fix(validator): preserve reviewed successor across head drift

[wallscaler]

Outcome target

Allow the fixed, digest-reviewed UID30 two-miner successor to cross only the existing one-or-two-finalized-block collection race, then sign only after every mutable launch gate is re-proven at the canonical descendant head.

The exact live target remains:

• complete mechanism-0 row [[8, 65535], [124, 65535]]
• zero burn destination and zero burn weight
• one authority_bounded successor attempt
• exact canonical predecessor [[124, 65535]]
• two distinct reviewed HTTPS axons and two distinct attested TLS identities
• finalized inclusion plus two later finalized-head confirmations

Live failure this fixes

The first production successor invocation on merged main a7115b5 collected fresh evidence at finalized blocks 8,947,986 and 8,947,987, then refused with:

SN39 finalized head advanced after preflight; refusing before signing

That refusal was safe. It returned REFUSED_NO_CHAIN_WRITE, created no signed intent, consumed no nonce, submitted no extrinsic, and restored the canonical predecessor journal byte-for-byte at SHA-256 700812f931a8c5c26bf35644e93a90c4ba4b15c5125ab22a231211777e647285.

The one-miner launch already had a bounded reviewed-descendant path. The fixed successor caller did not request it, and the canonical descendant guard supported only the legacy one-miner contract.

What changes

• The production fixed-successor call requests the existing bounded descendant capability.
• The canonical guard dispatches a separate two_miner_successor branch from the exact durable journal marker.
• The legacy one-miner descendant body remains byte-for-byte unchanged.
• Generic, recurring, partially marked, wrong-digest, wrong-journal, and test-double callers remain denied.

Before nonce lookup, wallet unlock, call composition, signing, intent journaling, or submission, the successor branch re-proves:

• the exact preview digest, durable attempt ID, canonical runtime root, shared lock, predecessor journal, unsigned rollback preimage, and one-attempt budget
• the dynamic two-UID vector with raw weights [65535, 65535] and zero burn
• the original mapping block and bounded canonical parent ancestry
• wall-clock, mortal-era, and epoch room at the descendant head
• subnet owner, min/max weights, version floor, commit-reveal state, stake threshold, exact validator stake, mechanism count, cooldown, and last update
• UID30 permit and forward/reverse mapping
• both miner forward/reverse mappings
• both exact reviewed public IPv4 HTTPS port 8081 protocol-4 axons using the installed Bittensor 10.5 raw MetagraphInfo shape
• the unchanged predecessor storage row at the descendant head

Every tested contradiction refuses before the irreversible boundary and leaves byte-exact unsigned abort available.

Verification

Exact commit: 4d06895042fb26babfd0d4574beaa2e004b96b1d

• 98 focused successor and descendant tests passed
• 222 impacted successor plus legacy tests passed
• 39 lifecycle tests passed, 1 environment skip
• 1,780 non-integration thin tests passed; 20 known macOS shell/bootstrap baseline failures and 9 skips remain unrelated
• Python compilation, Ruff lint, Ruff formatting, and git diff --check passed
• independent exact-diff safety review: SHIP, no P0 or P1 findings
• Claude Fable exact-commit review: SHIP, no P0 or P1 findings
• installed Bittensor 10.5.0 call signatures and return shapes verified

Fable recorded one P2 coverage gap: the axon mutation matrix lacks a dedicated live-IP-diff case. The exact IP comparison is present, while raw shape, IP type, port, protocol, and endpoint mutations are covered. This does not change the SHIP verdict.

Merge and live proof boundary

Merge success means the fail-closed descendant path is present on main. It is not proof of a chain write.

After merge, the operator must build the exact Linux/amd64 main image, create and independently review a new immutable preview, re-prove exclusive-writer status and both live machines, submit once, and confirm the exact row at inclusion and two later finalized heads. A signed or ambiguous result never authorizes a retry.

---

Note

High Risk
Changes pre-sign authorization for on-chain weight submission on SN39, including successor extrinsics; mistakes could sign wrong vectors or weaken fail-closed gates, though behavior is heavily tested and scoped to reviewed two-miner contracts.

Overview
Fixes production UID30 two-miner successor submissions that collected fresh evidence then refused with head-drift errors when the finalized chain moved one or two blocks before signing.

The successor submit path now passes allow_reviewed_uid30_finalized_descendant=True into _submit_exact_sn39_extrinsic, matching the existing one-miner launch behavior. In validator_thin, the canonical descendant guard branches when the durable journal marks a two_miner_successor contract (or the runtime carries the successor preview digest): it runs new _require_reviewed_uid30_successor_finalized_descendant instead of the legacy one-miner checks, which stay unchanged.

Before nonce, wallet unlock, or signing, the successor branch re-proves the reviewed digest, wire vector [65535, 65535], bounded parent ancestry from the mapping block, inclusion/time/epoch room, chain policy, UID mappings, validator permit/stake/cooldown, predecessor weights row, and both miners’ reviewed IPv4 HTTPS axons. Callers without the exact reviewed successor contract still fail closed.

Tests add _descendant_preflight fixtures, acceptance for bounded drift, a large counterexample matrix that must refuse before irreversible steps, and an assertion that the generic flag does not authorize unreviewed callers.

^{Reviewed by Cursor Bugbot for commit 4d06895. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_fbf7579b-977b-441a-a259-49e34d68723d)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T03:45:49.426847Z	4d06895	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[wallscaler]

PM gate (no Astro ping):

• Honesty: validator-only; no catalog/site/SKU copy; no SN70 claim.
• Merge when exact-head CI is green (3.11/3.12/Publisher/Integration). Bugbot usage-capped/neutral is not a blocker if independent SHIP reviews already land.
• Merge ≠ chain write. After merge: rebuild Linux/amd64 main image, new immutable reviewed successor preview, re-prove exclusive-writer + both live miners, one submit only; refuse retry on signed/ambiguous. Do not submit from a7115b5 again.
• Hold CyberGym feat(cybergym): v3 lane bottom-fill payout curve (leader takes remainder) #146/feat(cybergym): v3 redirects the CyberGym lane to compute when idle (N=0) #147; leave PolarIS #1163 draft; no emissions claim.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4d06895042

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Accept valid two-era successor windows

When a reviewed successor starts with between 2 * mortal_period_blocks + drift and 3 * mortal_period_blocks - 1 blocks before the epoch, its preview is valid under validate_uid30_successor_state, and after a one- or two-block drift it still has the full mortal era required by the preceding valid_until_block check. This additional three-era requirement nevertheless rejects it before signing, so the new path still fails to preserve otherwise valid reviewed successors across the exact head drift it is intended to handle. Align this threshold with the existing preview/inclusion-policy room requirement rather than imposing a third era only on the descendant path.

Useful? React with 👍 / 👎.