fix(consensus): stop view change discarding committed ops

.github/actions/go/pre-merge/action.yml

@@ -215,6 +215,53 @@ runs:
         pid-file: ${{ steps.iggy-tls.outputs.pid_file }}
         log-file: ${{ steps.iggy-tls.outputs.log_file }}
 
+    # `replica_count` is the roster length, and a two-replica cluster commits on
+    # two acks, so the shipped two-node roster would leave this lone node
+    # journalling every op and committing none. The roster itself has to stay as
+    # shipped (the Node VSR lane starts both of its replicas against it), so
+    # trim a copy instead: one node means a replication quorum of one.
+    - name: Build a single-node cluster config
+      id: iggy-cluster-config
+      if: inputs.task == 'e2e'
+      shell: bash
+      env:
+        CONFIG_OUT: ${{ runner.temp }}/iggy-go-cluster-config.toml
+      run: |
+        set -euo pipefail
+        python3 - "core/server-ng/config.toml" "$CONFIG_OUT" <<'PY'
+        import sys
+
+        src, dst = sys.argv[1], sys.argv[2]
+        lines = open(src).read().splitlines(keepends=True)
+
+        # A node block runs from its [[cluster.nodes]] line to the line before the
+        # next top-level table.
+        starts = [i for i, line in enumerate(lines) if line.strip() == "[[cluster.nodes]]"]
+        kept, dropped = [], []
+        for start in starts:
+            end = next(
+                (i for i in range(start + 1, len(lines)) if lines[i].startswith("[")),
+                len(lines),
+            )
+            body = "".join(lines[start:end])
+            (kept if "replica_id = 0" in body else dropped).append((start, end))
+
+        # Loud rather than silent: a reshaped roster that quietly matched nothing
+        # would hand the tests back the uncommittable cluster this exists to avoid.
+        if len(kept) != 1 or not dropped:
+            sys.exit(
+                f"{src}: expected one replica_id = 0 node and at least one other, "
+                f"found kept={len(kept)} dropped={len(dropped)}"
+            )
+
+        drop = {i for start, end in dropped for i in range(start, end)}
+        open(dst, "w").write(
+            "".join(line for i, line in enumerate(lines) if i not in drop)
+        )
+        print(f"{dst}: kept 1 node, dropped {len(dropped)}")
+        PY
+        echo "path=$CONFIG_OUT" >> "$GITHUB_OUTPUT"
+
     - name: Start Iggy VSR cluster node
       id: iggy-cluster-0
       if: inputs.task == 'e2e'
@@ -229,6 +276,7 @@ runs:
         wait-timeout-seconds: "90"
       env:
         IGGY_CLUSTER_ENABLED: "true"
+        IGGY_CONFIG_PATH: ${{ steps.iggy-cluster-config.outputs.path }}
         IGGY_SYSTEM_PATH: ${{ runner.temp }}/iggy-go-cluster-0-data
 
     - name: Run cluster e2e tests

core/binary_protocol/Cargo.toml

@@ -35,6 +35,7 @@ bytes = { workspace = true }
 enumset = { workspace = true }
 secrecy = { workspace = true }
 thiserror = { workspace = true }
+twox-hash = { workspace = true }
 
 [dev-dependencies]
 aligned-vec = { workspace = true }

core/binary_protocol/src/consensus/error.rs

@@ -29,6 +29,23 @@ pub enum ConsensusError {
     #[error("invalid checksum")]
     InvalidChecksum,
 
+    #[error(
+        "{command:?}: header checksum {found:#034x} does not cover the frame (expected \
+         {expected:#034x}){}",
+        if *found == 0 {
+            ". A zeroed checksum is the signature of a peer predating the frame seal, \
+             which is a hard version break: replicas must be upgraded together, with the \
+             cluster down"
+        } else {
+            ""
+        }
+    )]
+    FrameChecksumMismatch {
+        command: Command2,
+        expected: u128,
+        found: u128,
+    },
+
     #[error("invalid cluster ID")]
     InvalidCluster,