extract_consensus_splits (src/ts_pool.cpp:312-318) deduplicates/counts splits keyed on
hash_single_split alone (a 64-bit hash), with no bitset comparison to confirm two matching
hashes are actually the same split. A hash collision would merge two distinct splits' counts,
potentially pushing a non-unanimous split's count over the n_best threshold and promoting it
into auto_cd at src/ts_driven.cpp:1018 — feeding directly into the freeze mechanism described
in issue #64 (RT-A13-04), but via a wrong-split rather than a wrong-gate route.
Severity
Collision probability is negligible in practice (~n_splits² · n_best² / 2^64), so this is a
theoretical/completeness finding, not a demonstrated live bug. Recorded because the failure mode
it would produce (a wrong node incorrectly locked as a consensus constraint) is real and matches
#64's blast radius exactly.
Fix direction
Compare the actual split bitsets on hash match before treating two entries as identical, matching
the pattern presumably already used elsewhere for split equality (splits_equal /
hash_splits, per prior red-team rounds' references to order-independent split hashing).
extract_consensus_splits(src/ts_pool.cpp:312-318) deduplicates/counts splits keyed onhash_single_splitalone (a 64-bit hash), with no bitset comparison to confirm two matchinghashes are actually the same split. A hash collision would merge two distinct splits' counts,
potentially pushing a non-unanimous split's count over the
n_bestthreshold and promoting itinto
auto_cdatsrc/ts_driven.cpp:1018— feeding directly into the freeze mechanism describedin issue #64 (RT-A13-04), but via a wrong-split rather than a wrong-gate route.
Severity
Collision probability is negligible in practice (~
n_splits² · n_best² / 2^64), so this is atheoretical/completeness finding, not a demonstrated live bug. Recorded because the failure mode
it would produce (a wrong node incorrectly locked as a consensus constraint) is real and matches
#64's blast radius exactly.
Fix direction
Compare the actual split bitsets on hash match before treating two entries as identical, matching
the pattern presumably already used elsewhere for split equality (
splits_equal/hash_splits, per prior red-team rounds' references to order-independent split hashing).