block_log/archive_merge.test.cjs: 5 passed; nested overlap/default-end checks fail against Run chain-level tests in CI, fix block-log tooling, add HF15 agent tests #178.
• Actual chain, validator and network translation units compiled; complete node_admin translation unit passed syntax checking. Diff/secret gates passed.
• GitHub Actions Tests passed for 8a3ea96a: production-config CTest, the full N=1 testnet simulator and focused N=2 suites.
• GitHub Actions full production Docker build passed for 8a3ea96a; fork registry login was skipped and publication disabled.
• Independent GPT-6 Astra delta reviews approved the scoped fixes after corrections. Reviews inspected source/fixtures; execution results above were checked separately.

Limits and remaining risks

• The finality regression demonstrates the defective commit predicate, not a complete conflicting-finality attack on a live validator network.
• Two legacy single-producer smoke cases fail under the N=2 fixture on both the release baseline and this branch. CI deliberately uses the full N=1 simulator and focused N=2 suites; both passed. This does not claim the full N=2 simulator passes.
• Restore tests prove local failure boundaries, not whole-node quiescence, draining of all concurrent DB consumers, plugin lifecycle synchronization or completion of queued P2P work. These limits are documented.
• No 21-validator fault campaign, historical mainnet replay, in-place production upgrade or live browser/MCP acceptance was performed. Local full-node linking was not run; the GitHub production Docker build passed. No new admin scope bypass was established by static review; that is not a certification of all admin behavior.

[On1x]

Reviewed the complete delta against d4fd4bc at head 8a3ea96. The signed-child parent-QC requirement correctly excludes the late-QC fallback from the two-chain commit predicate. Header budgeting/evidence selection, committed-state key refresh, bounded accepted-vote caches, HTTP-only listener and fail-closed restore boundaries are justified. Archive cursors remain monotonic across nested overlaps. Fork workflow changes retain credential and publication boundaries.

Independently ran the vote-ingress, snapshot-restore (31 cases), signing-cache, production-safety (3 checks) and archive-merge (5 cases) regressions in an isolated Docker container; all passed. Verified successful Tests workflow 40165091993 and production Docker workflow 40165092000 on this exact head. No blocking findings in this scoped review.

Limits remain as documented: extracted-method fixtures do not establish whole-node quiescence, and this review did not repeat a 21-validator fault campaign, historical replay or production upgrade.