Running-head fork choice: heaviest-ParentWeight + periodic re-quorum (not boot-only)

[Reiers]

Problem

The boot-time anchor runs a strong defense (5-of-N independent-source quorum on the F3-finalized tipset, see chain/bootstrap), but it runs once at install / boot. Past the anchor, the running head is followed over gossipsub by net/blockingest, which advances head on height-fence + parent-linkage only — no re-quorum, no weight comparison.

This is the gap zenground0 (FilOz) raised in the fil-curio-dev thread (2026-06-30): an attacker who eclipses the gossip peer table can feed parent-linked, height-advancing blocks and walk a node onto a valid-but-non-canonical fork on the unfinalized tip. Content addressing does not catch it — the attacker's blocks hash fine, they're just not the canonical chain.

Proposed fix (pure-Go, no ffi, no one-binary-constraint impact)

1. Heaviest-ParentWeight fork choice on the running head. Replace the bare "height advanced" head-advance rule in net/blockingest with Filecoin's actual fork-choice rule: only adopt a competing head if it has strictly greater ParentWeight. The weight logic already exists in chain/anchorverify (boot path) — lift/extend it to the live head. ParentWeight is a header field, so this needs no proof verification, no ffi.
2. Periodic re-quorum of the live head. Re-run the multi-source agreement check (chain/bootstrap quorum) against the running head on a cadence (not just at boot), so the live head must keep clearing N-independent-source agreement. An attacker then has to eclipse the gossip mesh and simultaneously control ≥quorum of the independent sources.

What this does NOT do

Does not close the unfinalized-tip fork problem against a powerful adversary with real storage power genuinely splitting consensus. That is a finality problem; the answer is F3 (separate, network-layer). This issue is strictly about raising the cost of the cheap peer-table eclipse without touching Lantern's no-CGo / no-ffi / one-binary laws.

Acceptance

• net/blockingest adopts a competing head only on strictly-greater ParentWeight (with parent-linkage + height still enforced)
• Live head periodically re-verified against multi-source quorum; loud warn + no-adopt on disagreement
• Unit tests: competing-fork-with-lower-weight rejected; higher-weight adopted; quorum-disagreement on live head warns and holds

Context: fil-curio-dev thread w/ zenground0, 2026-06-30. Related: #76, security-anchor design in chain/anchorverify.

[Reiers]

Part 1 (heaviest-ParentWeight fork choice on the running head) shipped in v1.8.5 (PR #84). Remaining/deferred: periodic live-head re-quorum (re-run the multi-source agreement against the running head on a cadence, not just at boot). Keeping this issue open scoped to that follow-up.

[Reiers]

2026-07-01 — acceptance complete (commit b492dec)

All three acceptance items are now satisfied:

• Heaviest-ParentWeight fork choice — net/blockingest.process adopts a competing head only on strictly-greater ParentWeight (height fence + parent linkage still enforced). Shipped with the Chain-Head Reliability #85/feat(#85): header-propagation integrity gate + running-head divergence monitor #86 head-reliability work; RejectedLighter stat + TestIngestor_ForkChoiceRejectsLighterFork/...AcceptsHeavierAdvance.
• Live head periodically re-verified against multi-source quorum; loud warn + no-adopt on disagreement — chain/headcheck already does the periodic Kind-diverse quorum + loud warn (OnResult). This commit adds the no-adopt half: Ingestor.SetHeadAdoptionGate(fn). While headcheck reports StatusDiverge, the gate closes and the ingestor holds head (keeps receiving + backfilling, but won't walk head onto an uncorroborated tip); it reopens on StatusAgree. StatusInsufficient deliberately leaves the gate OPEN so a lightly-corroborated node never freezes. New HeldDiverged stat.
• Unit tests — lighter-fork rejected; heavier adopted; gate-closed holds a valid heavier head; gate-reopened adopts; nil gate always adopts.

Design note: the gate is a pure predicate on the Ingestor, wired by the daemon to the monitor via an atomic bool — zero cost on Light/PDP (nil gate). No ffi, no one-binary-law impact, consistent with the issue's constraints.

The unfinalized-tip fork problem against a real-power adversary remains a finality (F3) concern, explicitly out of scope per the issue.

Commit b492dec on branch fix/lightnode-messages-2026-07-01. Full module CGO-off build/vet/gofmt/tests green. Suggest closing after the calibration observe run confirms the gate doesn't false-close against normal source lag.