fix: v22 — collapse microblock failover machinery to pure VRF + skip-slot

Architectural simplification of the microblock layer: a single
deterministic VRF leader per height plus a time-derived in-rotation
fallback computed from the chain-anchored `last_applied_block_timestamp`
and the network-corrected `effective_now()` (BFT-time median over the
32-sample on-chain timestamp ring).

The macroblock layer (90-block 2f+1 commit-reveal + view-change),
existing fork-choice (`chain_weight.rs` cumulative attestation weight),
and equivocation slashing (`record_block_equivocation` +
`analyze_chain_for_slashing` covering block-equivocation,
timeout-equivocation, and generic double-sign) are unchanged.

Forensic context
----------------

Three bugs observed on the 5-node testnet across v21..v22:
  * h=360 macroblock-boundary cert-presence deadlock (12.7 h stall)
  * h=367 split-brain fork (empty-slot attestation cascade racing
    cert generation produced an alternate block at the same height)
  * node_002 555K pipeline backlog (canonical peers pipeline-jammed
    by the cert-presence gate, sync requests timed out, fell back to
    the forked peer, hash_chain_break loop)

Root cause was four overlapping microblock failover mechanisms
accumulated over 55 commits (v15..v21) without removing previous ones:
rotation_round atomic + TimeoutVote chain + empty-slot attestation
cascade + heartbeat-fast-path detection. O(N^2) interaction surface
made races inevitable.

Changes
-------

  block_pipeline.rs : +8   -160   net -152
  node.rs           : +372 -781   net -409
  unified_p2p.rs    : +0   -189   net -189

  TOTAL 396 insertions(+), 1186 deletions(-) — NET -790 lines

Deleted (microblock failover machinery)

  * Cert presence gate at block_pipeline.rs:1761 (incl. v21 A2 vote-pool
    fallback — both inert once `mb.timeout_round` is always 0).
  * Empty-slot attestation cascade body (~200 lines).
  * Heartbeat-fast-path consensus integration.
  * Pacemaker rotation_round combine + `set_timeout_round` storage.
  * Vote-gate `is_synced_enough` block (was gating only the deleted emit).
  * v21 (B1) heartbeat-driven TimeoutVote emit.
  * Stall-driven TimeoutVote-microblock emit + producer-failover log.
  * Adaptive timeout grace period (`base_grace + rotation_extra +
    drift_grace`).
  * `proposed_timeout_round` / `adopted_timeout_round` /
    `timeout_round_for_rotation` / `f_plus_1` derivations.
  * Per-tick `certified_timeout_round` read at the microblock layer.
  * `effective_timeout_round_at_start` computation inside the microblock
    struct construction.
  * v21 vote-pool helpers `count_timeout_votes_in_pool` /
    `has_two_f_plus_one_timeout_votes` and `tests_v21_a2_vote_pool` module.
  * `reset_consecutive_empty_slots()` no-op shim from an earlier v22
    draft.
  * Residual `/* */` commented-out blocks left from incremental edits
    (~360 lines physically removed).

Added (v22 production path)

  * `MAX_CONSECUTIVE_EMPTY_SLOTS = 3` constant.

  * `v22_compute_empty_slot_offset(last_applied_block_timestamp, now)`
    pure helper:
      seconds_silent = now - last_applied_block_timestamp - 1
      offset         = seconds_silent / MAX_CONSECUTIVE_EMPTY_SLOTS

    Returns 0 under healthy production. Walks forward by 1 every
    `MAX_CONSECUTIVE_EMPTY_SLOTS` silent seconds.

  * Producer loop rewrite:
      timeout_round       = 0 always
      primary_producer    = VRF leader at round 0
      empty_slot_offset   = v22_compute_empty_slot_offset(
                              last_applied_ts,
                              effective_now())          // BFT-time, not raw clock
      current_producer    = if offset == 0 { primary }
                            else { VRF leader at round = offset }

  * `microblock.timeout_round = 0` literal in the MicroBlock constructor.

  * `tests_v22_slot_offset` — 6 regression tests pinning every transition
    boundary plus the NTP-jitter spread bound.

Preserved (unchanged)

  * Macroblock 2f+1 commit-reveal finality (commit_phase / reveal_phase /
    finalize_round).
  * Macroblock view-change via `emit_macroblock_view_change_vote` on
    commit-phase or reveal-phase failure.
  * `AggregatedTimeoutCert` storage + gossip handlers (consumed by
    macroblock view-change only after v22).
  * `HIGHEST_CERTIFIED_ROUND` DashMap (macroblock state).
  * `chain_weight.rs` LMD-GHOST cumulative attestation fork choice.
  * `record_block_equivocation` + `BLOCK_EQUIVOCATION_EVIDENCE` + all
    slashing detection paths.
  * `effective_now()` BFT-time median ring infrastructure.
  * Median-past timestamp rule + `TIMESTAMP_FUTURE_TOLERANCE`.
  * `observe_clock_drift` EMA monitor + `[WARN][DRIFT]` operator hint.
  * v18 active sync + range-sync + parallel-sync (`MAX_PARALLEL_SYNC_PEERS=8`).
  * v19 anti-spoof Dilithium handshake + v19.1 fresh-bootstrap auto-anchor.
  * v20 PK registry scaling + LRU + 100K cap + env override.
  * Chronic stall recovery (`> 120 s` peer-driven resync) — simplified
    to drop the now-meaningless `certified_round == 0` predicate.

Why this is correct for PQC two-tier blockchain
-----------------------------------------------

Dilithium3 signatures have no aggregation (no BLS equivalent). At a
1000-validator committee, per-block 2/3 voting costs ~2.3 MB / block of
signatures alone — un-shippable. The two-tier amortisation (one signed
microblock per second; 2f+1 macroblock cert every 90 seconds) cuts the
sustained bandwidth to roughly 53 KB / sec at 1000 validators.

For the microblock tier, the universal pattern across multi-tier-finality
chains is optimistic apply with an empty slot tolerated when the
deterministic leader is silent. v22 adopts this pattern and adds an
in-rotation fallback bounded by `MAX_CONSECUTIVE_EMPTY_SLOTS` slots, so
the 30-block rotation window does not amplify a single failed primary
into 30 empty slots.

Safety properties preserved

  * Single deterministic VRF leader per height — no two valid producers
    can claim the same height legitimately.
  * Fallback identity is the same `select_microblock_producer_with_round`
    function with `empty_slot_offset` mixed into the seed; every honest
    node observing the same `effective_now()` reaches the same fallback
    identity.
  * `effective_now()` = max(wall, median of 32-sample on-chain block
    timestamps) — a node with a drifted local clock converges with the
    network on the slot-offset computation as long as the chain itself
    is making progress.
  * All Dilithium3 signature verification gates intact at every block.
  * 2f+1 macroblock commit-reveal supermajority preserved.
  * Anti-replay via signed `(mb_idx, round, voter_id)` tuple in macroblock
    TimeoutVote.
  * Anti-spoof handshake binding (v19) + chain-registered PK (v20) intact.

Failure modes structurally impossible in v22

  * Cascade livelock across microblock rounds (v15.0 h=2880-3150):
    no microblock rounds → no per-voter round scatter.
  * Split-brain producer at the same height (v15.13 h=556, v22 h=367):
    single VRF leader; deterministic time-derived fallback with offset
    spread ≤ 1 across honest nodes within ±2 s NTP jitter (pinned by
    `tests_v22_slot_offset::offset_jitter_bound_within_two_seconds_ntp`).
  * Macroblock-boundary cert deadlock (v21 h=360):
    `mb.timeout_round == 0` always → cert presence gate (deleted) cannot
    fire for any microblock.
  * Empty-slot attestation race producing alternate-round block (v22
    h=367): empty-slot cascade physically removed; no consensus state
    advances on local empty-slot observation.

Scalability
-----------

Per-node steady-state cost: two timestamp loads + one integer division
per slot for the offset computation. Zero added bandwidth, zero added
storage, identical performance profile from 5 to 1M super-nodes.
1000-validator-per-macroblock committee cap unaffected.

Tests
-----

  * `tests_v22_slot_offset` — 6 new tests in `node.rs`:
    - offset_zero_under_healthy_production
    - offset_zero_below_threshold
    - offset_one_at_threshold
    - offset_walks_forward_with_silence
    - offset_saturates_on_backward_clock
    - offset_jitter_bound_within_two_seconds_ntp
  * `qnet-consensus` : 73 passed, 0 failed
  * `qnet-integration` (serial) : 149 passed, 0 failed, 12 ignored
    (hardware-bench)
  * Total : 228 passed across both crates.

Build
-----

cargo build --release clean in 18m 47s, 0 warnings, 0 errors.
qnet-node.exe binary 22.3 MB optimised.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: AIQnetLab

development/qnet-integration/src/block_pipeline.rs

@@ -1710,167 +1710,14 @@ impl BlockPipeline {
                 }
             }
 
-            // ═══════════════════════════════════════════════════════════════════════════
-            // 2b. v16.2: CERT PRESENCE CHECK FOR ROUND>0 BLOCKS (BFT-evidence enforcement)
-            // ═══════════════════════════════════════════════════════════════════════════
-            // A block produced at `timeout_round = R > 0` claims that the network
-            // advanced rotation past round 0 via 2f+1 signed TimeoutVotes. The
-            // cryptographic evidence for that advancement is the
-            // AggregatedTimeoutCertificate stored at `AGGREGATED_TC[(mb_idx, R)]`.
-            //
-            // Cold-boot postmortem at h=154 showed two producers concurrently
-            // emitting blocks at different rotation_rounds because each had
-            // advanced its own `HIGHEST_CERTIFIED_ROUND` independently while
-            // peer gossip was still propagating votes. Without an evidence check
-            // here, ingest accepted any signed block that claimed any round —
-            // letting the network apply two divergent histories before the
-            // mismatch was observed at the next macroblock boundary.
-            //
-            // The fix:
-            //   * `block.timeout_round == 0`  → no cert needed, accept (happy path).
-            //   * `block.timeout_round > 0`   → REQUIRE local
-            //     `AGGREGATED_TC.get((mb_idx, round)).is_some()`. If absent, defer
-            //     the block (pull request_timeout_proofs from peers, re-check on
-            //     next pass). The certificate carries 2f+1 Dilithium3 signatures
-            //     and is signature-verified at gossip ingest by
-            //     `handle_aggregated_timeout_cert`, so presence is sufficient
-            //     evidence — we don't re-verify here.
-            //
-            // Safety property: a block at round R is accepted iff this node has
-            // independently observed 2f+1 votes for round R. Two producers at
-            // different rounds at the same height become impossible — the late
-            // one's cert can only be present after 2f+1 votes for ITS round
-            // arrived, which means rotation advanced past the earlier producer's
-            // round and the earlier block is now stale (will be rejected by the
-            // producer authority check below or supplanted by canonical chain).
-            //
-            // Scalability: O(1) DashMap lookup. AGGREGATED_TC bounded by the
-            // active macroblock window (cleanup_old_timeout_data evicts stale
-            // entries). Works identically at 5-node genesis and 1000-node
-            // production committee — cert size doesn't matter, only presence.
-            //
-            // Post-quantum adaptation: Dilithium3 signatures cannot be
-            // aggregated to a constant-size bundle (no BLS equivalent), so we
-            // cannot embed the 2f+1-signed cert directly inside every block
-            // header — at committee=1000 that would be ~2.2 MB per block. The
-            // local-presence model achieves the same safety property without
-            // the bandwidth cost: cert is gossiped once via
-            // `broadcast_aggregated_timeout_cert`, stored at every honest peer,
-            // and consulted here.
-            // ═══════════════════════════════════════════════════════════════════════════
-            if mb.height > 0 && mb.timeout_round > 0 {
-                let mb_idx_for_cert = mb.height / 90;
-                let cert_present = if let Some(ref p2p) = unified_p2p {
-                    p2p.has_aggregated_timeout_cert(mb_idx_for_cert, mb.timeout_round)
-                } else {
-                    // No P2P context (rare — replay path); accept block as
-                    // signature already validates producer identity. The
-                    // canonical safety net is at apply-time hash chain.
-                    true
-                };
-                if !cert_present {
-                    // ═══════════════════════════════════════════════════════════
-                    // v21 (A2): VOTE-POOL FALLBACK — boundary grace
-                    // ═══════════════════════════════════════════════════════════
-                    // The aggregated cert may not have been generated or
-                    // gossipped yet, but the underlying TimeoutVotes — each
-                    // Dilithium3-verified at ingest by `handle_timeout_vote`
-                    // — may already be in the local pool. The cert is just an
-                    // aggregated view of those votes; if 2f+1 are present in
-                    // the pool, we have equivalent cryptographic evidence.
-                    //
-                    // Why this is needed
-                    // ──────────────────
-                    // Forensic case h=360 on the 5-node testnet showed the
-                    // failure mode:
-                    //   * h=360 first block of new macroblock; primary
-                    //     timed out → failover producer emitted block with
-                    //     timeout_round=R>0;
-                    //   * receivers required AggregatedTimeoutCert for
-                    //     (mb_idx=4, R) before applying;
-                    //   * cert generation requires 2f+1 votes for
-                    //     (mb_idx=4, R) gossipped to at least one node
-                    //     which then aggregates and re-broadcasts;
-                    //   * during the race window between last vote arriving
-                    //     and cert re-gossip, every receiver's pipeline
-                    //     deferred the block — even though the underlying
-                    //     votes WERE locally present.
-                    //
-                    // Treating the pool as equivalent evidence closes that
-                    // race. No new attack surface: the votes counted are
-                    // the same Dilithium3-signed messages that feed cert
-                    // generation; threshold (2f+1) is the same.
-                    //
-                    // Pattern
-                    // ───────
-                    // "cert is a view, not a gate" — same data, two access
-                    // paths. Aligns with production-grade BFT semantics
-                    // where vote pool is the canonical source of truth and
-                    // the aggregated form is a transport optimisation.
-                    //
-                    // Scalability
-                    // ───────────
-                    // One DashMap shard read + one HashMap len() — O(1)
-                    // hot-path cost. At 1M super-nodes the inner HashMap
-                    // is bounded by `MAX_VALIDATORS = 1000` per slot, so
-                    // the count operation is a constant.
-                    // ═══════════════════════════════════════════════════════════
-                    let pool_has_quorum = if let Some(ref p2p) = unified_p2p {
-                        let total = p2p.get_active_validator_count();
-                        // Same threshold formula used everywhere in the
-                        // codebase: `(N * 2 + 2) / 3` = ceil(2N/3) = 2f+1.
-                        let two_f_plus_1 = (total * 2 + 2) / 3;
-                        p2p.has_two_f_plus_one_timeout_votes(
-                            mb_idx_for_cert,
-                            mb.timeout_round,
-                            two_f_plus_1,
-                        )
-                    } else {
-                        false
-                    };
-
-                    if pool_has_quorum {
-                        // Pool evidence equivalent to cert. Fall through to
-                        // subsequent verify steps. Boundary flag in the log
-                        // helps operators distinguish the legitimate macroblock-
-                        // boundary race window from steady-state mid-macroblock
-                        // catches (the latter is unusual and worth noting).
-                        let at_boundary = mb.height % 90 == 0;
-                        if is_info() {
-                            println!(
-                                "[INFO][PIPELINE] cert_pool_grace_admit h={} mb_idx={} round={} boundary={} \
-                                 reason=2fplus1_votes_in_local_pool hint=cert_aggregation_race_bypassed",
-                                mb.height, mb_idx_for_cert, mb.timeout_round, at_boundary
-                            );
-                        }
-                    } else {
-                        // Defer block: neither cert nor enough pool votes yet.
-                        // Trigger backfill request and put block in the
-                        // deferred buffer to be re-checked on the next pass.
-                        if let Some(ref p2p) = unified_p2p {
-                            p2p.request_timeout_proofs(mb_idx_for_cert, mb_idx_for_cert);
-                        }
-                        if deferred.len() < DEFERRED_MAX {
-                            if is_debug() {
-                                println!(
-                                    "[DBG][PIPELINE] block_deferred_for_cert h={} round={} mb_idx={} buf={}",
-                                    mb.height, mb.timeout_round, mb_idx_for_cert, deferred.len()
-                                );
-                            }
-                            deferred.insert(mb.height, decoded);
-                        } else {
-                            if is_info() {
-                                println!(
-                                    "[INFO][PIPELINE] deferred_full h={} round={} dropped (buf={})",
-                                    mb.height, mb.timeout_round, DEFERRED_MAX
-                                );
-                            }
-                            metrics.verify_failed.fetch_add(1, Ordering::Relaxed);
-                        }
-                        continue;
-                    }
-                }
-            }
+            // v22: cert presence gate REMOVED. Microblocks no longer carry a
+            // rotation round (`mb.timeout_round` is always 0 — see
+            // `node.rs::microblock_construction`). The previous gate existed to
+            // require AggregatedTimeoutCert presence for round>0 microblocks;
+            // the round>0 case is now structurally unreachable from honest
+            // producers, and dishonest emitters are caught by the signature
+            // gate immediately below. Macroblock layer retains its own 2f+1
+            // commit-reveal finality — that path is unchanged.
 
             // 3. Signature verification
             // Genesis block (h=0) uses embedded self-signed keys — skip standard verification.