Skip to content

Fix/svm environment at epoch crossing - #11

Open
Mctursh wants to merge 2 commits into
masterfrom
fix/svm-environment-at-epoch-crossing
Open

Mctursh wants to merge 2 commits into
masterfrom
fix/svm-environment-at-epoch-crossing

Conversation

@Mctursh

@Mctursh Mctursh commented Sep 15, 2026

Copy link
Copy Markdown
Owner

No description provided.

Splits the replay engine into a small shared layer and a per-era worker, so that
adding an era can't re-resolve a frozen era's dependency graph.

slate-hash owns the lattice and bank hash behind a byte API. It carries its own
LtHash rather than depending on solana-lattice-hash, which is already multi-major
in our lockfiles; two copies of a consensus-frozen algorithm is the drift this
crate exists to stop. Checked agave's lt_hash.rs at 2.2.20, 3.1.14 and 4.2.1
first: byte-identical apart from a rand call in a test helper. The agave crate
stays as a dev-dependency and is now the oracle in a test asserting the two agree
lane for lane.

slate-format owns the on-disk contracts: the account record and one versioned
checkpoint blob replacing four loose redb meta keys. Two things fall out. The
checkpoint's parts can no longer disagree about which slot they came from, so
last week's atomicity bug stops being a reachable state rather than a guarded
one. And decoders refuse what they don't recognise, where every old loader
returned "nothing" and let the caller continue with manifest defaults.

Both take bytes, not solana types. Pubkey at 3.0.0 and 4.3.0 are different types
that don't interoperate, so a shared crate taking &Pubkey is version-locked.

workers/agave-3.1.14 gets its own workspace, committed lockfile and
rust-toolchain. Named by agave version because that's the invariant; the epoch
range is derived from it and has already moved once. vendor/solana-stake-program
moves inside, it's era-private. Root lockfile now has zero agave SVM packages.

Re-proved 807 -> 808 on the new format. Killed a run at slot 349053049 and
resumed: bank hash Hndh3PL56XTD..., capitalization 603764711791976464, pool
147123302379618, commission 40235447357164, 228 partitions / 933553 paid, all
matching the recorded reference to the lamport. The killed leg had run 25 slots
past the checkpoint and the resume recomputed all 25 byte-identical.

Existing .redb stores are no longer resumable, by design. Their accounts tables
still read fine; only the checkpoint blob changed.

Also fixes .gitignore, where /target was anchored to the repo root and missed the
worker's own 2.1 GB target dir.
Feature activation at a boundary was implemented in two of three parts. The
feature accounts activate, and the bank's feature set gets rebuilt, but the
Replayer's svm_feature_set and the SVM's program-runtime environment were
built once from a range's first slot and never moved again. So a multi-epoch
range crossing an SVM-environment activation executes its tail with the wrong
syscall registry and the wrong SBPF version limits.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant