Module view_change 

The view change (W4 steps 3–4; docs/rhdl_ubft-view-change.md): uBFT Algorithm 5 with every NEWVIEW check upstream leaves out.

Problem. ubft_new’s views are local only and never synchronize (UN-F3); its recovery takes the highest self-reported proposal (N14). The original accepts a NEWVIEW from anyone (U02), at any time and more than once (U03, U06), with one replica’s history counted repeatedly (U04), from any sealed view (U05), and never starts a view change by itself (U13).

Idea. A step kernel beside the consensus kernel (crate::consensus):

1. Records. For every replica r it keeps, per window slot, the latest COMMIT r CTB-broadcast (view, instance, digest, value), with a flag set once that COMMIT’s certificate is held here.
2. Seal. On the consensus kernel’s stalled, or SEALVIEW from f + 1 others for this view, it asks the consensus kernel to seal (the bridge certifies our fast commits) and then CTB-broadcasts SEALVIEW(v), the view named explicitly.
3. History shares. When r’s SEALVIEW(v) is delivered and every one of r’s records is certified, it digests r’s records (a hash chain, one SHA-512 job per record) and signs HISTORY(v, r, digest) (role 4). A replica whose records never all certify is never vouched for (upstream busy-waits, then crashes on an invalid one).
4. NEWVIEW. leader(v + 1) broadcasts NEWVIEW(v + 1, subjects) once q subjects’ histories are certified here. A receiver takes it only from leader(v + 1) (U02), only for v + 1 and only once (U03, U06, UE-C6), with exactly q distinct in-range subjects (U04, UE-C8), and only when each subject’s certificate is for sealed view v and its own digest of that subject’s records (U05, U01). Until then it waits.
5. Safe values. Per slot, the record with the highest view among the subjects; two different digests at the highest view refuse the NEWVIEW. The consensus kernel installs them.

Modules

kind

CTB message kinds of the view change (after the consensus kinds).

Structs

Link

Which link of which history: the sealed view, the subject, the record.

Record

One record of replica r’s commits.

VcConfig

Configuration.

VcDigest

Its answer (the first 32 bytes, little-endian words).

VcDigestReq

A digest job of the history chain, for (subject, j).

VcIn

Inputs.

VcKey

A history-collector key (instance is the subject), or our share.

VcOut

Outputs (requests are holding registers).

VcSignReq

Sign HISTORY(v, subject, digest).

VcSigned

Our signature for subject’s history.

VcState

State.

Constants

HIS_DOMAIN

"RUB2-HIS" as a little-endian word.

Functions

empty_record

An empty record, for kernels.

history_block

One link of a history chain: 128 bytes, "RUB2-HIS" ‖ session ‖ view ‖ subject ‖ j ‖ flags ‖ h_j ‖ record view ‖ record instance ‖ record digest ‖ len ‖ value (P ≤ 4 words) ‖ 0, as big-endian SHA-512 words. flags is 1 for a valid record, 0 for an empty slot.

idle_install

An idle install, for kernels.

r_all

The mask of ids below n.

vc_idle_msg

An idle CTB message, for kernels.

vc_step

One cycle of the view change.