fix(vm): validate existing state before TIP-2935 deploy and self-heal half-installs

The previous deploy() skipped any store whose entry already existed at the
canonical address, which had two failure modes:

- Silent merge with foreign state. If any capsule already sat at 0x…2935
  (accidental transfer, pre-existing code), deploy would skip that store
  and proceed, leaving the canonical address with a mix of prior and new
  data. Nothing alerted operators, and the contract could be functionally
  broken (wrong code, wrong account type).
- Unrecoverable half-install. init() runs with revokingStore disabled, so
  the three writes are not atomic. A crash between writes left the DB with
  a subset of entries; on next start deployIfMissing only checked
  CodeStore.has and would skip, leaving the address permanently broken
  (RepositoryImpl returns null storage whenever the account is missing).

The rewritten deploy() validates any pre-existing code / contract / account
against the expected HistoryStorage (bytecode equality, contract name +
address, account type=Contract) and throws IllegalStateException on any
mismatch — activation refuses rather than silently corrupting state.
Whatever is missing after validation is filled in, so a half-install
self-heals on the next start.

deployIfMissing() now gates on the flag alone and delegates to deploy()
so the recovery path is exercised regardless of which of the three stores
was written before the crash. A logger.info fires inside the code-write
branch specifically, so operators can grep for when fresh bytecode landed
on a given node without noise on steady-state restarts.

New tests:
- deployRejectsPreExistingWrongCode
- deployRejectsPreExistingForeignContract
- deployRejectsPreExistingNormalAccount
- deployIfMissingCompletesPartialInstall

Author: yanghang8612

framework/src/main/java/org/tron/core/db/HistoryBlockHashUtil.java

@@ -3,6 +3,8 @@
 import static java.lang.System.arraycopy;
 
 import com.google.protobuf.ByteString;
+import java.util.Arrays;
+import lombok.extern.slf4j.Slf4j;
 import org.bouncycastle.util.encoders.Hex;
 import org.tron.common.crypto.Hash;
 import org.tron.common.runtime.vm.DataWord;
@@ -28,6 +30,7 @@
  * {@code contractVersion=0}: first 16 bytes of {@code sha3(address)} followed by
  * the last 16 bytes of the 32-byte slot key.
  */
+@Slf4j(topic = "DB")
 public class HistoryBlockHashUtil {
 
   public static final long HISTORY_SERVE_WINDOW = 8191L;
@@ -65,30 +68,38 @@ public static byte[] composeStorageKey(long slot, byte[] address) {
   }
 
   /**
-   * Deploy when the flag is on but bytecode is missing. Covers the config-boot
-   * path (committee.allowTvmPrague=1) where no proposal fires to trigger deploy.
-   * Run once from {@code Manager.init()} after config is loaded into the store.
+   * Ensure the HistoryStorage contract is fully deployed when the flag is on.
+   * Covers two recovery cases not handled by {@link ProposalService}:
+   * <ul>
+   *   <li>config-boot: {@code committee.allowTvmPrague=1} without a proposal;
+   *   <li>partial install: a prior startup crashed between the three store
+   *       writes, leaving a half-installed state that would otherwise never
+   *       self-heal.
+   * </ul>
+   * Run once from {@code Manager.init()} after config is loaded.
    */
   public static void deployIfMissing(Manager manager) {
-    if (manager.getDynamicPropertiesStore().allowTvmPrague()
-        && !manager.getCodeStore().has(HISTORY_STORAGE_ADDRESS)) {
+    if (manager.getDynamicPropertiesStore().allowTvmPrague()) {
       deploy(manager);
     }
   }
 
   /**
-   * Deploy the EIP-2935 HistoryStorage contract at HISTORY_STORAGE_ADDRESS.
-   * Writes CodeStore, ContractStore and AccountStore. Idempotent — safe to call
-   * multiple times; only the missing entries are written.
-   * Called once from ProposalService when ALLOW_TVM_PRAGUE activates.
+   * Deploy the EIP-2935 HistoryStorage contract at {@code HISTORY_STORAGE_ADDRESS}.
+   * Validates first, writes second: any pre-existing code/contract/account at the
+   * canonical address must match the expected HistoryStorage; otherwise the call
+   * throws and activation halts rather than silently merging with foreign state.
+   * Whatever is missing after validation is filled in, so a half-installed state
+   * from a crashed prior run self-heals on the next start.
    */
   public static void deploy(Manager manager) {
     byte[] addr = HISTORY_STORAGE_ADDRESS;
+    validateExistingOrThrow(manager, addr);
 
     if (!manager.getCodeStore().has(addr)) {
       manager.getCodeStore().put(addr, new CodeCapsule(HISTORY_STORAGE_CODE));
+      logger.info("TIP-2935: wrote HistoryStorage bytecode at {}", Hex.toHexString(addr));
     }
-
     if (!manager.getContractStore().has(addr)) {
       SmartContract sc = SmartContract.newBuilder()
           .setName(HISTORY_STORAGE_NAME)
@@ -99,13 +110,38 @@ public static void deploy(Manager manager) {
           .build();
       manager.getContractStore().put(addr, new ContractCapsule(sc));
     }
-
     if (!manager.getAccountStore().has(addr)) {
       manager.getAccountStore().put(addr,
           new AccountCapsule(ByteString.copyFrom(addr), Protocol.AccountType.Contract));
     }
   }
 
+  private static void validateExistingOrThrow(Manager manager, byte[] addr) {
+    if (manager.getCodeStore().has(addr)) {
+      byte[] existing = manager.getCodeStore().get(addr).getData();
+      if (!Arrays.equals(HISTORY_STORAGE_CODE, existing)) {
+        throw new IllegalStateException(
+            "TIP-2935: code at " + Hex.toHexString(addr) + " differs from expected bytecode");
+      }
+    }
+    if (manager.getContractStore().has(addr)) {
+      SmartContract existing = manager.getContractStore().get(addr).getInstance();
+      if (!HISTORY_STORAGE_NAME.equals(existing.getName())
+          || !Arrays.equals(addr, existing.getContractAddress().toByteArray())) {
+        throw new IllegalStateException(
+            "TIP-2935: contract at " + Hex.toHexString(addr)
+                + " is not the expected HistoryStorage");
+      }
+    }
+    if (manager.getAccountStore().has(addr)) {
+      AccountCapsule existing = manager.getAccountStore().get(addr);
+      if (existing.getType() != Protocol.AccountType.Contract) {
+        throw new IllegalStateException(
+            "TIP-2935: account at " + Hex.toHexString(addr) + " exists but is not a contract");
+      }
+    }
+  }
+
   /**
    * Write the parent block hash to storage at slot
    * {@code (blockNum - 1) % HISTORY_SERVE_WINDOW}. Called from

framework/src/test/java/org/tron/core/db/HistoryBlockHashIntegrationTest.java

@@ -5,6 +5,7 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
 
 import com.google.protobuf.ByteString;
 import java.lang.reflect.Field;
@@ -17,13 +18,17 @@
 import org.tron.common.parameter.CommonParameter;
 import org.tron.common.runtime.vm.DataWord;
 import org.tron.common.utils.Sha256Hash;
+import org.tron.core.capsule.AccountCapsule;
 import org.tron.core.capsule.BlockCapsule;
 import org.tron.core.capsule.CodeCapsule;
+import org.tron.core.capsule.ContractCapsule;
 import org.tron.core.capsule.StorageRowCapsule;
 import org.tron.core.config.args.Args;
 import org.tron.core.store.DynamicPropertiesStore;
 import org.tron.core.store.StoreFactory;
 import org.tron.core.vm.repository.RepositoryImpl;
+import org.tron.protos.Protocol;
+import org.tron.protos.contract.SmartContractOuterClass.SmartContract;
 
 /**
  * TIP-2935 end-to-end: activation deploys the contract, subsequent blocks
@@ -276,4 +281,88 @@ public void writeIsNoOpForGenesisBlock() {
         0L, HistoryBlockHashUtil.HISTORY_STORAGE_ADDRESS);
     assertFalse(chainBaseManager.getStorageRowStore().has(slot0Key));
   }
+
+  /**
+   * Collision guard: if foreign bytecode already sits at the canonical address
+   * (theoretically impossible short of a hash pre-image, but we fail-fast rather
+   * than silently merging), activation must refuse instead of skipping the code
+   * write and proceeding with a broken contract.
+   */
+  @Test
+  public void deployRejectsPreExistingWrongCode() {
+    byte[] addr = HistoryBlockHashUtil.HISTORY_STORAGE_ADDRESS;
+    chainBaseManager.getCodeStore().put(addr, new CodeCapsule(new byte[]{0x60, 0x00}));
+
+    try {
+      HistoryBlockHashUtil.deploy(dbManager);
+      fail("expected deploy to refuse foreign bytecode at canonical address");
+    } catch (IllegalStateException e) {
+      assertTrue(e.getMessage().contains("TIP-2935"));
+    }
+
+    assertFalse(chainBaseManager.getContractStore().has(addr));
+    assertFalse(chainBaseManager.getAccountStore().has(addr));
+  }
+
+  @Test
+  public void deployRejectsPreExistingForeignContract() {
+    byte[] addr = HistoryBlockHashUtil.HISTORY_STORAGE_ADDRESS;
+    SmartContract foreign = SmartContract.newBuilder()
+        .setName("NotHistoryStorage")
+        .setContractAddress(ByteString.copyFrom(addr))
+        .setOriginAddress(ByteString.copyFrom(addr))
+        .build();
+    chainBaseManager.getContractStore().put(addr, new ContractCapsule(foreign));
+
+    try {
+      HistoryBlockHashUtil.deploy(dbManager);
+      fail("expected deploy to refuse foreign contract at canonical address");
+    } catch (IllegalStateException e) {
+      assertTrue(e.getMessage().contains("TIP-2935"));
+    }
+
+    assertFalse(chainBaseManager.getCodeStore().has(addr));
+    assertFalse(chainBaseManager.getAccountStore().has(addr));
+  }
+
+  @Test
+  public void deployRejectsPreExistingNormalAccount() {
+    byte[] addr = HistoryBlockHashUtil.HISTORY_STORAGE_ADDRESS;
+    chainBaseManager.getAccountStore().put(addr,
+        new AccountCapsule(ByteString.copyFrom(addr), Protocol.AccountType.Normal));
+
+    try {
+      HistoryBlockHashUtil.deploy(dbManager);
+      fail("expected deploy to refuse a pre-existing non-contract account");
+    } catch (IllegalStateException e) {
+      assertTrue(e.getMessage().contains("TIP-2935"));
+    }
+
+    assertFalse(chainBaseManager.getCodeStore().has(addr));
+    assertFalse(chainBaseManager.getContractStore().has(addr));
+  }
+
+  /**
+   * Half-installed state recovery: if a prior startup crashed between the three
+   * writes (init() runs with revokingStore disabled, so writes are not atomic),
+   * the DB is left with a subset of the three entries. deployIfMissing must
+   * complete the install on the next start — the previous gate (which only
+   * checked CodeStore.has) would skip and leave the state permanently broken.
+   */
+  @Test
+  public void deployIfMissingCompletesPartialInstall() {
+    byte[] addr = HistoryBlockHashUtil.HISTORY_STORAGE_ADDRESS;
+    chainBaseManager.getDynamicPropertiesStore().saveAllowTvmPrague(1L);
+
+    chainBaseManager.getCodeStore().put(addr, new CodeCapsule(HistoryBlockHashUtil.HISTORY_STORAGE_CODE));
+    assertTrue(chainBaseManager.getCodeStore().has(addr));
+    assertFalse(chainBaseManager.getContractStore().has(addr));
+    assertFalse(chainBaseManager.getAccountStore().has(addr));
+
+    HistoryBlockHashUtil.deployIfMissing(dbManager);
+
+    assertTrue(chainBaseManager.getCodeStore().has(addr));
+    assertTrue(chainBaseManager.getContractStore().has(addr));
+    assertTrue(chainBaseManager.getAccountStore().has(addr));
+  }
 }