#45 Stage 7: real SP tx declines local send path bridge-off (parser mismatch + uncovered maxPriorityFeePerGas dep)

[Reiers]

Summary

The first live --vm-bridge-rpc-disable attempt on cc-smoke (2026-06-15) caught a real curio SP CreateDataSet tx that failed bridge-off. Stage 4/5 handlers are correct in isolation (unit + synthetic-tx live proof), but the real SP send flow exposed two concrete gaps that must close before bridge-off can work on a writing SP. Spun out of #45 so the write-path tracker stays clean.

Evidence (cc-smoke, calibration, 2026-06-15 15:07:44 UTC)

ERROR rpc  error in RPC call to 'eth_sendRawTransaction': FEVM method requires --vm-bridge-rpc pointing at a Forest/Lotus node
INFO  curio/message sender_eth.go:470  sent transaction  {"hash":"0x000...0", "task_id":40002, "send_error":"send error: FEVM method requires --vm-bridge-rpc...", "poll_loops":6}
ERROR pdpv0 handlers_create.go:137  Failed to send transaction: ...

The SP's SenderETH.Send hit errBridgeUnconfigured, meaning our local EthSendRawTransaction path declined and fell through to the (disabled) bridge. No local path declined, bridging debug line fired.

Ruled out

• Not a dual-ChainAPI bug: single instance (start.go:108), Mpool wired synchronously in startGossipHead before rpcserver.New binds (:261), ethAPI.EthSendRawTransaction → e.full.EthSendRawTransaction confirmed.
• Not a boot race: tx was ~5 min post-boot; gossipsub mempool publisher wired logged at boot.

Item 1 — local send declines on the real curio tx encoding

The curio SenderETH builds the tx as a go-ethereum types.DynamicFeeTx → MarshalBinary (see curio tasks/message/sender_eth.go). Our synthetic test tx round-trips through ParseSignedEIP1559 fine, but the real one declined (parse/convert failed, or hex decode returned derr != nil and skipped the block silently).

Suspected mismatch: access-list encoding (EIP-2930 list present/empty), v/r/s signature normalization, or chainID placement in our RLP decoder vs go-ethereum's canonical 0x02 || rlp([...]) envelope.

To do:

• Add per-branch decline logging at the top of EthSendRawTransaction (distinct lines for: hex-decode fail, Mpool == nil, ParseSignedEIP1559 err, ToSignedFilecoinMessage err) so the next bridge-off window pinpoints the exact branch.
• Capture one real SP raw-tx hex (bridge-on, log the raw bytes in SenderETH or sniff the bridge call) and round-trip it offline through ParseSignedEIP1559 → fix the decoder to accept it.
• Add a regression test in chain/ethtx using a real captured curio DynamicFeeTx payload.

Item 2 — eth_maxPriorityFeePerGas is an UNCOVERED write-path bridge dependency

The SP's full pre-send chain (curio sender_eth.go):

EstimateGas        -> eth_estimateGas            (#45 Stage 2, LOCAL ✅)
HeaderByNumber(nil) -> eth_getBlockByNumber latest (base fee; should be LOCAL)
SuggestGasTipCap   -> eth_maxPriorityFeePerGas   (STILL BRIDGE-ONLY ❌)
NetworkID          -> eth_chainId / net_version  (LOCAL ✅)
SendTransaction    -> eth_sendRawTransaction     (#45 Stage 4, see Item 1)

SuggestGasTipCap → eth_maxPriorityFeePerGas is still bridge-only. This means Stage 6 is not lower-priority — it is directly on the write path and must be local before any bridge-off succeeds, even after Item 1 is fixed.

To do:

• Implement local eth_maxPriorityFeePerGas (conservative tip estimate from recent tipset base-fee trend, or a safe floor). Over-estimate is acceptable; under-estimate is the hazard, same invariant as estimateGas.
• Confirm eth_getBlockByNumber("latest") returns a non-nil baseFee locally (the SP needs header.BaseFee); add to the bridge-off coverage checklist.

Acceptance / re-test gate

• Both items fixed + unit-tested.
• Re-run the cc-smoke bridge-off window and observe a real SP CreateDataSet (or Prove) tx published locally, landed on-chain, and confirmed by the TRUST-MODEL.md §2.1 overstates header validation (claims election-proof verify; code checks presence only) #81 watcher with --vm-bridge-rpc-disable and zero bridge errors.
• Only then is the zero-Glif write path real on calibration.

Refs

• Parent write-path tracker: Local FEVM write path — the zero-Glif keystone (estimateGas/nonce/sendRawTx/receipt) #45
• Status overview: Lantern — status overview #24
• curio-core mirror: Curio Core — status overview curio-core#10
• Rollback verified safe; cc-smoke stays on v0.1.0-wp45b (bridge-on).

[Reiers]

Update — live faucet testing corrected the diagnosis (Item 1 was wrong)

Using the Plumbline calibration faucet I drove a real funded tx end-to-end through cc-smoke's local RPC. Findings:

✅ The write path WORKS on the real go-ethereum encoding

• Captured a real types.DynamicFeeTx → MarshalBinary (exactly how curio SenderETH builds it) and fed it to ParseSignedEIP1559: parses cleanly, TxHash byte-identical to go-ethereum, ToSignedFilecoinMessage produces correct f410 addrs + Method=InvokeContract + Delegated sig. So Item 1 (parser mismatch) was a wrong hypothesis — the codec is fine.
• Live on cc-smoke: a real funded signed tx → eth_sendRawTransaction published locally (no bridge), → landed on-chain at block 3807078, → eth_getTransactionReceipt resolved locally. Full nonce→sign→send→confirm loop proven local + on-chain.

So what caused the 15:07 bridge-off decline?

A transient c.Mpool == nil at that call moment — the old code skipped the local block silently when Mpool was nil (no log). Fixed in v1.7.8: eth_sendRawTransaction now logs every decline branch distinctly, and mpool not wired is a loud WARN. If it recurs we'll see exactly why.

Remaining real work for bridge-off (Item 2 still stands)

• eth_maxPriorityFeePerGas (SuggestGasTipCap) is still bridge-only and on the SP pre-send path. This is the genuine remaining blocker.
• Plus the placeholder-balance bug found in the same session: eth_getBalance returns 0 for placeholder (received-only) Eth accounts — only resolves via InitActor map #48 (not a write-path blocker, but a correctness gap).

Updating scope: Item 1 closed (codec verified good), Item 2 (maxPriorityFeePerGas) is the live bridge-off blocker.

[Reiers]

Real funded bridge-off test (faucet) — send PROVEN on-chain, receipt blocked by #49

Drove real funded txs through cc-smoke with --vm-bridge-rpc-disable:

✅ Send path: PROVEN zero-Glif end-to-end

A funded EOA transfer was published locally (no bridge) and LANDED on chain — sender debited, recipient (0x…dEaD) credited, confirmed via Glif. The fee chain is fully local (eth_maxPriorityFeePerGas=0x0, eth_gasPrice now live base fee via v1.7.10, eth_estimateGas local, nonce local). Item 2 (maxPriorityFeePerGas) resolved — it was already local.

❌ Receipt path: blocked by a newly-found AMT-decode bug → #49

eth_getTransactionReceipt for the (confirmed-on-chain) tx fell to the bridge because StateSearchMsg fails decoding the block's BLS message AMT: loading AMT root: cbor input had wrong number of fields. The tx is on chain (Glif resolves it); Lantern just can't decode the message AMT to find it. Filed as #49 with root-cause analysis.

Also fixed this session

• eth_getBalance returns 0 for placeholder (received-only) Eth accounts — only resolves via InitActor map #48 (closed): eth_getBalance was reading the boot TrustedRoot, not the live head → post-boot accounts read 0. Now live-anchored, verified byte-identical to Glif.
• v1.7.8: eth_sendRawTransaction decline paths are now observable (the original silent nil-Mpool trap).

Net for bridge-off

The write/send path is real (proven on-chain bridge-off). The remaining hard blocker is #49 (local receipt resolution). Once #49 lands, a full send→confirm loop runs zero-Glif and --vm-bridge-rpc-disable is viable for a writing SP. Keeping #46 open as the umbrella until #49 closes + a clean end-to-end bridge-off send+confirm passes.

[Reiers]

#49 fixed → write path now resolves receipts LOCALLY bridge-off ✅

With Lantern v1.7.12 (#49 v2-AMT decode fix), the full write loop ran zero-Glif on cc-smoke:

• send → published locally (no bridge), landed on-chain
• eth_getTransactionReceipt → resolved locally, byte-identical to Glif (blockNumber 0x3a1819, status 0x1, gasUsed 0x1a6a52)

The earlier receipt decline was two stacked issues, both now understood:

1. AMT decode (StateSearchMsg fails decoding block message AMT ('cbor input had wrong number of fields') — blocks local eth_getTransactionReceipt #49) — fixed. StateSearchMsg now walks legacy v2 message/receipt AMTs.
2. Transient block-availability — a message block not yet in the embedded Bitswap cache; resolves on a 3-5s retry (same class as Embedded state-block availability for local eth_call (last blocker for --vm-bridge-rpc-disable) #44 state availability, not an engine bug).

Remaining before a clean unconditional bridge-off

• In-memory sent-tx index survives only one daemon lifetime. A restart between send and receipt loses the eth-hash→msgCID map (the receipt then bridges). Real curio doesn't restart mid-flight, so this isn't a runtime blocker, but for a durable guarantee the index should be persisted or reconstructable. Tracked alongside mpool: pending-tx confirm + rebroadcast loop (published-but-unmined messages silently stall) #47.
• A sustained bridge-off soak over a full proving window (the discipline gate, not code).

The send/confirm halves are both proven local now. #46 stays open only as the umbrella for the soak + index-persistence polish.