db/state: clip merge windows that straddle existing files

When the natural merge start (endTxNum minus the largest power-of-two
step span) falls strictly inside an existing visible file, bump it up
to that file's endTxNum so the candidate window cannot straddle.
Without this clip, non-power-of-2 step layouts — such as those produced
by a step-size rebase that turns one step into a non-power-of-2 number
of tx-nums — let the algorithm propose merge windows whose `from` lies
inside a pre-existing file. Downstream staticFilesInRange would then
silently drop that file and emit a merged segment whose name lies about
its coverage, leaving an overlap with the surviving straddler.

Unskip partial_overlap_must_not_be_selected (which now passes), and add
step_rebase_swallow covering the headline case where a single-step file
arriving at N=2_048_000 has natural span 16384 / natural start 2031616
that straddles [2016000, 2032000). After the clip the safe window
{2032000, 2048000} cleanly absorbs 15 trailing files.

Author: wmitsuda

db/state/merge.go

@@ -136,6 +136,13 @@ func calculateMergeStartTxNum(endTxNum, stepSize, maxSpan uint64) uint64 {
 // Accounts/Storage/Commitment domain frontiers aligned. Files past it aren't yet
 // merge candidates — going further would let one entity drift ahead of the others.
 //
+// When the natural start (endTxNum minus the largest power-of-two step span)
+// falls strictly inside an existing visible file, the window is clipped so its
+// from aligns with that file's endTxNum boundary. Without this clip, on
+// non-power-of-2 step layouts (e.g. after a step-size rebase) the algorithm
+// would propose windows straddling an existing file, producing misnamed merged
+// files and/or overlapping coverage. See #20878.
+//
 // When superSetCheck is true (history & inverted index), a file matching the
 // candidate's from and reaching at least its to replaces the candidate's bounds
 // but resets needMerge to false, letting later smaller-but-still-mergeable files
@@ -146,7 +153,7 @@ func findMergeRangeInFiles(files visibleFiles, stepSize, maxEndTxNum, maxSpan ui
 		if item.endTxNum > maxEndTxNum {
 			continue
 		}
-		start := calculateMergeStartTxNum(item.endTxNum, stepSize, maxSpan)
+		start := clipMergeStartToFileBoundary(files, calculateMergeStartTxNum(item.endTxNum, stepSize, maxSpan))
 		if superSetCheck && r.from == item.startTxNum && item.endTxNum >= r.to {
 			r.needMerge = false
 			r.from = start
@@ -166,6 +173,24 @@ func findMergeRangeInFiles(files visibleFiles, stepSize, maxEndTxNum, maxSpan ui
 	return r
 }
 
+// clipMergeStartToFileBoundary bumps start up to the endTxNum of any visible
+// file that straddles it (startTxNum < start < endTxNum). visibleFiles are
+// non-overlapping, so at most one straddling file can exist; the loop returns
+// as soon as it is found. Files are sorted by endTxNum ascending, so the first
+// file with endTxNum > start is the only straddler candidate.
+func clipMergeStartToFileBoundary(files visibleFiles, start uint64) uint64 {
+	for _, f := range files {
+		if f.endTxNum <= start {
+			continue
+		}
+		if f.startTxNum < start {
+			return f.endTxNum
+		}
+		return start
+	}
+	return start
+}
+
 // findMergeRange
 // make merge determenistic across nodes: even if Node has much small files - do earliest-first merges
 // As any other methods of DomainRoTx - it can't see any files overlaps or garbage

db/state/merge_test.go

@@ -869,19 +869,11 @@ func TestFindMergeRangeInFiles(t *testing.T) {
 	t.Run("partial_overlap_must_not_be_selected", func(t *testing.T) {
 		// [0, 1024), [1024, 1536), [1536, 1600), [1600, 1618), [1618, 1620), [1620, 1621), [1621, 1622) ->
 		// [0, 1024), [1024, 1536), [1536, 1600), [1600, 1618), [1618, 1620), [1620, 1622)
-		// CORRECT BEHAVIOR: the {1616, 1620} window proposed by [1618, 1620) straddles the
-		// pre-existing [1600, 1618) (its startTxNum 1600 < window's from 1616). Selecting that
-		// window would either drop coverage of [1616, 1618) or create an overlap once
-		// staticFilesInRange filters [1600, 1618) out. The algorithm should skip this unsafe
-		// window and instead pick the trailing pair's safe window {1620, 1622}.
-		//
-		// TODO(#20878): findMergeRangeInFiles currently picks {1616, 1620} regardless.
-		// The "Flexible merge ranges" proposal in https://github.com/erigontech/erigon/issues/20878
-		// fixes this by clipping the candidate window's `from` to the smallest visible
-		// startTxNum >= the natural from, so a window can never straddle an existing file.
-		// Once that lands, unskip this test.
-		t.Skip("known pathology: findMergeRangeInFiles selects a window straddling an existing file; see #20878")
-
+		// The {1616, 1620} window proposed by [1618, 1620) would straddle the pre-existing
+		// [1600, 1618) (its startTxNum 1600 < window's from 1616). clipMergeStartToFileBoundary
+		// bumps the start up to 1618; the resulting [1618, 1620) is then rejected as
+		// already-aligned, and the next iteration picks the safe trailing pair {1620, 1622}.
+		// See #20878.
 		files := visibleFiles{
 			f(0, 1024),
 			f(1024, 1536),
@@ -898,6 +890,62 @@ func TestFindMergeRangeInFiles(t *testing.T) {
 		assert.Equal(t, uint64(1622), mr.to)
 	})
 
+	t.Run("step_rebase_swallow", func(t *testing.T) {
+		// File boundaries here are not power-of-2 aligned: they're the original canonical
+		// boundaries (1024, 1536, ..., 2046, 2047) multiplied by 1000, as would result from
+		// a step-size rebase that changes one step into 1000 tx-nums. None of the resulting
+		// endTxNums (1024000, 1536000, ..., 2047000) sit on a power-of-2 boundary, so the
+		// merge algorithm's "largest aligned span ending at endTxNum" can fall strictly
+		// inside an existing file.
+		//
+		// Past 2047000, single-step files [N-1, N) accumulate. They merge cleanly among
+		// themselves whenever their endTxNum has a rightmost-set-bit span that fits inside
+		// the post-2047000 region — that gives the binary tree of files below.
+		//
+		// The interesting moment is N=2048000. Its natural span is 16384 (2048000 = 125 *
+		// 2^14, rightmost bit 2^14), giving natural start 2031616. That start lands inside
+		// [2016000, 2032000): selecting {2031616, 2048000} as a merge window would either
+		// drop coverage of [2016000, 2031616) or produce a file that overlaps [2016000,
+		// 2032000). The clip bumps start up to 2032000 — the next safe boundary — producing
+		// {2032000, 2048000}. That window cleanly absorbs the four trailing rebased files
+		// at and above 2032000, the eight post-2047000 files, and the three latest
+		// singletons (15 files into 1) without touching the still non-canonical
+		// [2016000, 2032000) on its left.
+		const maxSpan = uint64(1 << 20) // 1048576, large enough for the natural 16384 span
+		files := visibleFiles{
+			// Rebased canonical-step boundaries (×1000).
+			f(0, 1024000),
+			f(1024000, 1536000),
+			f(1536000, 1792000),
+			f(1792000, 1920000),
+			f(1920000, 1984000),
+			f(1984000, 2016000),
+			f(2016000, 2032000),
+			f(2032000, 2040000),
+			f(2040000, 2044000),
+			f(2044000, 2046000),
+			f(2046000, 2047000),
+			// Binary expansion of the post-2047000 region by N=2047996.
+			f(2047000, 2047488),
+			f(2047488, 2047744),
+			f(2047744, 2047872),
+			f(2047872, 2047936),
+			f(2047936, 2047968),
+			f(2047968, 2047984),
+			f(2047984, 2047992),
+			f(2047992, 2047996),
+			// Latest singletons added at N=2047997, 2047998, 2047999, 2048000.
+			f(2047996, 2047998),
+			f(2047998, 2047999),
+			f(2047999, 2048000),
+		}
+		mr := findMergeRangeInFiles(files, stepSize, 2048000, maxSpan, false)
+		assert.True(t, mr.needMerge)
+		assert.Equal(t, uint64(2032000), mr.from,
+			"natural start 2031616 must be clipped up to 2032000 to avoid straddling [2016000, 2032000)")
+		assert.Equal(t, uint64(2048000), mr.to)
+	})
+
 	// --- superSetCheck (history / inverted-index branch) ---
 
 	t.Run("superSetCheck_resets_when_existing_file_covers_candidate", func(t *testing.T) {