Struct Consensus 

pub struct Consensus<T: NodeType> {

    proposals: Proposals<T>,
    signed_proposals: BTreeMap<(ViewNumber, Commitment<Leaf2<T>>), Proposal<T, Proposal<T>>>,
    proposed_views: BTreeSet<ViewEpoch>,
    vid_shares: BTreeMap<ViewNumber, VidDisperseShare2<T>>,
    unpaired_proposals: BTreeMap<(ViewNumber, Option<EpochNumber>, VidCommitment2), (<T as NodeType>::SignatureKey, ProposalMessage<T, Validated>)>,
    unpaired_vid_shares: BTreeMap<(ViewNumber, Option<EpochNumber>, VidCommitment2), VidDisperseShare2<T>>,
    states_verified: BTreeSet<(ViewNumber, Commitment<Leaf2<T>>)>,
    blocks_reconstructed: BTreeSet<(ViewNumber, VidCommitment2)>,
    blocks: BTreeMap<(ViewNumber, VidCommitment2), T::BlockPayload>,
    certs1: BTreeMap<ViewEpoch, Certificate1<T>>,
    certs2: BTreeMap<ViewEpoch, Certificate2<T>>,
    timeout_certs: BTreeMap<ViewNumber, TimeoutEvidence<T>>,
    locked_cert: Option<Certificate1<T>>,
    headers: BTreeMap<(ViewNumber, Commitment<Leaf2<T>>), T::BlockHeader>,
    leaves: BTreeMap<(ViewNumber, Commitment<Leaf2<T>>), Leaf2<T>>,
    decided_views: BTreeSet<ViewNumber>,
    decide_floor_view: ViewNumber,
    last_decided_view: ViewNumber,
    last_decided_leaf: Leaf2<T>,
    drb_results: BTreeMap<EpochNumber, DrbResult>,
    voted_1_views: BTreeSet<ViewEpoch>,
    voted_2_views: BTreeSet<ViewEpoch>,
    sent_timeout_votes: BTreeSet<ViewEpoch>,
    vote1_parent: BTreeMap<ViewNumber, ViewNumber>,
    stored_proposals: BTreeMap<ViewNumber, Vec<Commitment<Leaf2<T>>>>,
    stored_vids: BTreeSet<ViewNumber>,
    stored_actions: BTreeSet<(ViewNumber, ActionKind)>,
    requested_actions: BTreeSet<(ViewNumber, ActionKind)>,
    stored_high_qc: Option<LockView>,
    pending_vote1: BTreeMap<ViewEpoch, Vote1<T>>,
    pending_vote2: BTreeMap<ViewEpoch, PendingVote2<T>>,
    pending_proposal: BTreeMap<ViewEpoch, Proposal<T, Proposal<T>>>,
    pending_revote: BTreeMap<ViewEpoch, ReVoteMessage<T, Validated>>,
    pending_timeout_vote: BTreeMap<ViewEpoch, (TimeoutVote<T>, Option<CatchupEvidence<T>>)>,
    timeout_vote_bar: Option<ViewNumber>,
    revote_commits: BTreeMap<ViewNumber, EpochNumber>,
    revotes: BTreeMap<ViewNumber, ReVote<T>>,
    revote_fetches: BTreeSet<(ViewNumber, RevoteFetch)>,
    lock_payload_fetches: BTreeMap<(ViewNumber, VidCommitment2), ViewNumber>,
    formed_upgrade_certificate: Option<ValidCert<UpgradeCertificate2<T>>>,
    decided_upgrade_carrier: Option<ViewNumber>,
    timeout_view: ViewNumber,
    restart_barred_view: ViewNumber,
    current_view: ViewNumber,
    current_epoch: EpochNumber,
    stake_table_coordinator: EpochMembershipCoordinator<T>,
    public_key: T::SignatureKey,
    private_key: <T::SignatureKey as SignatureKey>::PrivateKey,
    state_private_key: <T::StateSignatureKey as StateSignatureKey>::StatePrivateKey,
    stake_table_capacity: usize,
    state_certs: BTreeMap<EpochNumber, LightClientStateUpdateCertificateV2<T>>,
    node_id: KeyPrefix,
    upgrade_lock: UpgradeLock<T>,
    pub(crate) epoch_height: BlockNumber,
    pub(crate) tracer: Option<LeaderTracerHandle>,
}

Fields

proposals: Proposals<T>

signed_proposals: BTreeMap<(ViewNumber, Commitment<Leaf2<T>>), Proposal<T, Proposal<T>>>

proposed_views: BTreeSet<ViewEpoch>

vid_shares: BTreeMap<ViewNumber, VidDisperseShare2<T>>

unpaired_proposals: BTreeMap<(ViewNumber, Option<EpochNumber>, VidCommitment2), (<T as NodeType>::SignatureKey, ProposalMessage<T, Validated>)>

unpaired_vid_shares: BTreeMap<(ViewNumber, Option<EpochNumber>, VidCommitment2), VidDisperseShare2<T>>

states_verified: BTreeSet<(ViewNumber, Commitment<Leaf2<T>>)>

blocks_reconstructed: BTreeSet<(ViewNumber, VidCommitment2)>

blocks: BTreeMap<(ViewNumber, VidCommitment2), T::BlockPayload>

Payloads this node built or obtained, which a decide attaches to its leaves. Also gates proposing: the leader’s header must have its block.

certs1: BTreeMap<ViewEpoch, Certificate1<T>>

certs2: BTreeMap<ViewEpoch, Certificate2<T>>

timeout_certs: BTreeMap<ViewNumber, TimeoutEvidence<T>>

locked_cert: Option<Certificate1<T>>

headers: BTreeMap<(ViewNumber, Commitment<Leaf2<T>>), T::BlockHeader>

leaves: BTreeMap<(ViewNumber, Commitment<Leaf2<T>>), Leaf2<T>>

decided_views: BTreeSet<ViewNumber>

Views actually emitted in a LeafDecided; once views can decide late, last_decided_view is only a high-water mark.

decide_floor_view: ViewNumber

Hard lower bound for deciding, pinned to the anchor on restart: decided_views is not persisted, so a replayed certificate pair could otherwise re-decide pre-anchor views.

last_decided_view: ViewNumber

last_decided_leaf: Leaf2<T>

drb_results: BTreeMap<EpochNumber, DrbResult>

voted_1_views: BTreeSet<ViewEpoch>

voted_2_views: BTreeSet<ViewEpoch>

sent_timeout_votes: BTreeSet<ViewEpoch>

vote1_parent: BTreeMap<ViewNumber, ViewNumber>

For each view this node cast a vote1 in, the view its proposal was justified at.

stored_proposals: BTreeMap<ViewNumber, Vec<Commitment<Leaf2<T>>>>

Storage confirmations; sends are gated on these facts.

stored_vids: BTreeSet<ViewNumber>

stored_actions: BTreeSet<(ViewNumber, ActionKind)>

requested_actions: BTreeSet<(ViewNumber, ActionKind)>

stored_high_qc: Option<LockView>

Highest locked QC confirmed persisted; gates release of phase-2 votes.

pending_vote1: BTreeMap<ViewEpoch, Vote1<T>>

Messages constructed and accounted for in voted_*_views / proposed_views, awaiting their storage confirmations. A pending vote2 also records the locked-QC view it must see persisted before release.

pending_vote2: BTreeMap<ViewEpoch, PendingVote2<T>>

pending_proposal: BTreeMap<ViewEpoch, Proposal<T, Proposal<T>>>

pending_revote: BTreeMap<ViewEpoch, ReVoteMessage<T, Validated>>

pending_timeout_vote: BTreeMap<ViewEpoch, (TimeoutVote<T>, Option<CatchupEvidence<T>>)>

timeout_vote_bar: Option<ViewNumber>

The highest view this node has sent, or may have sent before a restart, a lock-carrying timeout vote for.

Under the certificate rule a node never votes2 at or before it: its timeout vote signed a lock earlier than the commit that vote2 would help form, and a proposal skipping that commit could use the certificate.

revote_commits: BTreeMap<ViewNumber, EpochNumber>

The epoch of the re-vote commit processed at each view.

Not in decided_views: the next epoch may have a block of its own at a re-vote’s view.

revotes: BTreeMap<ViewNumber, ReVote<T>>

Validated re-vote requests by view (see ReVote).

revote_fetches: BTreeSet<(ViewNumber, RevoteFetch)>

What was requested for each re-vote view, so it is requested once.

lock_payload_fetches: BTreeMap<(ViewNumber, VidCommitment2), ViewNumber>

The payloads of timeout certificate locks this node asked for, by the block’s view and payload commitment, with the view it asked in. Each is asked for once per view: a silent peer is replaced in the next view.

formed_upgrade_certificate: Option<ValidCert<UpgradeCertificate2<T>>>

An assembled or adopted upgrade certificate, kept until a leader turn attaches it, the upgrade decides, or decide_by passes.

decided_upgrade_carrier: Option<ViewNumber>

View of the decided leaf whose upgrade certificate is in the UpgradeLock (see Self::maybe_decide_upgrade).

timeout_view: ViewNumber

restart_barred_view: ViewNumber

Highest view this node may have acted in before a restart (from the persisted action log). Bars re-recording a view’s Vote action, not re-casting the phase-2 vote itself (see Self::vote2_persisted).

current_view: ViewNumber

current_epoch: EpochNumber

stake_table_coordinator: EpochMembershipCoordinator<T>

public_key: T::SignatureKey

private_key: <T::SignatureKey as SignatureKey>::PrivateKey

state_private_key: <T::StateSignatureKey as StateSignatureKey>::StatePrivateKey

stake_table_capacity: usize

state_certs: BTreeMap<EpochNumber, LightClientStateUpdateCertificateV2<T>>

node_id: KeyPrefix

upgrade_lock: UpgradeLock<T>

epoch_height: BlockNumber

tracer: Option<LeaderTracerHandle>

Implementations

impl<T: NodeType> Consensus<T>

pub fn new<B>( membership_coordinator: EpochMembershipCoordinator<T>, public_key: T::SignatureKey, private_key: <T::SignatureKey as SignatureKey>::PrivateKey, state_private_key: <T::StateSignatureKey as StateSignatureKey>::StatePrivateKey, stake_table_capacity: usize, upgrade_lock: UpgradeLock<T>, genesis_leaf: Leaf2<T>, epoch_height: B, ) -> Self

where B: Into<BlockNumber>,

pub fn public_key(&self) -> &T::SignatureKey

pub fn set_tracer(&mut self, tracer: Option<LeaderTracerHandle>)

pub fn seed_parent( &mut self, cert1: Certificate1<T>, proposal: Proposal<T>, reconstructed: impl IntoIterator<Item = (ViewNumber, VidCommitment2)>, )

Seed a parent certificate and proposal so the leader of the next view can propose without any external bootstrap injection. Sets the locked certificate and current epoch. After calling this, a subsequent apply that triggers maybe_propose will find the parent cert and proposal it needs.

reconstructed are (view, V2 commitment) pairs to record as already reconstructed blocks. During normal operation this set is populated as VID shares arrive; on restart it starts empty, but the persisted leaf and proposals correspond to blocks this node had already reconstructed in the previous process. Seeding them lets a restarted leader satisfy the parent_block_reconstructed check for its first proposal/vote instead of stalling.

pub fn seed_signed_proposals( &mut self, proposals: impl IntoIterator<Item = SignedProposal<T, Proposal<T>>>, )

Seed proposals loaded from storage on restart, keeping each one’s signature.

Fetches are answered only with signed proposals, such as the epoch’s last block a re-vote needs.

pub(crate) fn seed_proposals( &mut self, proposals: impl IntoIterator<Item = Proposal<T>>, )

Seed proposals loaded from storage on restart so the decide chain-walk can follow justify_qc back through views the node had already seen, and so maybe_vote_1/maybe_propose can find the parent of the first post-restart proposal (otherwise never re-fetched).

pub fn seed_locked_cert(&mut self, cert1: Certificate1<T>)

Restore the locked QC persisted on a prior run. Called after seed_parent: the persisted lock can be newer than the decided-anchor QC, and restoring it keeps the node from voting against a block it had already locked. The loaded value is persisted, so it also advances the persistence watermark.

pub fn seed_boundary_cert(&mut self, cert1: Certificate1<T>)

Seed the boundary certificate persisted on a prior run (see ConsensusOutput::PersistBoundaryQc), so that a restarted node can still lead a re-vote of the boundary block or the next epoch’s first block.

pub fn seed_anchor_cert2(&mut self, cert2: Certificate2<T>)

Seed the Certificate2 persisted for the anchor on a prior run, so that a node restarted on the last block of an epoch can lead the next epoch’s first block.

fn insert_cert1(&mut self, cert: Certificate1<T>)

fn insert_cert2(&mut self, cert: Certificate2<T>) -> bool

Insert a cert2 and return if it is new for its view and epoch.

fn proposed_at(&self, view: ViewNumber, epoch: EpochNumber) -> bool

fn voted_1_at(&self, view: ViewNumber, epoch: EpochNumber) -> bool

fn voted_2_at(&self, view: ViewNumber, epoch: EpochNumber) -> bool

fn bump_stored_high_qc(&mut self, lock: LockView)

Advance the locked-QC persistence watermark to lock if it is newer.

fn high_qc_persisted(&self, required: LockView) -> bool

Whether the locked QC required is persisted.

fn behind_current_epoch(&self, view: ViewNumber, epoch: EpochNumber) -> bool

Whether a certificate at view is of an epoch earlier than this node’s, under the certificate rule: one of the outgoing committee’s late re-votes, which this node does not lock on.

pub(crate) fn lock_view(&self) -> Option<LockView>

fn certified_proposal( &self, view: ViewNumber, leaf_commit: Commitment<Leaf2<T>>, block_number: Option<u64>, ) -> Option<(ViewNumber, &Proposal<T>)>

The proposal a certificate at view over leaf_commit certifies, with the view it was proposed at.

That is view itself, except for a re-vote, which certifies the last block of an epoch again at a later view.

fn cert2_over( &self, from: ViewNumber, leaf_commit: Commitment<Leaf2<T>>, ) -> Option<&Certificate2<T>>

A Certificate2 this node holds over leaf_commit, at from or later.

fn parent_reconstructed( &self, parent_view: ViewNumber, parent_block_commitment: VidCommitment2, parent_leaf: Commitment<Leaf2<T>>, ) -> bool

Whether the parent block counts as reconstructed for voting: this node holds its payload, or its lock certifies the parent leaf.

A lock is taken only on a reconstructed block, so a restarted node can vote on the first proposal built on its restored lock. The exception is an epoch’s last block taken from an epoch change, whose only child opens the next epoch and needs no parent payload. The leaf, which covers the block’s view, is compared rather than the view, since a re-vote’s certificate is at a later view than its block.

pub fn seed_state_cert( &mut self, state_cert: LightClientStateUpdateCertificateV2<T>, )

Seed a state certificate loaded from storage on restart, so a leader proposing on an epoch-root parent QC right after a restart does not stall on a missing state_cert.

pub fn last_proposal_before(&self, view: ViewNumber) -> Option<&Proposal<T>>

The proposal with the highest view below view, if any.

pub fn cert1_at(&self, view: ViewNumber) -> Option<&Certificate1<T>>

The Certificate1 of the latest epoch this node holds one of at view.

pub fn cert2_at(&self, view: ViewNumber) -> Option<&Certificate2<T>>

The Certificate2 of the latest epoch this node holds one of at view.

pub fn catchup_evidence(&self) -> Option<CatchupEvidence<T>>

The highest certificate we hold: the locked QC or the latest timeout certificate, whichever has the higher view (ties go to the timeout certificate).

fn signed_vid_share( &self, p: &Proposal<T>, ) -> Option<SignedProposal<T, VidDisperseShare2<T>>>

This node’s signed VID share of proposal’s payload, if it holds one.

The share held for a view is the one of the proposal the node paired it with, which need not be proposal when the leader equivocated.

pub fn signed_proposal_fetch_request( &self, view: ViewNumber, ) -> Result<ProposalFetchRequest<T>, <T::SignatureKey as SignatureKey>::SignError>

pub fn timeout_cert_at(&self, view: ViewNumber) -> Option<&TimeoutEvidence<T>>

Return the timeout certificate that advanced consensus to view, if any. Keyed by the view it advanced into (i.e. one greater than the view it certified as timed out).

pub fn is_reconstructed( &self, view: ViewNumber, payload_commitment: VidCommitment2, ) -> bool

pub(crate) fn decide_floor(&self) -> ViewNumber

Newest view that can no longer be decided (and below which decide inputs are dropped): slides DECIDE_BUFFER behind the watermark, pinned at the restart anchor.

fn decided_or_past(&self, view: ViewNumber) -> bool

Whether view is decided or at or below the decide floor, so that no block of it is wanted any more.

A view between the floor and the last decided view that is not decided is a gap, and its block is still wanted: a later decide fills it in (maybe_decide_at).

pub fn apply( &mut self, input: ConsensusInput<T>, outbox: &mut Outbox<ConsensusOutput<T>>, )

Apply consensus to the given input and collect protocol outputs.

pub fn last_decided_view(&self) -> ViewNumber

pub fn last_decided_leaf(&self) -> &Leaf2<T>

pub fn undecided_leaves(&self) -> impl Iterator<Item = &Leaf2<T>>

pub fn current_view(&self) -> ViewNumber

pub fn upgrade_lock(&self) -> &UpgradeLock<T>

pub fn current_epoch(&self) -> EpochNumber

pub fn resume_from_restart( &mut self, anchor_view: ViewNumber, restart_view: ViewNumber, last_actioned_view: ViewNumber, )

On restart, bar voting and proposing in every view this node may have acted in by raising timeout_view (vote1, propose) and restart_barred_view (vote-action re-recording), pin the decide floor at the anchor, and place the view cursor just past the high QC. Forward-only: never regresses any view.

pub fn wants_proposal_for_view( &self, view: &ViewNumber, epoch: EpochNumber, ) -> bool

Whether a proposal for view in epoch can still matter to this node.

One at or before the decide floor cannot be decided any more. Under the certificate rule, one behind the lock is kept: it gets no vote1 (maybe_vote_1), but a Certificate2 for its view may still arrive and decide it. Before the certificate rule, one behind the lock fails is_safe and is not wanted. Locks are ordered by epoch, then view, so a proposal of a later epoch is wanted even if a lock of an earlier one is at a later view.

pub fn proposals(&self) -> &Proposals<T>

pub fn proposal_at(&self, view: ViewNumber) -> Option<&Proposal<T>>

The proposal held at view that matters most, if any.

The one a held Cert2 names, else the one a held Cert1 names, else the one this node paired with its own VID share, else any. A view normally holds one proposal; the order only matters when a leader equivocated.

pub fn proposal_with_payload( &self, v: ViewNumber, c: VidCommitment2, ) -> Option<&Proposal<T>>

pub fn signed_proposal( &self, v: ViewNumber, c: Commitment<Leaf2<T>>, ) -> Option<&SignedProposal<T, Proposal<T>>>

pub fn signed_proposal_at( &self, v: ViewNumber, ) -> Option<&SignedProposal<T, Proposal<T>>>

pub fn epoch_change_ending( &self, epoch: EpochNumber, ) -> Option<EpochChangeMessage<T, Validated>>

The epoch change that ended epoch, if this node holds it.

pub fn signed_proposals_for_fetch( &self, view: &ViewNumber, ) -> Vec<&SignedProposal<T, Proposal<T>>>

The proposals to answer a fetch for view with.

That is the one proposed at view, and the blocks view’s certificates certify if they are others. A re-vote’s certificate certifies a block of an earlier view, and a node holding only the certificate knows no other view to ask for.

pub fn gc(&mut self, scope: GcScope)

Garbage-collect per-view state.

The decide inputs (proposals, certs, certs2, deferred certs, decided_views) survive down to Self::decide_floor so a late Cert2 can still decide a gap view. Parked proposal halves survive as long, so such a Cert2 can adopt one instead of fetching.

pub(crate) fn keeps_payload_on_timeout(&self, view: ViewNumber) -> bool

Whether a view that timed out keeps its payload and shares.

A view holding a certificate is likely to decide soon. So is the last block of an epoch: a re-vote commits it at a later view.

pub fn leader_of( &self, view: ViewNumber, epoch: EpochNumber, ) -> Option<T::SignatureKey>

fn pair_proposal( &mut self, sender: T::SignatureKey, proposal: ProposalMessage<T, Validated>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

Pair a validated proposal with this node’s VID share for the same payload.

The half arriving first is parked under its PairingKey.

fn pair_vid_share( &mut self, vid_share: VidDisperseShare2<T>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

Pair this node’s VID share with a validated proposal for the same payload.

The half arriving first is parked under its PairingKey.

fn on_proposal_paired( &mut self, sender: T::SignatureKey, proposal: ProposalMessage<T, Validated>, vid_share: VidDisperseShare2<T>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

fn handle_proposal_with_vid_share( &mut self, sender: T::SignatureKey, proposal: ProposalMessage<T, Validated>, vid_share: VidDisperseShare2<T>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

fn adopt_certified_proposal( &mut self, message: ProposalMessage<T, Validated>, outbox: &mut Outbox<ConsensusOutput<T>>, )

Take in a proposal this node did not receive live together with its VID share: one fetched from a peer, or one parked in unpaired_proposals that a certificate has since vouched for. Its parked ancestors come with it, oldest first, so each finds its parent stored rather than fetching it.

fn parked_ancestors( &self, message: ProposalMessage<T, Validated>, ) -> Vec<ProposalMessage<T, Validated>>

message followed by its parked ancestors, nearest first, up to the first parent this node already holds or has nothing parked for.

A loop, not recursion through request_parent_proposal_if_missing: the chain is as long as the run of views parked without a share.

fn store_certified_proposal( &mut self, message: ProposalMessage<T, Validated>, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn adopt_unpaired_proposal( &mut self, view: ViewNumber, leaf_commit: Commitment<Leaf2<T>>, block_number: Option<u64>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> bool

Adopt the live proposal parked for view awaiting this node’s VID share, if it is the leaf leaf_commit names. Returns whether one was adopted.

The proposal stays parked: a share arriving later still pairs with it and runs the live path, the only one that stores the share for maybe_vote_1.

fn parked_proposal( &self, view: ViewNumber, leaf_commit: Commitment<Leaf2<T>>, block_number: Option<u64>, ) -> Option<ProposalMessage<T, Validated>>

The live proposal parked awaiting this node’s VID share that a certificate at view over leaf_commit certifies.

As for Self::certified_proposal, that is one parked for view itself, except for a re-vote’s certificate, which certifies the last block of an epoch again at a later view.

fn request_state( &self, proposal: &Proposal<T>, payload_size: Option<u32>, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn payload_size_for(&self, proposal: &Proposal<T>) -> Option<u32>

The payload size of an adopted proposal, if a share for it has arrived. None makes state validation skip the checks that need the size; a quorum already certified the proposal, so they have been run elsewhere.

fn request_block_and_header_if_next_leader( &self, proposal: &Proposal<T>, outbox: &mut Outbox<ConsensusOutput<T>>, )

pub(crate) fn push_block_request( &self, request: BlockAndHeaderRequest<T>, outbox: &mut Outbox<ConsensusOutput<T>>, )

Queue a block and header request, stamping when it enters the outbox.

fn request_missing_payloads(&self, outbox: &mut Outbox<ConsensusOutput<T>>)

Ask for the payload of the view every proposal we could vote for is parented at.

Leaders build on their lock, so the parent of the latest proposal we hold is that view, and it is the one view peers still retain: a node holding the payload of a certified later view would have locked there itself, so no peer keeps one. Its certificate is the proposal’s justify_qc, which is also the only record of it for a node that missed the view’s votes and the certificate broadcast that followed them.

Views at or earlier than the lock cannot be what blocks us: safety pins the justify_qc of any proposal we may still vote for at or later than the lock, and a parent equal to the lock counts as reconstructed. Later than current_view - GC_MARGIN_VIEWS a missing share broadcast may still arrive on its own, and fetching would race it for a whole payload.

fn request_parent_proposal_if_missing( &mut self, proposal: &Proposal<T>, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn handle_certificate1( &mut self, certificate: ValidCert<Certificate1<T>>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

fn handle_certificate2( &mut self, certificate: ValidCert<Certificate2<T>>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

fn adopt_certified_drb(&mut self, view: ViewNumber)

Adopt the successor-epoch DRB carried by the transition leaf at view, once we hold both its proposal and a QC certifying it. A Cert1 over the leaf is a quorum’s endorsement of its next_drb_result, so a catching-up node can use it without waiting on a separate successor-epoch catchup.

fn handle_upgrade_certificate_formed( &mut self, cert: ValidCert<UpgradeCertificate2<T>>, ) -> Protocol

fn adopt_proposal_upgrade_certificate(&mut self, proposal: &Proposal<T>)

Lift the upgrade certificate attached to a stored proposal, so a node that never saw the upgrade votes can still re-attach it when leading.

fn upgrade_certificate_to_attach( &self, view: ViewNumber, epoch: EpochNumber, ) -> Option<UpgradeCertificate2<T>>

The upgrade certificate to attach to this node’s proposal at view. The Leaf2 carries it without its epoch, so validators require it to bind the carrying proposal’s epoch.

fn maybe_decide_upgrade( &mut self, decided: &[Leaf2<T>], outbox: &mut Outbox<ConsensusOutput<T>>, )

Decide the upgrade when a decided leaf carries a certificate within its decide_by deadline: flip the shared UpgradeLock and emit ConsensusOutput::UpgradeDecided so the certificate is persisted.

The chain can carry more than one certificate and gap fills decide carriers out of order, so the earliest carrying leaf wins: an earlier carrier overrides a later one.

fn handle_advance_view( &mut self, cert1: ValidCert<Certificate1<T>>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

Advance our view based on a quorum certificate.

fn advance_on( &mut self, cert1: Certificate1<T>, epoch: EpochNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

Keep cert1 of epoch, vote2 and lock on it if this node can, and move to the view after it.

fn handle_timeout( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

fn send_timeout_vote3( &mut self, view: ViewNumber, epoch: EpochNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

Sign a timeout vote that carries this node’s lock, and send it once its action is recorded.

The bar is raised first, so from now on this node does not vote2 at view or before it, and recording the action keeps the bar where it is across a restart (see Self::timeout_vote_bar).

fn release_timeout_vote( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn send_timeout_vote( &mut self, vote: TimeoutVote<T>, evidence: Option<CatchupEvidence<T>>, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn sent_timeout_vote( &self, view: ViewNumber, epoch: Option<EpochNumber>, ) -> bool

Whether this node signed a timeout vote for view in epoch, or in any epoch for a certificate that does not bind one.

fn handle_timeout_certificate( &mut self, certificate: ValidCert<TimeoutEvidence<T>>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

fn adopt_timeout_lock( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

Take in the lock the timeout certificate entering view carries.

The lock may be later than this node’s own: a leader must build on a block no earlier than it, and this node may have to lock on it to vote. Its block and payload are fetched if missing. Only a recent lock (TimeoutLock::Recent), the one the certificate’s verification checked, is taken in.

fn handle_epoch_change( &mut self, epoch_change: EpochChangeMessage<T, Validated>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

fn maybe_propose( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn parent_cert( &self, view: ViewNumber, evidence: Option<&TimeoutEvidence<T>>, ) -> Option<Certificate1<T>>

The certificate a proposal at view would name as its parent.

Without a timeout that is the certificate of the view before. After one it is this node’s lock, except under the certificate rule a leader holding a commit of an epoch’s last block builds the next epoch’s first block on it, even when locked on a re-vote’s certificate.

fn committed_last_block_cert1( &self, epoch: EpochNumber, ) -> Option<Certificate1<T>>

The own Certificate1 of the latest last block of an epoch at or after epoch that this node holds a commit of.

fn opening_cert2( &self, view: ViewNumber, block_view: ViewNumber, leaf_commit: Commitment<Leaf2<T>>, evidence: &Option<TimeoutEvidence<T>>, ) -> Option<Certificate2<T>>

The commit of the last block of an epoch, at block_view over leaf_commit, that the next epoch’s first block at view can carry: one at the block’s view or later, and before view.

Without a timeout certificate the first block follows its parent directly, so only the block’s own commit can come before it.

fn maybe_request_revote( &mut self, view: ViewNumber, cert1: &Certificate1<T>, block_view: ViewNumber, block: &Proposal<T>, tc: Option<&TimeoutEvidence<T>>, outbox: &mut Outbox<ConsensusOutput<T>>, )

Send a re-vote request for the last block of an epoch at view, if this node leads view in that epoch.

block, proposed at block_view, has a Certificate1 but no commit this node knows of, and cert1 is the one over it this node builds on: the block’s own or a re-vote’s. The request names cert1.

The request goes out in the view after cert1’s, not only after a timeout tc. Faulty nodes can assemble a re-vote’s Certificate1 from a minority of honest vote1s, hand it to the next leader before it times the view out and to the others after they did. No timeout certificate for that view then forms, and the others can no longer vote2 in it. A leader that waited for a timeout certificate could not ask again, and with faulty and honest leaders alternating the boundary would stall for ever.

fn maybe_decide( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

Decide on each Certificate2 at view, earliest epoch first.

fn maybe_decide_at( &mut self, key: ViewEpoch, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn build_state_vote( &self, proposal: &Proposal<T>, ) -> Result<LightClientStateUpdateVote2<T>>

Build a LightClientStateUpdateVote2 for an epoch-root leaf.

Computes the LightClientState from the header, fetches the next-epoch stake-table commitment, and signs both the LCV2 (pre-upgrade, for backward compatibility with existing relay infrastructure) and LCV3 (current) Schnorr signatures.

fn handle_stored( &mut self, stored: StorageOutput<T>, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn release_vote1( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn release_vote1_at( &mut self, key: ViewEpoch, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn release_vote2( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn release_vote2_at( &mut self, key: ViewEpoch, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn vote2_persisted(&self, view: ViewNumber, block_view: ViewNumber) -> bool

Whether the view’s Vote action and VID share are persisted, gating the phase-2 vote. A restart-barred view persisted both before the crash: its vote is re-cast, but its Vote action is never re-recorded. A re-vote disperses nothing, so it has no share of its own to wait for.

fn timed_out_for_vote2(&self, view: ViewNumber) -> bool

See Self::timeout_vote_bar.

fn hold_proposal(&mut self, proposal: Proposal<T>) -> Commitment<Leaf2<T>>

Hold proposal together with its leaf, and return its commitment.

Every held proposal above the decided view has a leaf, which is what undecided_leaves reads. Leaves are pruned at the decided view, proposals only at the decide floor.

fn hold_proposal_under( &mut self, proposal: Proposal<T>, commit: Commitment<Leaf2<T>>, )

Hold proposal and its leaf under commit, which need not be the proposal’s own commitment; only for the anchor, see seed_parent.

fn voted_for_branch_excluding(&self, view: ViewNumber) -> bool

Whether a vote1 in a later view endorsed a branch with no block at view.

This is what keeps one node out of two conflicting quorums. A vote2 certifies view for good, but the certificate and the reconstructed block it waits on can arrive after the node has submitted vote1 elsewhere. Casting it anyway would count the node towards a quorum committing view and towards one certifying a branch without it.

This covers the order vote1-then-vote2. The reverse is the is_safe re-check in maybe_vote_1; neither alone is enough.

fn release_proposal( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn is_proposal_stored( &self, view: ViewNumber, commitment: &Commitment<Leaf2<T>>, ) -> bool

fn request_action( &mut self, view: ViewNumber, kind: ActionKind, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn maybe_vote_1( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn maybe_vote_2_and_update_lock( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

Vote2 and lock on each Certificate1 at view, earliest epoch first, so that the lock ends on the latest.

fn maybe_vote_2_and_update_lock_at( &mut self, key: ViewEpoch, outbox: &mut Outbox<ConsensusOutput<T>>, )

fn certificate_rule_vote1( &self, proposal: &Proposal<T>, ) -> Result<(), &'static str>

The certificate rule’s checks on a vote1, in place of the voter’s own votes:

• a node votes for no epoch earlier than its own;
• after a timeout, the parent must be admitted by the timeout certificate’s lock (certificate_rule_admits);
• the first block of an epoch names its parent’s own Certificate1, and the node must hold that parent. The commit of it the proposal carries was verified with the proposal.

fn handle_revote( &mut self, message: ReVoteMessage<T, Validated>, outbox: &mut Outbox<ConsensusOutput<T>>, ) -> Protocol

Take in a validated re-vote request (see ReVote).

Its certificate, the block’s own or a re-vote’s, is taken in as any Cert1 is (advance_on): grounds for the view after it, kept, and locked on. Its timeout certificate, if any, moves this node into the re-vote’s view. The vote is cast by Self::maybe_vote_revote once the node holds the block.

fn maybe_vote_revote( &mut self, view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

Vote1 on the re-vote at view, with the last block’s own vote data.

The rules are those of any vote1 under the certificate rule. The node must also hold the block and its payload, which it fetches once if missing.

fn retry_later_certificates( &mut self, block_view: ViewNumber, outbox: &mut Outbox<ConsensusOutput<T>>, )

Retry the vote2, lock and decide on the re-vote certificates over the block proposed at block_view, whose block, payload or own Certificate1 just arrived.

A re-vote’s Certificate2 commits the block at a later view, so the post-apply decide at block_view does not reach it.

fn retry_revotes(&mut self, outbox: &mut Outbox<ConsensusOutput<T>>)

Retry what a block or payload arriving can unblock for re-votes: the vote1 on a pending request, and the vote2, lock and decide on a re-vote’s certificates.

fn is_safe(&self, proposal: &Proposal<T>) -> Result<(), SafetyError>

fn leader_label(&self, view: ViewNumber, epoch: EpochNumber) -> String

Format the leader’s key prefix for the given view/epoch, or "unknown" when the stake table is not available. Used by timeout logging so a reader can immediately see which validator failed to make progress.

fn is_leader(&self, view: ViewNumber, epoch: EpochNumber) -> bool

fn staked_in_epoch(&self, epoch: EpochNumber) -> bool

fn missing_for_vote1(&self, view: ViewNumber) -> Vec<&'static str>

Used for logging. Returns a list of checks that failed for the given trying to vote1

fn missing_for_propose(&self, view: ViewNumber) -> Vec<&'static str>

Used for logging. Returns a list of checks that failed for the given trying to propose

fn set_current_epoch_max(&mut self, e: EpochNumber)

fn set_current_view_max(&mut self, v: ViewNumber)