Module consensus 

Consensus over CTB, the normal case (W4 step 2; docs/rhdl_ubft-view-change.md). The view change is added on top.

Problem. ubft_new’s leader never sees a fast decision (UN-F4), its slow path needs every replica (N06), it re-reads the decided value from mutable memory after certifying it (UN-F5), and its votes and commits are counted without their view or value (U08, UE-C1).

Idea. One step kernel over one state value, with ports instead of mailboxes:

• PREPAREs and COMMITs arrive as CTB deliveries (consistent: no replica is shown a different one), PROMISEs, FASTCOMMITs and shares point-to-point. Every message names (view, instance, digest), and counts only if that equals the slot’s stored prepare.
• The leader runs the same path as everyone else, so it sees its own decisions; it stays leader for the whole view.
• Fast path: promises from all n, then fast-commits from all n.
• Slow path (after the slot’s deadline): our share goes to the collector and to every replica; with a certificate we CTB a COMMIT, and a replica’s COMMIT counts once we hold the certificate ourselves. q = f + 1 commits decide.
• The decided value is the one stored when the prepare was accepted. Nothing reads it from anywhere else afterwards.
• Decisions leave in instance order, each exactly once.
• A message that cannot be matched yet (its instance is in the window and this view, but our prepare or its digest is not here yet) is not taken: ctb_ready/p2p_ready stay low for it, so it waits in its own source’s channel (the caller’s mux serves the other sources meanwhile) instead of being dropped. Upstream buffers early promises the same way.
• Our own CTB sends are delivered back to us by the caller (upstream handleCbMessage(local_index, ...)), so the leader’s PREPARE and our COMMIT take the same path as everyone else’s.

Modules

kind

Message kinds on CTB and point-to-point channels.

Structs

CSlot

One window slot.

ConsConfig

Configuration.

ConsDigest

A digest answer for (slot, instance).

ConsDigestReq

A digest request: the value-block of (instance, len, value).

ConsIn

Inputs.

ConsKey

Open a collector key, or hand it our own share.

ConsMsg

A message: a CTB delivery or a point-to-point record, from from.

ConsOut

Outputs. Every request is a holding register (unchanged until taken).

ConsSignReq

Sign the share context for (slot, instance).

ConsSigned

Our signed share for (slot, instance).

ConsState

State.

Constraint

A safe value fixed by a NEWVIEW for one window slot.

Decision

One decision.

Install

Enter view with its safe values (from the view change), or, with skip, enter it without a NEWVIEW: its leader never delivered one in time, so nothing can be prepared or committed in it, and it will be sealed in turn (as upstream advances the view at sealing).

Proposal

A proposal from the client side (the leader takes it).

SlotView

What the view change sees of a window slot.

Functions

cons_step

One cycle of the normal case.

empty_constraint

No constraint, for kernels.

empty_cslot

A cleared slot, for kernels.

idle_decision

An idle decision, for kernels.

idle_key

An idle key, for kernels.

idle_msg

An idle message, for kernels.

leader_of

leader(view) = view mod n, without % (n ≤ 16, view < 2^32).