forkchoice: use only the "new" pool for update_safe_target#680
Merged
tcoratger merged 1 commit intoleanEthereum:mainfrom Apr 25, 2026
Merged
Conversation
Treat safe target as an availability signal: compute it strictly from latest_new_aggregated_payloads and ignore latest_known_aggregated_payloads. update_safe_target runs at interval 3, before the migration step at interval 4. That ordering is intentional: votes still in "new" at interval 3 reflect the current slot's online view, while anything already in "known" reflects historical knowledge (block-included attestations, previously migrated gossip, self-attestations stored locally). Counting "known" would let the safe target keep advancing on stale evidence even when live participation has collapsed. This brings the spec in line with the zeam client (see blockblaz/zeam#779) and the Ream reference implementation. The merged-pool test is rewritten to pin the new-only behaviour: with "known" at 2 votes and "new" at 2 votes (threshold 4), the safe target now stays at genesis instead of advancing to block_2.
g11tech
approved these changes
Apr 24, 2026
Merged
5 tasks
tcoratger
approved these changes
Apr 25, 2026
tcoratger
added a commit
to tcoratger/leanSpec
that referenced
this pull request
Apr 27, 2026
Absorbs 14 commits from main and resolves two textual conflicts in genesis/config.py and the matching test (PR leanEthereum#683 deleted the dead GenesisConfig.create_state helper that this branch had refactored to take a fork argument; production code goes through fork.generate_genesis directly, so the wrapper is genuinely dead). Reroutes two stale subspecs.containers imports left behind by the auto-merge: a new test file from PR leanEthereum#684 (Checkpoint __lt__) and a sync test fixture from PR leanEthereum#672. Both now resolve through forks.devnet4.containers. Tightens the docstring and inline comment introduced for update_safe_target by PR leanEthereum#680 to follow the project's documentation rules (short sentences, bullets over paragraphs). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced Apr 27, 2026
pablodeymo
pushed a commit
to lambdaclass/ethlambda
that referenced
this pull request
Apr 27, 2026
…316) ## Summary Ports [leanSpec PR #680](leanEthereum/leanSpec#680) into ethlambda. `update_safe_target` now reads only `latest_new_attestations` instead of merging the `new` and `known` pools. ## Rationale Safe target is an **availability** signal, not a durable-knowledge signal. The `new -> known` migration step runs at interval 4, strictly *after* safe-target computation at interval 3, and 3sf-mini chose that ordering deliberately: - At interval 3, votes still in `new` represent the current slot's online view. - Anything already in `known` is historical: block-included attestations, gossip migrated in earlier slots, self-attestations stored locally without traversing gossipsub. - Counting `known` would let a node keep advancing its safe target on stale evidence even when live participation has collapsed, which is exactly the failure mode safe target is supposed to prevent. Aligns with zeam (PR #779) and the Ream reference implementation. ## Changes - `crates/blockchain/src/store.rs` (`update_safe_target`): swap `extract_latest_all_attestations()` for `extract_latest_new_attestations()`. Docstring rewritten around the interval-3 / interval-4 ordering and the availability framing. - `crates/storage/src/store.rs`: drop the now-unused `extract_latest_all_attestations` helper. ## Notes - Marked draft because the upstream spec PR is still draft awaiting confirmation from Yaan on the availability framing. Once leanSpec #680 lands and `LEAN_SPEC_COMMIT_HASH` is bumped, the regenerated `test_safe_target_*` fixtures should validate the new behavior end-to-end. (Today the fixture's `safeTargetSlot` / `safeTargetRootLabel` checks are silently ignored by our spec-test runner because those fields are not yet wired into `StoreChecks`.) ## Test plan - [x] `cargo build --workspace` - [x] `cargo clippy --workspace --all-targets -- -D warnings` - [x] `cargo fmt --all` - [x] `cargo test --workspace --release` -- 323 passed, 6 ignored - [x] `cargo test -p ethlambda-blockchain --release --test forkchoice_spectests` -- 70 passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Treat safe target as an availability signal: compute it strictly from
latest_new_aggregated_payloadsand stop merging inlatest_known_aggregated_payloads.This aligns the spec with the zeam client's existing behaviour (see blockblaz/zeam#779) and the Ream reference implementation.
Rationale
update_safe_targetruns at interval 3, strictly before the migration step at interval 4 that movesnew -> known. The tick ordering is the whole argument:accept_new_votesfirst, thencompute_safe_targeton a merged pool) and chose not to.newrepresent the current slot's online view. Anything already inknownrepresents historical knowledge: block-included attestations, gossip votes migrated in previous slots, self-attestations stored locally without passing through gossipsub.knownwould let a node keep advancing its safe target on stale evidence even when live participation has collapsed. That is exactly the failure mode safe target is supposed to prevent.Quoting the zeam review thread:
What changes
`src/lean_spec/subspecs/forkchoice/store.py` (`update_safe_target`):
`tests/consensus/devnet/fc/test_safe_target.py`:
Notes
Test plan