fix(proposervm): slot-snap child timestamp — kill stale-parent rebuild churn (VC liveness)

Off a stale parent (idle past the proposer window → anyone-can-propose), buildChild
was stamping a raw wall-clock timestamp (Time().Truncate(1s)), so every rebuild of the
same inner block produced a DISTINCT envelope id. That is an unbounded, ever-growing
sibling set at one height: the round-scoped view-change can never gather α aligned
prevotes on a single candidate (no proof-of-lock forms) and finality stalls fleet-wide
(the distributed liveness stall).

Snap the child timestamp DOWN to the parent-anchored proposer-window grid
(parentTimestamp + slot*WindowDuration, slot = TimeToSlot(parent, now)) so all rebuilds
WITHIN one slot are byte-identical → one stable candidate the view-change converges on.

Safe by construction: TimeToSlot(parent, snapped) == slot == TimeToSlot(parent, now), so
the block's slot — hence ExpectedProposer's proposer-window / signed-unsigned verdict and
the derived epoch — is unchanged. Only slot>0 snapped, so a fresh in-window child keeps
its exact timestamp (zero live-chain change), and a snapped time is strictly > parent
(monotonic) and <= now (not advanced). Liveness-only; no safety surface touched.

Extracted as slotSnappedChildTimestamp + unit-proven (idempotence, slot-invariance,
monotonicity). Full proposervm suite green.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>

vms/proposervm/block.go

@@ -210,6 +210,42 @@ func (p *postForkCommonComponents) Verify(
 	)
 }
 
+// slotSnappedChildTimestamp returns the timestamp a child built at wall-clock `now` off a
+// parent at `parentTimestamp` should carry. It is the parent-anchored proposer-window grid:
+// parentTimestamp + slot*WindowDuration, where slot = TimeToSlot(parentTimestamp, now).
+//
+// WHY (round-scoped view-change liveness): off a STALE parent — idle past the proposer
+// window, so "anyone can propose" — buildChild is called repeatedly, and a raw wall-clock
+// timestamp (now.Truncate(1s)) makes EVERY rebuild a DISTINCT envelope over the same inner
+// block. That is an unbounded, ever-growing set of siblings at one height; the round-scoped
+// view-change can never gather α aligned prevotes on any single candidate (no proof-of-lock
+// forms) → finality stalls fleet-wide (the distributed liveness stall a goroutine dump of the
+// hung fleet showed: all nodes quiescent, waiting for votes no one will send). Snapping to the
+// window grid makes all rebuilds WITHIN one slot byte-IDENTICAL — one stable candidate per
+// slot for the view-change to converge on.
+//
+// WHY IT IS SAFE: TimeToSlot(parent, snapped) == slot == TimeToSlot(parent, now), so the
+// block's SLOT is unchanged; ExpectedProposer (verifyPostDurangoBlockDelay /
+// shouldBuildSignedBlockPostDurango) returns the IDENTICAL verdict, so the proposer-window and
+// signed/unsigned checks are byte-for-byte unaffected, and the derived epoch is stabilised
+// across the slot instead of churned. Only slot>0 is snapped, so:
+//   - normal in-window production (slot 0, child < WindowDuration after parent) keeps its exact
+//     sub-window timestamp — zero behaviour change on a live chain;
+//   - a snapped time is strictly > parent (monotonic, no errTimeNotMonotonic) and ≤ now (never
+//     errTimeTooAdvanced).
+// It is a pure function of (parentTimestamp, now) so it is idempotent for any two calls in the
+// same slot — the property the liveness fix relies on.
+func slotSnappedChildTimestamp(parentTimestamp, now time.Time) time.Time {
+	ts := now.Truncate(time.Second)
+	if ts.Before(parentTimestamp) {
+		return parentTimestamp
+	}
+	if slot := proposer.TimeToSlot(parentTimestamp, ts); slot > 0 {
+		return parentTimestamp.Add(time.Duration(slot) * proposer.WindowDuration)
+	}
+	return ts
+}
+
 // Return the child (a *postForkBlock) of this block
 func (p *postForkCommonComponents) buildChild(
 	ctx context.Context,
@@ -218,11 +254,10 @@ func (p *postForkCommonComponents) buildChild(
 	parentPChainHeight uint64,
 	parentEpoch chain.Epoch,
 ) (Block, error) {
-	// Child's timestamp is the later of now and this block's timestamp
-	newTimestamp := p.vm.Time().Truncate(time.Second)
-	if newTimestamp.Before(parentTimestamp) {
-		newTimestamp = parentTimestamp
-	}
+	// Child's timestamp is the later of now and this block's timestamp, SLOT-SNAPPED to the
+	// parent-anchored proposer-window grid (see slotSnappedChildTimestamp) so repeated rebuilds
+	// off a stale parent are byte-identical — the round-scoped view-change liveness fix.
+	newTimestamp := slotSnappedChildTimestamp(parentTimestamp, p.vm.Time())
 
 	// The child's P-Chain height is proposed as the optimal P-Chain height that
 	// is at least the parent's P-Chain height

vms/proposervm/block_slotsnap_test.go

@@ -0,0 +1,81 @@
+// Copyright (C) 2019-2026, Lux Industries, Inc. All rights reserved.
+// See the file LICENSE for licensing terms.
+
+package proposervm
+
+import (
+	"testing"
+	"time"
+
+	"github.com/luxfi/node/vms/proposervm/proposer"
+)
+
+// TestSlotSnappedChildTimestamp proves the view-change liveness fix's properties on the
+// timestamp buildChild stamps: the same-slot IDEMPOTENCE that makes a stale-parent rebuild
+// one stable candidate, and the SLOT-INVARIANCE that keeps every proposer-window check
+// byte-identical to the pre-fix behaviour.
+func TestSlotSnappedChildTimestamp(t *testing.T) {
+	parent := time.Unix(1_700_000_000, 0) // fixed parent instant
+
+	t.Run("idempotent_within_a_slot_off_a_stale_parent", func(t *testing.T) {
+		// A parent 2h stale: slot = 1440. Two rebuilds 1.9s apart land in the SAME slot and
+		// MUST produce the byte-identical timestamp (→ identical envelope id). This is the
+		// property that collapses the unbounded churn to one candidate.
+		base := parent.Add(2 * time.Hour)
+		a := slotSnappedChildTimestamp(parent, base.Add(200*time.Millisecond))
+		b := slotSnappedChildTimestamp(parent, base.Add(2100*time.Millisecond))
+		if !a.Equal(b) {
+			t.Fatalf("NOT idempotent within a slot: %v != %v (churn not eliminated)", a, b)
+		}
+		// And it is exactly on the window grid.
+		if off := a.Sub(parent) % proposer.WindowDuration; off != 0 {
+			t.Fatalf("snapped timestamp %v is not on the WindowDuration grid (offset %v)", a, off)
+		}
+	})
+
+	t.Run("slot_invariant_proposer_window_unchanged", func(t *testing.T) {
+		// For a spread of stale ages, the snapped timestamp MUST map to the SAME slot as the
+		// raw now — this is what guarantees ExpectedProposer returns the identical verdict, so
+		// the fix cannot cause errUnexpectedProposer / errProposerWindowNotStarted.
+		for _, age := range []time.Duration{
+			6 * time.Second, 5*time.Minute + time.Second, time.Hour, 3 * time.Hour,
+		} {
+			now := parent.Add(age)
+			snapped := slotSnappedChildTimestamp(parent, now)
+			if got, want := proposer.TimeToSlot(parent, snapped), proposer.TimeToSlot(parent, now.Truncate(time.Second)); got != want {
+				t.Fatalf("age %v: snapped slot %d != raw slot %d — proposer-window verdict would change", age, got, want)
+			}
+		}
+	})
+
+	t.Run("monotonic_and_not_advanced", func(t *testing.T) {
+		for _, age := range []time.Duration{
+			5 * time.Second, 7 * time.Second, time.Hour,
+		} {
+			now := parent.Add(age)
+			snapped := slotSnappedChildTimestamp(parent, now)
+			if !snapped.After(parent) {
+				t.Fatalf("age %v: snapped %v not strictly after parent %v (errTimeNotMonotonic risk)", age, snapped, parent)
+			}
+			if snapped.After(now) {
+				t.Fatalf("age %v: snapped %v runs ahead of now %v (errTimeTooAdvanced risk)", age, snapped, now)
+			}
+		}
+	})
+
+	t.Run("fresh_in_window_child_unchanged", func(t *testing.T) {
+		// Slot 0 (child < WindowDuration after parent) is the NORMAL live case: no snap, exact
+		// wall-clock (truncated) timestamp — zero behaviour change on a healthy chain.
+		now := parent.Add(3 * time.Second)
+		if got, want := slotSnappedChildTimestamp(parent, now), now.Truncate(time.Second); !got.Equal(want) {
+			t.Fatalf("in-window child was altered: got %v want %v", got, want)
+		}
+	})
+
+	t.Run("clock_before_parent_pins_to_parent", func(t *testing.T) {
+		now := parent.Add(-10 * time.Second)
+		if got := slotSnappedChildTimestamp(parent, now); !got.Equal(parent) {
+			t.Fatalf("now<parent must pin to parent, got %v", got)
+		}
+	})
+}