enm v0.5.230 — stdio:'ignore' on chain spawn + F28 CR Council Inactive

Two follow-ups to v0.5.229.

## 1. stdio:'ignore' on detached chain spawn (NativeProcessService:567)

Pre-230 ENM spawned children with `stdio:['pipe','pipe','pipe']`. The
stdin pipe was used (ela reads its keystore password from stdin per
node.sh:878 + the BPoS arbiter mode password feed in
ElaMainChainAdapter), but stdout/stderr pipes were never read on the
ENM side — they were just held open for the child's lifetime, with
ENM's runtime as the other end.

Consequence: every ENM restart (deploy SIGTERM, crash, OOM) closed
the stdout/stderr pipe FDs. The child's next write to stdout/stderr
delivered SIGPIPE → default handler is terminate → ALL 8 child
chains died on every ENM restart, even with detached:true. autoStart
then respawned them ~60s later via the oracle/arbiter pairing logic
shipped in v0.5.228. Operator-visible as "chains briefly down on
every ENM deploy."

Fix: `stdio:['pipe','ignore','ignore']`. stdin stays a pipe for the
password feed; stdout/stderr resolve to /dev/null inside the child.
The child can write to stdout/stderr forever without anyone closing
on them; ENM exiting becomes invisible to the child's stdio.
Combined with detached:true + child.unref(), children are now truly
long-lived across ENM lifecycle events. Chain binaries already write
their own logs via --logdir / --log flags, so dropping the unused
pipes loses nothing in observability terms.

## 2. F28 — CR Council MemberState degraded (parallel to F12)

F12 fires when a BPoS producer-registry record shows state='Inactive'
(producer skipped rotation slots for too many consecutive rounds).
F28 is its CR Council sibling: fires when this node's CR Committee
record (in `listcurrentcrs.crmembersinfo[]`) shows MemberState !=
'Elected'. Same risk class (missed rounds → lost rewards → eventual
seat loss); same NEVER_AUTOMATIC tier (ENM can't recover — Activate
requires the operator's owner key).

Cited file:line for the MemberState enum:
  Elastos.ELA/cr/state/keyframe.go:24-42

State decision table:
  Elected     → quiet (steady state)
  Inactive    → WARN if impeachmentVotes=0, CRITICAL if >0
  Impeached   → CRITICAL (seat lost for term)
  Returned    → CRITICAL (voluntary withdrawal)
  Terminated  → CRITICAL (term ended)
  Illegal     → CRITICAL (caught misbehaving — deposit forfeited)

Wiring:
- snap.cr populated by HealthChecker._fetchCrState (thin wrapper over
  CrMembershipService.detectCrMembership; reuses 30s cache)
- Hard-gated to mainchain (snap.chainId === 'mainchain')
- Hard-gated to actual CR members (cr.isCrMember === true)
- Defensive null-guard pattern same as F12's null-guard on
  snap.bpos.producer
- Filtered into HealthChecker's rule-runner alongside F12 + F25

Operator-facing copy is state-specific so the right recovery hint
surfaces in the audit log. Activate/Recover from Inactive points at
Essentials (where the operator's owner key lives).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Elastos DAO

enm-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elacity/enm-server",
-  "version": "0.5.229",
+  "version": "0.5.230",
   "description": "Elastos Node Manager — standalone sidecar server for PC2 that runs and self-heals an Elastos mainchain node for BPoS supernode AND CR Council operators.",
   "main": "src/server.js",
   "author": "Elacity",

enm-server/src/services/HealthChecker.js

@@ -605,6 +605,14 @@ class HealthChecker {
                 ? await this._fetchBposState(chainId, chainCfg, s)
                 : null;
 
+            // v0.5.230 — CR Council membership snapshot for F28. Only the
+            // mainchain has CR Committee state; non-Class-A chains pass null
+            // and F28 self-gates on the chainId === 'mainchain' check. Best
+            // effort; failure leaves cr=null and F28 stays quiet.
+            const cr = (chainId === 'mainchain')
+                ? await this._fetchCrState(chainCfg).catch(() => null)
+                : null;
+
             const snap = {
                 chainId,
                 processStatus: this.processService.statusSync(chainId),
@@ -616,6 +624,7 @@ class HealthChecker {
                 chainConfig: chainCfg,
                 ruleState: s,
                 bpos,
+                cr,
                 clockSkew,
                 hostConflicts,
             };
@@ -625,7 +634,8 @@ class HealthChecker {
             const dets = HealthRules.runAll(snap).filter((d) =>
                 d.ruleId === 'F5'  || d.ruleId === 'F6'  || d.ruleId === 'F8'
                 || d.ruleId === 'F11' || d.ruleId === 'F12' || d.ruleId === 'F13'
-                || d.ruleId === 'F19' || d.ruleId === 'F25');
+                || d.ruleId === 'F19' || d.ruleId === 'F25'
+                || d.ruleId === 'F28');  // v0.5.230 — CR Council MemberState degraded
             if (dets.length > 0) {
                 await this.engine.apply(chainId, dets, chainCfg);
             }
@@ -931,6 +941,39 @@ class HealthChecker {
         snap.crossChainReach = reach;
     }
 
+    /**
+     * v0.5.230 — fetch CR Council membership state for F28.
+     *
+     * Thin wrapper over CrMembershipService.detectCrMembership, sharing
+     * its 30s in-process cache so the slow-tick re-poll doesn't hammer
+     * mainchain RPC. Returns the same shape the service returns:
+     *   { isCrMember, state, nickname, impeachmentVotes, source, ... }
+     * F28 reads .isCrMember + .state + .impeachmentVotes; everything else
+     * is informational. Failure modes (no pubkey / RPC unreachable /
+     * not-in-Committee) all surface via source !== 'matched'; F28
+     * self-gates on isCrMember=true so non-Council operators don't
+     * trigger it.
+     *
+     * @private
+     * @param {object} chainCfg  mainchain cfg block (read pubkey + RPC from)
+     * @returns {Promise<object|null>}
+     */
+    async _fetchCrState(chainCfg) {
+        if (!chainCfg || !chainCfg.dpos || !chainCfg.dpos.nodePublicKey) {
+            return null;
+        }
+        try {
+            const CrMembershipService = require('./CrMembershipService');
+            const ConfigStore = require('./ConfigStore');
+            const cfg = await ConfigStore.load();
+            return await CrMembershipService.detectCrMembership(cfg, {
+                log: this.extensionHandle && this.extensionHandle.log,
+            });
+        } catch (_) {
+            return null;
+        }
+    }
+
     /**
      * beta.0.3.5 (Wave M4.5) — enrich a snapshot with parent-chain
      * fields for Class C (oracle) chains. F24 reads snap.parentChainId

enm-server/src/services/HealthRules.js

@@ -1048,6 +1048,113 @@ function detectF27(snap) {
     };
 }
 
+/**
+ * F28 — CR Council MemberState degraded (Class A / mainchain only).
+ *
+ * v0.5.230 — parallel to F12 for the Council operator audience. F12 fires
+ * when the BPoS producer-registry record reads state='Inactive'; F28
+ * fires when this node's CR Committee record (in `listcurrentcrs`'s
+ * `crmembersinfo[]`) reads MemberState != 'Elected'. Both rules surface
+ * the same kind of operator-facing risk (missed rotation rounds → lost
+ * rewards) for the two distinct roles a node can play in Elastos DPoS.
+ *
+ * Snap shape consumed: `snap.cr` populated by HealthChecker._fetchCrState
+ * (mirrors _fetchBposState), itself a thin wrapper over CrMembership
+ * Service.detectCrMembership. Null when:
+ *   - chain is not class A (rule self-gates below)
+ *   - operator has no node pubkey configured
+ *   - mainchain RPC unreachable (CrMembershipService returns source='error')
+ *   - the operator is not a CR Committee member (source='not-in-committee')
+ * In all those cases F28 stays quiet (returns null), same defensive
+ * pattern as F12's null-guard on snap.bpos.producer.
+ *
+ * State decision table (mirrors Elastos.ELA/cr/state/keyframe.go:24-42):
+ *   Elected     → no fire (steady state, healthy)
+ *   Inactive    → WARN if impeachmentVotes==0, CRITICAL if > 0 (close to
+ *                 impeachment threshold). Recoverable via Essentials →
+ *                 Activate CR member.
+ *   Impeached   → CRITICAL (impeachment threshold reached; seat lost for
+ *                 the rest of this term)
+ *   Returned    → CRITICAL (operator voluntarily withdrew; deposit
+ *                 returnable but seat gone)
+ *   Terminated  → CRITICAL (term ended without re-election; informational
+ *                 only post-term)
+ *   Illegal     → CRITICAL (caught misbehaving — deposit forfeited)
+ *
+ * Tier: NEVER_AUTOMATIC. ENM cannot recover any of these states for the
+ * operator: Activate / RecoverFromInactive require the operator's owner
+ * key (which ENM intentionally never holds, Rev-6 RNG findings). The
+ * summary points the operator at Essentials.
+ *
+ * Hard-gated to mainchain (snap.chainId === 'mainchain') because CR
+ * Committee membership is a Class-A-only concept; the rule runner would
+ * still skip non-A chains via _fetchCrState returning null, but the
+ * explicit chainId gate makes the intent clear in code-review.
+ */
+function detectF28(snap) {
+    if (!snap || snap.chainId !== 'mainchain') return null;
+    if (!snap.cr) return null;
+    const cr = snap.cr;
+    if (!cr.isCrMember) return null;
+    const state = String(cr.state || '').toLowerCase();
+    if (state === 'elected') return null;  // healthy steady state
+
+    // Pre-fire severity decision. Inactive with no impeachment votes is
+    // WARN (still recoverable cheaply); Inactive with votes climbing,
+    // or any terminal state, is CRITICAL.
+    const impeachmentVotes = parseFloat(cr.impeachmentVotes || '0');
+    const isCritical = (state !== 'inactive') || (impeachmentVotes > 0);
+    const severity = isCritical ? 'CRITICAL' : 'WARNING';
+
+    // Recovery copy is state-specific so the operator gets the right hint.
+    let summaryAction;
+    let summaryReason;
+    if (state === 'inactive') {
+        summaryAction = 'CR Council member Inactive — Activate via Essentials';
+        summaryReason = 'Your CR Committee member record reads MemberState=Inactive '
+            + '(the chain skipped your DPoS slot for too many consecutive rounds). '
+            + 'You can recover by signing an Activate transaction from the wallet '
+            + 'that holds your CR registration deposit, via Elastos Essentials. '
+            + 'ENM cannot do this for you.'
+            + (impeachmentVotes > 0 ? ` Impeachment votes: ${cr.impeachmentVotes} — `
+                + 'address this before votes pass the impeachment threshold.' : '');
+    } else if (state === 'impeached') {
+        summaryAction = 'CR Council member Impeached — seat lost for this term';
+        summaryReason = 'Your CR Committee member record reads MemberState=Impeached. '
+            + 'The impeachment vote threshold was reached on-chain; your seat is gone '
+            + 'for the rest of this Committee term. Your registration deposit is still '
+            + 'yours but Activate is no longer an option. Re-register via Essentials '
+            + 'in the next CR election cycle.';
+    } else if (state === 'returned') {
+        summaryAction = 'CR Council member Returned — deposit refundable';
+        summaryReason = 'Your CR Committee member record reads MemberState=Returned, '
+            + 'which means you voluntarily withdrew from the seat (or the chain '
+            + 'returned you after impeachment). Deposit is refundable via Essentials; '
+            + 'your DPoS slot is no longer in the arbiter slate.';
+    } else {
+        // Terminated / Illegal / any future MemberState value.
+        summaryAction = `CR Council member ${cr.state} — investigate via Essentials`;
+        summaryReason = `Your CR Committee member record reads MemberState=${cr.state}. `
+            + 'This is a terminal state for the current term; check Elastos Essentials '
+            + 'for the specific cause and next steps.';
+    }
+
+    return {
+        ruleId: 'F28',
+        tier: HEALING_TIERS.NEVER_AUTOMATIC,
+        severity,
+        summaryAction,
+        summaryReason,
+        payload: {
+            action: 'cr-council-investigate',
+            chainId: snap.chainId,
+            crState: cr.state,
+            impeachmentVotes: cr.impeachmentVotes || null,
+            nickname: cr.nickname || null,
+        },
+    };
+}
+
 /**
  * Per-rule enable defaults. Per Architectural Invariant #7, healing ships
  * with F1 (auto-restart on unexpected exit) only. F2-F19 are off until
@@ -1135,6 +1242,9 @@ const RULE_METADATA = Object.freeze({
     // v0.5.185 (P1-A) — Class B-only, alert-only. PBFT consensus-recovery stall.
     F27: { tier: 'CRITICAL_NOTIFY', title: 'EVM consensus-recovery stall',
            description: 'On an EVM sidechain (ESC/EID/PG) that is stuck for >20 min with peers but a PBFT recovery-stall log signature ("wait for recoved states" / "can not find active peer"), surface a critical alert. This is a quorum / peer problem, not a data fork — an auto-resync cannot fix it, so F26 yields to this alert and the operator restores peers/bootnodes instead.' },
+    // v0.5.230 — Class A (mainchain) — alert-only. CR Council MemberState drift.
+    F28: { tier: 'NEVER_AUTOMATIC', title: 'CR Council member state degraded',
+           description: 'Parallel to F12 for BPoS producers. Fires when this node\'s CR Committee MemberState is anything other than \'Elected\' — typically Inactive (skipped slots for too many consecutive rounds), Impeached, Returned, Terminated, or Illegal. Recovery for Inactive is the Activate flow in Elastos Essentials; other states are terminal-for-the-term and need the operator to investigate via Essentials. ENM cannot recover this for the operator (no owner key).' },
 });
 
 // beta.3.22 — every rule is enabled by default. The operator-facing
@@ -1171,6 +1281,7 @@ const DEFAULT_ENABLED = Object.freeze({
     F23: true,  // beta.0.3.14 — Class D arbiter cross-chain unreachable
     F26: true,  // v0.5.184 — Class B wedged-fork auto-resync (rate-limited)
     F27: true,  // v0.5.185 — Class B PBFT recovery-stall alert (alert-only)
+    F28: true,  // v0.5.230 — Class A CR Council MemberState degraded (alert-only)
 });
 
 // Global rule overrides (apply to all chains). Pre-3.87 this was the only
@@ -1303,6 +1414,8 @@ function runAll(snap) {
         ['F24', detectF24],
         // beta.0.3.14 (Wave M6.5) — Class D arbiter cross-chain.
         ['F23', detectF23],
+        // v0.5.230 — Class A CR Council MemberState degraded (F12 sibling).
+        ['F28', detectF28],
     ];
 
     // beta.3.87 — Wave M1.3 — DPoS-only rules. F11 (rotation stuck),
@@ -1399,6 +1512,7 @@ module.exports = {
     detectF23,  // beta.0.3.14 (Wave M6.5)
     detectF26,  // v0.5.184 — Class B wedged-fork auto-resync
     detectF27,  // v0.5.185 (P1-A) — Class B PBFT recovery-stall alert
+    detectF28,  // v0.5.230 — Class A CR Council MemberState degraded
     EVM_FORK_STALL_GRACE_MS,
     SPV_CAUGHTUP_MAX_DELTA,  // v0.5.185 (P0-B)
     PEER_ZERO_GRACE_MS,

enm-server/src/services/NativeProcessService.js

@@ -558,13 +558,39 @@ class NativeProcessService extends EventEmitter {
         // stdin, so the post-spawn keystore-password pipe (ela/arbiter) still
         // reaches the chain. argv is forwarded verbatim ($0=binary, "$@"=args).
         const NOFILE_SOFT_TARGET = 40960;
+        // v0.5.230 — stdio: keep stdin as a pipe (ela reads its keystore
+        // password from stdin per node.sh:878 + the BPoS arbiter mode
+        // password feed below), but route stdout/stderr to /dev/null
+        // ('ignore') instead of through ENM's runtime pipes.
+        //
+        // Why: every chain binary already writes its own logs via its
+        // own --log/--logdir flags (ela → chains/mainchain/elastos/logs/
+        // node/*.log; geth forks → their own logdir; oracle scripts →
+        // their stdout was unread anyway). The pre-230 ['pipe', 'pipe',
+        // 'pipe'] only existed for the stdin password feed; the stdout/
+        // stderr pipes back to ENM were never read, but they DID hold an
+        // FD attached to ENM's process lifecycle.
+        //
+        // The consequence pre-230: when ENM exited (deploy SIGTERM,
+        // crash, OOM, anything), Node closed those pipe FDs. The
+        // chain's NEXT write to stdout/stderr would deliver SIGPIPE →
+        // the chain process terminates by default. Net effect: every
+        // ENM restart killed all 8 child chains, even with detached:
+        // true. autoStart then respawned them ~60s later. Operator-
+        // visible as "all chains briefly down on every deploy."
+        //
+        // 'ignore' makes the kernel-level fd be /dev/null inside the
+        // child. The child can write to stdout/stderr forever without
+        // anyone closing on them — ENM exiting is invisible to the
+        // child's stdio. Combined with detached:true + child.unref(),
+        // children are now truly long-lived across ENM lifecycle events.
         const child = spawn(
             '/bin/sh',
             ['-c', `ulimit -n ${NOFILE_SOFT_TARGET} 2>/dev/null; exec "$0" "$@"`, binaryPath, ...spawnArgs],
             {
                 cwd,
                 env: childEnv,
-                stdio: ['pipe', 'pipe', 'pipe'],
+                stdio: ['pipe', 'ignore', 'ignore'],
                 detached: true,
             },
         );