Kills the bug CLASS behind the α-of-K finality wedge (v1.30.65), not just the
one Gossip instance. The chain router (node/chain_router.go) forwards an inbound
message only if message.ToConsensusOp maps it, then dispatches on the router op;
the node op table and the consensus router op enum are two halves of ONE routing
contract. When they diverged — router.Gossip existed but no node op mapped to it
— every broadcast vote was dropped as "unhandled message op" and finality
wedged, with nothing to catch it.
- ToConsensusOp now returns the router constants (byte(router.Get) ...) instead
of 0..11 magic numbers, so values cannot drift and the table reads as the
correspondence it is. Bumps consensus v1.25.29 -> v1.25.30 (adds router.NumOps,
the single source of truth for the op count).
- message/ops_test.go TestToConsensusOp_TableAlignedWithRouter is now EXHAUSTIVE
and BIDIRECTIONAL: it reconstructs the inverse mapping over the whole node op
space and requires a bijection onto [0, router.NumOps). A router op with no
node preimage (the original bug), a collision, a wrong target, or a stray
mapping all go RED. Pinned to router.NumOps, so a future op added to one table
but not the other fails the test instead of at runtime. Proven RED against the
original bug (drop the GossipOp case -> router.Gossip loses its preimage ->
fail); folds in the old Gossip-specific and hand-listed table checks.
Build rc=0 (GOWORK=off go build ./...); message tests green; finality fix
(GossipOp -> router.Gossip -> blockHandler.Gossip) unchanged and still covered.
The α-of-K quorum vote/cert transport rides on app-gossip (GossipOp), but
GossipOp was never added to the chain router's consensus-op table
(message.ToConsensusOp) nor to blockHandler.HandleInbound's switch. So every
inbound vote was dropped at node/chain_router.go as "unhandled message op"
before it could reach blockHandler.Gossip -> engine.HandleIncomingVote. Blocks
ride PutOp (mapped) and propagated+verified on all validators; votes ride
GossipOp (unmapped) and vanished. Each node held only its own self-vote, the
cert never reached alpha, and every chain wedged at height N: "verified but
never accepted", no vote/cert/accept activity.
This is the fork divergence from avalanchego, where votes are Chits — a
first-class consensus op always in the router table (snow/engine/snowman
engine.go Chits -> voter -> topological.RecordPoll -> accept). Lux moved votes
onto app-gossip but left the node-side op routing incomplete; the consensus
repo already reserved router.Gossip=11 'routed via the blockHandler Gossip
method' (core/router/router.go) — only the node wiring was missing.
Fix (node-only; safety core untouched — this is purely liveness):
- message.ToConsensusOp: map GossipOp -> 11 (router.Gossip)
- blockHandler.HandleInbound: add case handler.Gossip -> b.Gossip(...)
b.Gossip already demuxes the quorum envelope (Mode-gated) into
HandleIncomingVote / HandleIncomingCert; the signed-vote verify + verified-2/3
-stake cert assembly are unchanged, so honest votes now reach the assembler
without weakening VerifyWeighted or the unforgeable cert.
Regression guard (message/ops_test.go): GossipOp must map to router.Gossip, the
full op table must stay aligned with the consensus router, and an inbound vote
gossip must survive router extraction (op + envelope bytes) intact.
zeekay