@leofcoin/chain 1.10.22 → 1.11.0

package/README.md

@@ -18,6 +18,12 @@ from a peer. A pending-only copy cannot act as a provider for the canonical
 transaction store. Responses must use the expected codec and advertised hash;
 the first valid response wins, and unavailable content fails explicitly.
 
+Incoming chain data requests only read the requested local store. Missing,
+private or concurrently removed content receives an empty data response using
+the existing codec and request ID; requesters reject it and can try another
+provider. A local miss never starts a recursive peer fetch, and read/send
+failures are logged without rejecting the transport's detached handler.
+
 Historical ancestry is resolved iteratively, finishing transaction dependencies
 before requesting the next parent. Duplicate callers await the same resolution,
 completed blocks survive retries, and missing or cyclic ancestry fails explicitly.
@@ -27,6 +33,74 @@ Transaction bodies are hash-checked before entering the canonical transaction
 store. Resolving data never applies it: canonical loading still uses the
 serialized state writer and chain-link validation.
 
+## Crash recovery and checkpoints
+
+State snapshots use two alternating, checksummed `checkpoint:0` / `checkpoint:1`
+records. Each record binds the chain ID and canonical tip to the **complete**
+contract state, committed account nonces and financial counters. An interrupted
+write leaves the previous verified slot available. Storage I/O errors propagate;
+if neither existing slot validates, startup refuses readiness rather than
+inventing balances or resetting counters. Preserve that root and rebuild into a
+separate data root when both checkpoints are unrecoverable.
+
+Startup verifies the ancestry of the checkpoint and persisted recovery target,
+restores derived nonces, then replays only the unapplied suffix through the same
+signature, validator, economics and serialized execution path as live blocks.
+A durable recovery target preserves a multi-block replay across another crash.
+The tip is checkpointed before updating the chain marker or announcing success.
+Local transaction bytes are not considered evidence of prior execution;
+committed sender nonces prevent executing a transfer twice.
+
+Older, split `lastBlock` / `states` / `accounts` / `info` snapshots are not trusted
+as coherent checkpoints. On first startup they are rebuilt from their hash-checked
+block ancestry and validated transactions, without removing ledger or identity
+files. Missing historical content or invalid execution stops recovery explicitly.
+No new genesis is required for this local storage change.
+
+Build `@leofcoin/workers` before `@leofcoin/chain` and deploy matching artifacts;
+the worker now exposes a serialized full-snapshot operation and no longer owns a
+separate startup-replay implementation. Process-isolated LevelDB tests exercise
+normal restarts, crashes before/during/after checkpoint writes and marker writes,
+plus invalid producer proofs and execution failures. These tests do not establish
+live multi-peer consensus correctness or protection against arbitrary disk loss.
+
+## Contract calls and read isolation
+
+Public `call(transaction)` now accepts a **signed transaction object**, not the
+old `(contract, method, params)` direct-execution form. `transfer(transaction)`
+likewise requires a signed native-token transfer. Both use `sendTransaction()`:
+admission returns a pending handle; only canonical execution changes state.
+Caller-supplied `hash` metadata is ignored and recomputed from signed content.
+`internalCall(sender, ...)` no longer permits public sender impersonation, and
+native minting is reserved for the monetary protocol. CLI/wallet helpers that
+already sign and submit transactions keep working.
+
+`staticCall(contract, method, params = [])` queries an isolated worker restored
+from the last committed snapshot, with `msg.sender = 'leofcoin:read-only'`.
+It never uses the node's selected account as read authority. Mutating getters
+and methods are rejected when their exported state changes; nested mutating
+`msg.call()` is denied. Results are cloned, so returned references cannot alter
+canonical state or cached results. Private validator snapshot bookkeeping stays
+inside the canonical block writer; name-service lookup uses the read path.
+
+Contract-to-contract `msg.staticCall()` during execution uses a separate read
+worker seeded from the transaction's current in-flight state and retains the
+calling contract as sender. A rejected nested mutation rejects execution; it
+does not mutate the queried canonical contract. Code instrumentation is cached,
+but evaluated classes and closures are reconstructed for each uncached query.
+
+Workers are lazy and reused. Public read queues are capped at 32; queries at
+64 KiB; results and the result cache at 4 MiB (maximum 64 entries). Instrumented
+code caches are bounded to 8 MiB/128 entries. Reads time out after 10 seconds;
+execution metering still applies. A committed snapshot invalidates result caches.
+Use `machine.close()` to release the canonical and both lazy query workers.
+Nested static-call execution rules are stricter than in older runtimes: coordinate
+the rollout across all validators before producing blocks; do not mix execution
+policies within one active network.
+This is state separation, not an OS security sandbox or a full audit of arbitrary
+JavaScript host-escape resistance. Consensus quorum certificates and durable
+validator vote locks remain separate follow-up work.
+
 ## Pending transaction propagation
 
 Transactions enter the local pending pool before canonical confirmation. Peers

package/exports/browser/beacon-wire.js

@@ -1,6 +1,6 @@
-import { s as signTransaction, c as MultiWallet, d as createTransactionHash } from './index-dxD17Fom.js';
+import { s as signTransaction, c as MultiWallet, d as createTransactionHash } from './index-phv5KvaE.js';
 import { f as fromBase58 } from './index-CvKt4UDE.js';
-import './browser-crypto-CH0ua22L.js';
+import './browser-crypto-B_UJguhk.js';
 import './sha2-BKcEJzgd.js';
 
 const validInteger = (value, minimum = 0n) => {

package/exports/browser/{browser-CCfR9KOM-UO9mzy-j.js → browser-CCfR9KOM-CNWKLusu.js}

@@ -1,8 +1,8 @@
-import { g as getDefaultExportFromCjs } from './node-browser-BMfelxXV.js';
-import './browser-crypto-CH0ua22L.js';
+import { g as getDefaultExportFromCjs } from './node-browser-BmyPBkL5.js';
+import './browser-crypto-B_UJguhk.js';
 import './index-CvKt4UDE.js';
 import './sha2-BKcEJzgd.js';
-import './connection-monitor-DMGAhcC0.js';
+import './connection-monitor-BzbeYGEt.js';
 
 function _mergeNamespaces$1(n, m) {
 	m.forEach(function (e) {