round-trip the liveness clock through genesis export/import

Export and re-import the per-consumer liveness state so a genesis export/import
(a state-export restart) preserves it instead of resetting it:

- provider ConsumerState gains last_ack_time and highest_sent / highest_acked
  vsc ids, exported for launched consumers and restored at InitGenesis.
- consumer GenesisState gains last_vsc_recv_time, so the VSC-staleness clock
  survives a restart rather than falling back to the current block time.

Previously these fields reset on import -- safe by fallback (no immediate sweep,
no forced snapshot, never-stale until the first VSC) but not faithful. Genesis
round-tripping is foundational state handling, not a version migration, so the
liveness clock is now preserved end-to-end (covered by the provider and consumer
genesis round-trip tests).

Author: giunatale

proto/vaas/consumer/v1/genesis.proto

@@ -29,6 +29,11 @@ message GenesisState {
   // Flag indicating whether the consumer VAAS module starts in pre-VAAS state
   bool preVAAS = 5;
   vaas.v1.ProviderInfo provider = 6 [ (gogoproto.nullable) = false ];
+  // LastVSCRecvTime is the block time of the last VSC packet the consumer
+  // received; it drives IsVSCStale (safe mode). Round-tripped on restart so a
+  // state-export upgrade preserves the staleness clock. Absent for a new chain
+  // that has not received a VSC yet.
+  google.protobuf.Timestamp last_vsc_recv_time = 7 [ (gogoproto.stdtime) = true ];
 }
 
 // HeightValsetUpdateID represents a mapping internal to the consumer VAAS module

proto/vaas/provider/v1/genesis.proto

@@ -86,6 +86,17 @@ message ConsumerState {
   // absent otherwise. Used to re-derive the keeper's removal-time queue.
   google.protobuf.Timestamp removal_time = 12
       [ (gogoproto.stdtime) = true ];
+
+  // Liveness clock, present once a consumer has launched: LastAckTime is the
+  // block time of the consumer's most recent successful VSC acknowledgement
+  // (the provider's per-consumer grace clock), and HighestSentVscId /
+  // HighestAckedVscId are the resync counters that decide whether the consumer
+  // is behind. Round-tripped so a state-export restart preserves the grace
+  // window and resync state instead of resetting them.
+  google.protobuf.Timestamp last_ack_time = 13
+      [ (gogoproto.stdtime) = true ];
+  uint64 highest_sent_vsc_id = 14;
+  uint64 highest_acked_vsc_id = 15;
 }
 
 // ValsetUpdateIdToHeight defines the genesis information for the mapping

x/vaas/consumer/keeper/genesis.go

@@ -61,6 +61,12 @@ func (k Keeper) InitGenesis(ctx sdk.Context, state *types.GenesisState) []abci.V
 		return []abci.ValidatorUpdate{}
 	}
 
+	// Restore the VSC staleness clock on a restart (see ExportGenesis); absent
+	// (new chain / never received a VSC) leaves the never-stale default.
+	if state.LastVscRecvTime != nil {
+		k.SetLastVSCRecvTime(ctx, *state.LastVscRecvTime)
+	}
+
 	// populate cross chain validators states with initial valset
 	k.ApplyCCValidatorChanges(ctx, state.Provider.InitialValSet)
 	return state.Provider.InitialValSet
@@ -88,5 +94,17 @@ func (k Keeper) ExportGenesis(ctx sdk.Context) (genesis *types.GenesisState) {
 		params,
 	)
 
+	// Preserve the VSC staleness clock across a restart (see IsVSCStale): export
+	// the last-VSC-recv time only when actually recorded, so a consumer that has
+	// not received a VSC keeps the absent-default (never stale) on import.
+	has, err := k.LastVSCRecvTime.Has(ctx)
+	if err != nil {
+		panic(err)
+	}
+	if has {
+		t := k.GetLastVSCRecvTime(ctx)
+		genesis.LastVscRecvTime = &t
+	}
+
 	return genesis
 }

x/vaas/consumer/keeper/genesis_test.go

@@ -193,6 +193,44 @@ func TestExportGenesis(t *testing.T) {
 	}
 }
 
+// TestGenesisRoundTripLastVSCRecvTime verifies the consumer's VSC-staleness
+// clock survives an export/import restart: ExportGenesis carries the recorded
+// last-VSC-recv time, and InitGenesis restores it on a fresh keeper (rather than
+// falling back to the current block time, which would reset the safe-mode clock).
+func TestGenesisRoundTripLastVSCRecvTime(t *testing.T) {
+	provClientID := "tendermint-07"
+	params := vaastypes.DefaultConsumerParams()
+	params.Enabled = true
+
+	pubKey := ed25519.GenPrivKey().PubKey()
+	tmPK, err := cryptocodec.ToCmtPubKeyInterface(pubKey)
+	require.NoError(t, err)
+	validator := tmtypes.NewValidator(tmPK, 1)
+
+	lastRecv := time.Unix(1_850_000_000, 0).UTC()
+
+	// Export half: a keeper with a recorded last-VSC-recv time exports it.
+	ck, ctx, ctrl, _ := testkeeper.GetConsumerKeeperAndCtx(t, testkeeper.NewInMemKeeperParams(t))
+	defer ctrl.Finish()
+	ck.SetParams(ctx, params)
+	ck.SetProviderClientID(ctx, provClientID)
+	cVal, err := consumertypes.NewCCValidator(validator.Address.Bytes(), 1, pubKey)
+	require.NoError(t, err)
+	ck.SetCCValidator(ctx, cVal)
+	ck.SetHeightValsetUpdateID(ctx, 0, 0)
+	ck.SetLastVSCRecvTime(ctx, lastRecv)
+
+	exported := ck.ExportGenesis(ctx)
+	require.NotNil(t, exported.LastVscRecvTime, "export must carry last_vsc_recv_time")
+	require.Equal(t, lastRecv, *exported.LastVscRecvTime)
+
+	// Import half: a fresh keeper restores the exact time, not the block-time fallback.
+	ck2, ctx2, ctrl2, _ := testkeeper.GetConsumerKeeperAndCtx(t, testkeeper.NewInMemKeeperParams(t))
+	defer ctrl2.Finish()
+	ck2.InitGenesis(ctx2, exported)
+	require.Equal(t, lastRecv, ck2.GetLastVSCRecvTime(ctx2))
+}
+
 func assertProviderClientID(t *testing.T, ctx sdk.Context, ck *consumerkeeper.Keeper, clientID string) {
 	t.Helper()
 	cid, ok := ck.GetProviderClientID(ctx)

x/vaas/consumer/types/genesis.pb.go

@@ -81,6 +81,19 @@ func (k Keeper) InitGenesis(ctx sdk.Context, genState *types.GenesisState) []abc
 				panic(fmt.Errorf("init: set removal time for %d: %w", consumerId, err))
 			}
 		}
+		// Restore the liveness clock (see ExportGenesis): only when present, so
+		// a consumer that never launched keeps the absent-defaults.
+		if cs.LastAckTime != nil {
+			if err := k.SetConsumerLastAckTime(ctx, consumerId, *cs.LastAckTime); err != nil {
+				panic(fmt.Errorf("init: set last ack time for %d: %w", consumerId, err))
+			}
+		}
+		if cs.HighestSentVscId != 0 {
+			k.SetConsumerHighestSentVscId(ctx, consumerId, cs.HighestSentVscId)
+		}
+		if cs.HighestAckedVscId != 0 {
+			k.SetConsumerHighestAckedVscId(ctx, consumerId, cs.HighestAckedVscId)
+		}
 		if len(cs.PendingValsetChanges) > 0 {
 			k.AppendPendingVSCPackets(ctx, consumerId, cs.PendingValsetChanges...)
 		}
@@ -281,13 +294,10 @@ func (k Keeper) InitGenesisValUpdates(ctx sdk.Context) []abci.ValidatorUpdate {
 // and per-consumer debt are NOT exported because they are derivable from
 // the per-consumer fields above and / or other module state at InitGenesis.
 //
-// The liveness clock is also NOT exported and resets to its fresh state on
-// import: the last-ack time defaults to the current block time (so no launched
-// consumer is swept before it has had a fresh grace window), and the
-// highest-sent / highest-acked VSC ids default to 0 and equal (so no consumer
-// is treated as "behind", and the next epoch sends an ordinary diff rather than
-// a snapshot). This is a deliberate reset for a state-export restart, not
-// preserved audit state.
+// The liveness clock (last-ack time and the highest-sent / highest-acked VSC
+// ids) IS exported per consumer and restored at InitGenesis, so a state-export
+// restart preserves each consumer's grace window and resync counters rather
+// than resetting them.
 func (k Keeper) ExportGenesis(ctx sdk.Context) *types.GenesisState {
 	allConsumerIds := k.GetAllConsumerIds(ctx)
 
@@ -339,6 +349,25 @@ func (k Keeper) ExportGenesis(ctx sdk.Context) *types.GenesisState {
 			panic(fmt.Errorf("export: failed to read removal time for consumer %d: %w", consumerId, err))
 		}
 
+		// Liveness clock: export the last-ack time only when actually recorded
+		// (GetConsumerLastAckTime falls back to block time when absent, which we
+		// must not persist), and the resync counters only when non-zero (zero is
+		// their absent default).
+		hasAck, err := k.ConsumerLastAckTime.Has(ctx, consumerId)
+		if err != nil {
+			panic(fmt.Errorf("export: failed to check last ack time for consumer %d: %w", consumerId, err))
+		}
+		if hasAck {
+			ackCopy := k.GetConsumerLastAckTime(ctx, consumerId)
+			cs.LastAckTime = &ackCopy
+		}
+		if v := k.GetConsumerHighestSentVscId(ctx, consumerId); v != 0 {
+			cs.HighestSentVscId = v
+		}
+		if v := k.GetConsumerHighestAckedVscId(ctx, consumerId); v != 0 {
+			cs.HighestAckedVscId = v
+		}
+
 		consumerStates = append(consumerStates, cs)
 	}