Anti-entropy: targeted cert-hash backfill instead of coarse 200-round frontier re-pull

[t-bhendarkar]

Summary

Anti-entropy heals missing certs with a coarse frontier (round-range) re-pull, not by the specific missing-parent hashes. To recover a handful of missing parent certs it re-fetches a 200-round window from peers, re-importing certs the node already has. This is an efficiency / recovery-speed gap, not a safety bug.

Problem

node/src/consensus/anti-entropy.js -> _pullFrontierFromPeers():

const fromRound = committed - FRONTIER_RECONCILE_LOOKBACK_ROUNDS;  // 200
syncHandler.syncFromPeer(pid, { fromRound });   // pulls a 200-round range

So recovering a few missing parent certs re-fetches a 200-round range, re-importing certs already present (the repeated Sync: imported 0/N certificates we observe), plus extra libp2p traffic.

What it is / isn't

• NOT a safety bug. Parking has a sound fallback: if a parent is still missing after BULLSHARK_DEFER_MS (60s), bullshark triggers a snapshot resync (onMissingCertsTimeout) rather than force-committing divergent state, so no fork.
• NOT a hard-liveness halt. A lagging node stays caught up; it just carries a parked backlog.
• IS an efficiency / recovery-speed gap. Live example: node4 sat with 15 parked certs ("anchor DAG incomplete, 4-5 parent certs missing") for ~8 min while peers had the certs; frontier re-pull healed it slowly and wastefully.

Proposed fix

Add a targeted "pull these N cert hashes" sync path: when bullshark parks an anchor with a known missingHashes set, ask a peer for exactly those cert hashes instead of (or before) the 200-round frontier sweep. Backfills the gap in one small round-trip with near-zero wasted import. Fall back to the frontier sweep only if the peer doesn't have the requested hashes.

Scope

• node/src/consensus/anti-entropy.js — targeted backfill attempt before the frontier sweep.
• node/src/sync/sync-handler.js + proto — a bounded "fetch certs by hash" request/response.
• bullshark already surfaces the missing-parent set on a parked anchor (onMissingCertsTimeout path).
• Tests: targeted backfill heals a known missing-parent set with 0 wasted imports; falls back to the frontier sweep when the peer lacks the hashes.

Pairs with

• Streaming snapshot install: process frames incrementally instead of buffering the whole snapshot in RAM #132 (streaming snapshot install) — same buffer-the-whole-payload anti-pattern; this cuts sync volume, Streaming snapshot install: process frames incrementally instead of buffering the whole snapshot in RAM #132 streams the install.
• Major Refactor: Node restructure routes, services, middleware, prod hardening #6 / libp2p overhead — removes redundant cert re-pull traffic.
• "anti-entropy recovery gaps" tracking — this is the efficiency half.

Priority

MED. Not blocking (parking + snapshot-resync fallback keep it safe), but the largest remaining churn / CPU / memory reducer in the perf roadmap (Phase B). Natural pairing point to stand up the load-test harness so it can be measured under real tx load.