fix: v23.1 — BFT-certified rotation hardening + cryptographic binding

Five concrete defects in v23 closed by direct cross-file audit. Together
they bring the microblock layer to canonical BFT-PoS L1 standards.

1. timeout_round cryptographically bound to block identity
   * MicroBlock::hash and EfficientMicroBlock::hash now include
     timeout_round in the SHA3-256 digest.
   * sign_microblock_with_dilithium / verify_microblock_signature
     include timeout_round in the signing payload; payload tag
     bumped to "Block_Sig_v23.1" (breaking, requires clean restart).
   * Closes the surface where a peer-relay could mutate timeout_round
     in transit and storage-L4 anti-fork would treat the mutated
     block as idempotent re-save.

2. Producer selection uses STRICT 2f+1 certified-only rotation
   * New get_certified_rotation_round(mb_idx) = HIGHEST_CERTIFIED_ROUND
     − baseline (no f+1 adopted input).
   * Old get_effective_rotation_round marked #[deprecated]; its
     max(certified, adopted) semantics re-introduced the h=556
     split-brain class under partial gossip propagation. v23 had
     accidentally adopted that path; v23.1 reverts to v15.13's
     supermajority-only rule.

3. Authenticity gate on block.timeout_round (block_pipeline.rs)
   * Hard-reject when claimed round exceeds local_certified by more
     than TIMEOUT_ROUND_DRIFT_WINDOW=3. Bounds Byzantine claim
     inflation that could lock the rotation baseline.

4. Sticky leader within view (node.rs STICKY_LEADER_PER_VIEW)
   * Once a fallback (timeout_round > 0) successfully produces in
     leadership_round L, it sticks for the remainder of L. Replaces
     the v23 thrash pattern where every successful fallback was
     followed by a retry of the failed primary on the next height
     (6-sec stall per block while primary offline). Sticky lock is
     released only when certified advances to a different round
     OR the 30-block view ends.

5. Bounded memory for the two new rotation DashMaps
   * LAST_TIMEOUT_EMIT_PER_MB and STICKY_LEADER_PER_VIEW pruned by
     the existing cleanup_old_timeout_data sweep, sharing the same
     active-macroblock-window retention contract as the rest of the
     rotation state.

BREAKING (signing-payload tag change):
   Existing peers running v22.1 or earlier will fail signature
   verification on v23.1-signed blocks and vice versa. Operational
   path is a coordinated clean restart with QNET_BOOTSTRAP_FRESH=1
   on every genesis node and a wiped Explorer database.

Verification:
   * cargo check --release --tests: 0 warnings, 0 errors.
   * cargo test --release tests_v23_rotation_round: 2/2 passed.
   * cargo build --release --bin qnet-node: exit 0, 22 MB binary.

Files touched (4): core/qnet-state/src/block.rs,
development/qnet-integration/src/{block_pipeline.rs, node.rs, unified_p2p.rs}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: AIQnetLab

core/qnet-state/src/block.rs

@@ -957,14 +957,45 @@ impl MicroBlock {
     }
 
     /// Calculate microblock hash
+    ///
+    /// ═══════════════════════════════════════════════════════════════════════
+    /// v23.1: TIMEOUT_ROUND INCLUDED IN HASH (consensus-relevant binding)
+    /// ═══════════════════════════════════════════════════════════════════════
+    /// The `timeout_round` field is consensus-relevant state — it determines
+    /// which producer is legitimately elected at this height via the pure
+    /// function `select_microblock_producer_with_round(h, candidates, round)`.
+    /// It also drives `record_finalized_round` → `LAST_FINALIZED_ROUND_PER_MB`
+    /// → `get_certified_rotation_round` for all subsequent heights in the
+    /// macroblock window. Any field that influences consensus decisions
+    /// MUST be cryptographically bound to the block.
+    ///
+    /// Pre-v23.1 the field was omitted from the hash because v22 hardcoded
+    /// it to 0 (single value, omission harmless). v23 restored real values
+    /// (0, 1, 2, ...) for BFT-certified rotation; the omission then became
+    /// a real attack surface: a peer-relay or man-in-the-middle could mutate
+    /// `timeout_round` without breaking the hash → storage L4 anti-fork
+    /// guard would silently treat the mutated block as idempotent re-save
+    /// → divergent baseline tracking across nodes → potential leader-
+    /// selection divergence on subsequent heights.
+    ///
+    /// Including `timeout_round` in the hash closes that surface: any
+    /// mutation produces a different hash → storage L4 detects it as
+    /// equivocation (different content at same height) → reject + record
+    /// evidence for slashing.
+    ///
+    /// Scalability: one extra `to_le_bytes` + `hasher.update` per block.
+    /// Negligible cost at any committee size.
+    /// ═══════════════════════════════════════════════════════════════════════
     pub fn hash(&self) -> [u8; 32] {
         let mut hasher = Sha3_256::new();
         hasher.update(&self.height.to_le_bytes());
         hasher.update(&self.timestamp.to_le_bytes());
         hasher.update(&self.previous_hash);
         hasher.update(&self.merkle_root);
         hasher.update(self.producer.as_bytes());
-        
+        // v23.1: bind timeout_round to block identity (see header above).
+        hasher.update(&self.timeout_round.to_le_bytes());
+
         let result = hasher.finalize();
         let mut hash = [0u8; 32];
         hash.copy_from_slice(&result);
@@ -1123,14 +1154,25 @@ impl EfficientMicroBlock {
     }
 
     /// Calculate efficient microblock hash
+    ///
+    /// v23.1: Mirror of `MicroBlock::hash` — includes `timeout_round` in the
+    /// digest so that storage-layer hash identity matches between the full
+    /// `MicroBlock` and its `EfficientMicroBlock` representation. Without
+    /// this mirror, a block loaded as `MicroBlock` and a block loaded as
+    /// `EfficientMicroBlock` would produce different hashes for the same
+    /// on-disk bytes — breaking the storage-L4 anti-fork guard's identity
+    /// comparison across read paths. See `MicroBlock::hash` header for the
+    /// full consensus-binding rationale.
     pub fn hash(&self) -> [u8; 32] {
         let mut hasher = Sha3_256::new();
         hasher.update(&self.height.to_le_bytes());
         hasher.update(&self.timestamp.to_le_bytes());
         hasher.update(&self.previous_hash);
         hasher.update(&self.merkle_root);
         hasher.update(self.producer.as_bytes());
-        
+        // v23.1: bind timeout_round to block identity (see MicroBlock::hash header).
+        hasher.update(&self.timeout_round.to_le_bytes());
+
         let result = hasher.finalize();
         let mut hash = [0u8; 32];
         hash.copy_from_slice(&result);

development/qnet-integration/src/block_pipeline.rs

@@ -1822,15 +1822,78 @@ impl BlockPipeline {
             //
             // Scalability: O(1) cache lookup. Identical cost at 5 or 5000 validators.
             if !snap.is_syncing() && mb.height > 0 {
+                // ═══════════════════════════════════════════════════════════════
+                // v23.1: BFT-CERTIFIED ROUND AUTHENTICITY GATE
+                // ═══════════════════════════════════════════════════════════════
+                // A block claims to have been produced at rotation round
+                // `mb.timeout_round`. Verify the claim is plausible against
+                // this node's local view of supermajority-certified rounds
+                // for the containing macroblock.
+                //
+                // Allow a small forward drift (TIMEOUT_ROUND_DRIFT_WINDOW)
+                // to absorb honest gossip propagation latency — a producer
+                // can legitimately see 2f+1 votes for round R before this
+                // node's local DashMap has been updated by the same gossip
+                // stream. After the drift window, the claim is implausibly
+                // far ahead of any cert this node could ever have seen,
+                // so it must come from a Byzantine signer (authentic
+                // producer with valid Dilithium3 key but signing an
+                // unsupportable claim).
+                //
+                // Why this matters
+                // ────────────────
+                // After v23.1's timeout_round binding in hash+signature
+                // (block.rs:hash, sign_microblock_with_dilithium), the
+                // producer's claim is CRYPTOGRAPHICALLY ATTESTED — it
+                // cannot be mutated in transit. But a Byzantine producer
+                // can still SIGN an arbitrary round claim. Without this
+                // gate, downstream code (notably `record_finalized_round`
+                // called at apply) would advance `LAST_FINALIZED_ROUND_PER_MB`
+                // to the Byzantine value, locking out future rotation
+                // until 2f+1 honest evidence catches up to the inflated
+                // baseline. This is a DoS class — bounded here.
+                //
+                // The v15.0 `rotation_backfill_request` path below still
+                // fires as a soft signal: if the producer's claim is
+                // legitimate (cert exists somewhere), peer-side retrieval
+                // catches our local certified up to match.
+                //
+                // Drift window = 3: covers ~3 gossip RTTs at the
+                // 1000-validator committee cap (log_5 propagation depth
+                // ≈ 4 hops × ~50ms each = 200ms; cross-region asymmetry
+                // could extend this to ~1s; 3 rounds × 5s emit grace
+                // covers the worst-case propagation race).
+                //
+                // Scalability: one O(1) DashMap read per block ingest.
+                // Identical cost at 5 or 10 000 super-nodes.
+                // ═══════════════════════════════════════════════════════════════
+                const TIMEOUT_ROUND_DRIFT_WINDOW: u64 = 3;
+                let mb_idx = mb.height / 90;
+                let local_certified =
+                    crate::unified_p2p::highest_certified_round_for(mb_idx);
+                if mb.timeout_round > local_certified.saturating_add(TIMEOUT_ROUND_DRIFT_WINDOW) {
+                    if is_warn() {
+                        println!(
+                            "[WARN][PIPELINE] timeout_round_implausible h={} mb={} claimed={} local_certified={} drift_window={} action=hard_reject from={}",
+                            mb.height, mb_idx, mb.timeout_round,
+                            local_certified, TIMEOUT_ROUND_DRIFT_WINDOW,
+                            decoded.from_peer,
+                        );
+                    }
+                    metrics.verify_failed.fetch_add(1, Ordering::Relaxed);
+                    continue;
+                }
+
                 if let Some((expected, expected_round)) = crate::node::get_expected_producer(mb.height) {
                     if mb.producer != expected {
                         if mb.timeout_round != expected_round {
                             // Category A: Timeout divergence — different round claimed.
-                            // Without an ingest-side VRF re-derivation we cannot
-                            // declare this invalid; signature + hash chain + 2f+1
-                            // macroblock commit still enforce correctness, and
-                            // the BFT-driven rotation converges once all nodes
-                            // have gossiped their signed TimeoutVotes.
+                            // Bounded above by the v23.1 authenticity gate; this branch
+                            // covers honest gossip-window divergence (within drift) where
+                            // the claim is plausible but doesn't match our cached view.
+                            // Signature + hash chain + macroblock 2f+1 commit still enforce
+                            // correctness; the BFT-driven rotation converges once vote
+                            // gossip propagates.
                             if is_info() {
                                 println!("[INFO][PIPELINE] timeout_divergence h={} our_round={} block_round={} our_prod={} block_prod={}",
                                          mb.height, expected_round, mb.timeout_round, expected, mb.producer);