staking: curate consensus set at epoch boundary

[erwanor]

Close #3854 - the idea here is to eliminate concerns about validator manipulating state transitions to hop out of the consensus set, and escape end-epoch processing.

The way we achieve this is by forcing every validator identity in the index to be processed at least once before being removed.

[cratelyn]

small logging question below..

[hdevalence]

I'm not totally sure I follow the logic here.

My understanding of the original issue was that not that a validator could "escape" end_epoch processing but that they could toggle their validator on and off to trigger additional epoch changes.

Wouldn't making it so that disabled validators have to wait to turn back on prevent that problem, in a more simplified and isolated way?

EDIT: ah, maybe i am confused and thinking of a different issue...

[erwanor]

That's a different issue, and I'm not sure I follow what the suggested fix is for:

Wouldn't making it so that disabled validators have to wait to turn back on prevent that problem, in a more simplified and isolated way?

The problem this PR solves is that the set of validators we need to process and the set of validators we index can diverge. This happens because we made the state machine implementation manage indexing/deindexing directly. Instead of having to carefully arrange the entire staking component to make sure that we do this correctly, it is actually much simpler to have the end-epoch processor decide if an identity can be deindexed.

[hdevalence]

Yes, I got issues confused, that is not a fix for this issue, sorry for the noise.

[erwanor]

Ok I also misread your proposed fix, I think I see what you mean - yes that's the plan, every validator, regardless of state waits the unbonding epoch in block time

On second read, I realize the fix is for another issue altogether: it's about adding a cooldown to reactivate a disabled validator to increase the marginal cost of performing #3738