is_update_parent_recoverable_replay_error classifies optimistic-prefix failures through an incomplete allowlist. It omits
FailedToLoadEntries(InvalidShredData(_) | BlockAborted(_))
Also I haven't confirmed any of the below, but it then delegates to another incomplete allowlist, which also omits the following:
GenesisCertificateOnNonChild
GenesisCertificateAlreadyPopulated
SpuriousUpdateParent
Which I think should be able to trigger the divergence too.
A malicious leader can send every validator the same signed shred stream but schedule delivery so one honest cohort executes the failing optimistic prefix and permanently marks the slot dead, while another observes UpdateParent first, starts replay at its FEC boundary, skips that prefix, and accepts the suffix.
This is a post-migration divergence issue. I'm not exactly sure how much it can be escalated. But I have observed nodes going offline on a test-cluster.
is_update_parent_recoverable_replay_errorclassifies optimistic-prefix failures through an incomplete allowlist. It omitsFailedToLoadEntries(InvalidShredData(_) | BlockAborted(_))Also I haven't confirmed any of the below, but it then delegates to another incomplete allowlist, which also omits the following:
GenesisCertificateOnNonChildGenesisCertificateAlreadyPopulatedSpuriousUpdateParentWhich I think should be able to trigger the divergence too.
A malicious leader can send every validator the same signed shred stream but schedule delivery so one honest cohort executes the failing optimistic prefix and permanently marks the slot dead, while another observes
UpdateParentfirst, starts replay at its FEC boundary, skips that prefix, and accepts the suffix.This is a post-migration divergence issue. I'm not exactly sure how much it can be escalated. But I have observed nodes going offline on a test-cluster.