fix(block): validate witnesses against parent state

FE
12d ago
+1192-100

What does this PR do?

Validate block witness signatures against the candidate block's parent state, after resetting pending transaction state and, for competing branches, rewinding to the common ancestor. Forward blocks only after the selected branch has applied successfully, and distinguish an invalid ancestor from an invalid block supplied by the current peer when recovering synchronization.

This change is based on release_v4.8.3. It uses one bounded deferred-signature index, without a separate timestamp index or TTL. It retains signature alternatives for the same block ID, preserves Khaos child links on duplicate arrivals, and releases candidates when blocks are committed, evicted from Khaos, or cleared at the capacity limit.

Why are these changes required?

Refs #59. Witness permissions and signature recovery rules can differ between the committed parent state, pending transaction state, and another branch. Validating against the wrong state can reject a valid header or accept a signature authorized only by a pending permission update. A block ID also excludes its witness signature, so a rejected or deferred signature must not prevent retrying another signature for that ID.

The changes to Khaos, Manager, and network ingress are coupled: Manager selects and authenticates the parent state, Khaos preserves competing branch links, and broadcast/sync callers consume explicit application results to avoid forwarding unverified blocks or blaming a descendant provider for an invalid ancestor.

This PR has been tested by:

  • Focused unit/integration tests on x86_64/JDK 8: 144 tests passed across 11 related classes, with no failures or skipped tests: BlockWitnessParentStateTest, TronNetDelegateTest, BlockMsgHandlerTest, BlockAlreadyKnownCounterTest, SyncServiceTest, KhaosDatabaseTest, KhaosDatabaseMemoryTest, TransactionStoreTest, ManagerTest, ManagerMockTest, and BlockCapsuleTest.
  • Added pending-state coverage for sync accepting the committed witness key and for both broadcast and sync rejecting a pending-only witness key. Existing coverage includes fork rollback, same-ID signature retries, capacity recovery, and synchronization cleanup.
  • Passed :framework:checkstyleMain, :framework:checkstyleTest, and :plugins:checkstyleMain.
  • Passed bash .github/scripts/check_math_usage.sh and git diff --check.
  • The full test suite and manual multi-node tests were not run.

Follow up

Validate historical replay, mixed-version and multi-node convergence, and ARM64/JDK 17 behavior before production rollout. Establish the complete affected-version range and coordinated upgrade requirements; this PR targets release_v4.8.3.

Extra details

No protobuf, on-disk schema, dependency, or configuration changes; no database migration is required. Block acceptance changes when parent state differs from the pending or unrelated branch state previously used for authentication. No activation height or fork gate is introduced, so deployment compatibility requires the follow-up validation above.