@typeberry/lib 0.8.4-7a69737 → 0.8.4-7cde74e

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typeberry/lib",
-  "version": "0.8.4-7a69737",
+  "version": "0.8.4-7cde74e",
   "description": "Typeberry Library",
   "main": "./bin/lib/index.js",
   "types": "./bin/lib/index.d.ts",
@@ -244,6 +244,8 @@
     "#@typeberry/state-merkleization/*": "./packages/jam/state-merkleization/*",
     "#@typeberry/state-vectors": "./packages/jam/state-vectors/index.js",
     "#@typeberry/state-vectors/*": "./packages/jam/state-vectors/*",
+    "#@typeberry/ticket-pool": "./packages/jam/ticket-pool/index.js",
+    "#@typeberry/ticket-pool/*": "./packages/jam/ticket-pool/*",
     "#@typeberry/transition": "./packages/jam/transition/index.js",
     "#@typeberry/transition/*": "./packages/jam/transition/*",
     "#@typeberry/disputes": "./packages/jam/transition/disputes/index.js",

package/packages/jam/jamnp-s/tasks/ticket-distribution.d.ts

@@ -1,6 +1,7 @@
 import type { Epoch } from "#@typeberry/block";
 import type { SignedTicket } from "#@typeberry/block/tickets.js";
 import type { ChainSpec } from "#@typeberry/config";
+import { type TicketValidator } from "#@typeberry/ticket-pool";
 import type { Connections } from "../peers.js";
 import type { StreamManager } from "../stream-manager.js";
 /**
@@ -9,33 +10,40 @@ import type { StreamManager } from "../stream-manager.js";
  * Uses CE-132 (proxy-to-all) for direct broadcast to all peers.
  * Implements a maintain pattern similar to SyncTask: tickets are collected
  * and periodically distributed to peers that haven't received them yet.
+ *
+ * Incoming tickets from peers are first run through a {@link TicketValidator};
+ * only validated tickets are added to the redistribution pool. The default
+ * validator denies everything, so callers must wire a real one via
+ * {@link setTicketValidator} before any networked ticket can be redistributed.
  */
 export declare class TicketDistributionTask {
     private readonly streamManager;
     private readonly connections;
     static start(streamManager: StreamManager, connections: Connections, chainSpec: ChainSpec): TicketDistributionTask;
-    /** Pending tickets waiting to be distributed to peers */
-    private pendingTickets;
-    /** Current epoch being tracked (cleared when epoch changes) */
-    private currentEpoch;
+    private readonly pool;
+    private validator;
     private constructor();
     /**
      * Should be called periodically to distribute pending tickets to connected peers.
      */
     maintainDistribution(): void;
     /**
-     * Add a ticket to the pending queue for distribution.
+     * Add a ticket to the redistribution pool.
      * Clears pending tickets when epoch changes.
      * Deduplicates tickets based on signature.
      */
     addTicket(epochIndex: Epoch, ticket: SignedTicket): void;
-    private onTicketReceivedCallback;
     /**
-     * Register a callback that validates a received ticket.
-     * The ticket is only added to the redistribution pool if the callback returns `true`.
-     * This prevents redistribution of invalid tickets (e.g. those with a tampered `attempt` field).
+     * Replace the redistribution pool for the given epoch with the supplied tickets.
+     * Used when the authorship worker dumps the authoritative pool on an epoch boundary.
+     */
+    replacePool(epochIndex: Epoch, tickets: readonly SignedTicket[]): void;
+    /**
+     * Register the validator that decides whether tickets received from peers should be
+     * accepted (and therefore redistributed). The default is {@link DenyTicketsValidator},
+     * so the caller must install a real validator for any peer ticket to make it through.
      */
-    setOnTicketReceived(cb: (epochIndex: Epoch, ticket: SignedTicket) => Promise<boolean>): void;
+    setTicketValidator(validator: TicketValidator): void;
     private onTicketReceived;
 }
 //# sourceMappingURL=ticket-distribution.d.ts.map

package/packages/jam/jamnp-s/tasks/ticket-distribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ticket-distribution.d.ts","sourceRoot":"","sources":["../../../../../../packages/jam/jamnp-s/tasks/ticket-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAe1D;;;;;;GAMG;AACH,qBAAa,sBAAsB;IAuB/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAvB9B,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS;IAgBzF,yDAAyD;IACzD,OAAO,CAAC,cAAc,CAA0D;IAChF,+DAA+D;IAC/D,OAAO,CAAC,YAAY,CAAsB;IAE1C,OAAO;IAKP;;OAEG;IACH,oBAAoB;IAkDpB;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY;IAsCjD,OAAO,CAAC,wBAAwB,CAAgF;IAEhH;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC;IAIrF,OAAO,CAAC,gBAAgB;CAsBzB"}
+{"version":3,"file":"ticket-distribution.d.ts","sourceRoot":"","sources":["../../../../../../packages/jam/jamnp-s/tasks/ticket-distribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAA2C,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEvG,OAAO,KAAK,EAAW,WAAW,EAAE,MAAM,aAAa,CAAC;AAExD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAe1D;;;;;;;;;;;GAWG;AACH,qBAAa,sBAAsB;IAqB/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IArB9B,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS;IAgBzF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA2B;IAChD,OAAO,CAAC,SAAS,CAA+C;IAEhE,OAAO;IAKP;;OAEG;IACH,oBAAoB;IAgDpB;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY;IAIjD;;;OAGG;IACH,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,YAAY,EAAE;IAI/D;;;;OAIG;IACH,kBAAkB,CAAC,SAAS,EAAE,eAAe;IAI7C,OAAO,CAAC,gBAAgB;CAkBzB"}

package/packages/jam/jamnp-s/tasks/ticket-distribution.js

@@ -1,4 +1,5 @@
 import { Logger } from "#@typeberry/logger";
+import { DenyTicketsValidator, PendingTicketPool } from "#@typeberry/ticket-pool";
 import { OK } from "#@typeberry/utils";
 import { ce131 } from "../protocol/index.js";
 const logger = Logger.new(import.meta.filename, "net:tickets");
@@ -12,6 +13,11 @@ const TICKET_AUX = {
  * Uses CE-132 (proxy-to-all) for direct broadcast to all peers.
  * Implements a maintain pattern similar to SyncTask: tickets are collected
  * and periodically distributed to peers that haven't received them yet.
+ *
+ * Incoming tickets from peers are first run through a {@link TicketValidator};
+ * only validated tickets are added to the redistribution pool. The default
+ * validator denies everything, so callers must wire a real one via
+ * {@link setTicketValidator} before any networked ticket can be redistributed.
  */
 export class TicketDistributionTask {
     streamManager;
@@ -26,10 +32,8 @@ export class TicketDistributionTask {
         streamManager.registerOutgoingHandlers(ce131.ClientHandler.new(chainSpec, ce131.STREAM_KIND_PROXY_TO_ALL));
         return task;
     }
-    /** Pending tickets waiting to be distributed to peers */
-    pendingTickets = [];
-    /** Current epoch being tracked (cleared when epoch changes) */
-    currentEpoch = null;
+    pool = new PendingTicketPool();
+    validator = new DenyTicketsValidator();
     constructor(streamManager, connections) {
         this.streamManager = streamManager;
         this.connections = connections;
@@ -38,14 +42,13 @@ export class TicketDistributionTask {
      * Should be called periodically to distribute pending tickets to connected peers.
      */
     maintainDistribution() {
-        if (this.currentEpoch === null) {
-            return; // No tickets to distribute yet
+        const currentEpoch = this.pool.currentEpoch;
+        if (currentEpoch === null) {
+            return;
         }
-        /** `this` is mutable and TS can't narrow this.currentEpoch inside the callback closure */
-        const currentEpoch = this.currentEpoch;
-        // Iterate through all pending tickets
-        for (let ticketIdx = 0; ticketIdx < this.pendingTickets.length; ticketIdx++) {
-            const { epochIndex, ticket } = this.pendingTickets[ticketIdx];
+        const tickets = this.pool.getTickets();
+        for (let ticketIdx = 0; ticketIdx < tickets.length; ticketIdx++) {
+            const { epochIndex, ticket } = tickets[ticketIdx];
             // Try to send to each connected peer
             for (const peerInfo of this.connections.getConnectedPeers()) {
                 this.connections.withAuxData(peerInfo.peerId, TICKET_AUX, (maybeAux) => {
@@ -77,72 +80,45 @@ export class TicketDistributionTask {
         }
     }
     /**
-     * Add a ticket to the pending queue for distribution.
+     * Add a ticket to the redistribution pool.
      * Clears pending tickets when epoch changes.
      * Deduplicates tickets based on signature.
      */
     addTicket(epochIndex, ticket) {
-        // Drop tickets for older epochs (can happen when a delayed validation callback completes
-        // after the epoch has already advanced — accepting it would roll back currentEpoch).
-        if (this.currentEpoch !== null && epochIndex < this.currentEpoch) {
-            return;
-        }
-        // Epoch advanced — clear old tickets
-        if (this.currentEpoch !== null && epochIndex > this.currentEpoch) {
-            logger.log `[addTicket] Epoch changed from ${this.currentEpoch} to ${epochIndex}, clearing ${this.pendingTickets.length} old tickets`;
-            this.pendingTickets = [];
-            // Note: We don't need to clear aux data for all peers here.
-            // The aux data contains the epoch, so maintainDistribution will lazily
-            // reset it when it detects an epoch mismatch. This handles both connected
-            // and disconnected peers correctly.
-        }
-        this.currentEpoch = epochIndex;
-        /**
-         * Deduplicate: check if a ticket with the same signature already exists
-         *
-         * Here we are risking "poisoning" the local pendingTickets - i.e:
-         *  1. The adversary sees a signature and swaps the ticket attempt to something different.
-         *  2. This creates an invalid ticket, but prevents a valid ticket with the same signature from being included and distributed.
-         *
-         * TODO [MaSi]: The poisoning risk should be fixed during implementation of ticket validation.
-         */
-        const isDuplicate = this.pendingTickets.some((pending) => pending.epochIndex === epochIndex && pending.ticket.signature.isEqualTo(ticket.signature));
-        if (!isDuplicate) {
-            this.pendingTickets.push({ epochIndex, ticket });
-            logger.info `[addTicket] Added ticket for epoch ${epochIndex}, total: ${this.pendingTickets.length}`;
-        }
+        this.pool.addTicket(epochIndex, ticket);
     }
-    onTicketReceivedCallback = null;
     /**
-     * Register a callback that validates a received ticket.
-     * The ticket is only added to the redistribution pool if the callback returns `true`.
-     * This prevents redistribution of invalid tickets (e.g. those with a tampered `attempt` field).
+     * Replace the redistribution pool for the given epoch with the supplied tickets.
+     * Used when the authorship worker dumps the authoritative pool on an epoch boundary.
      */
-    setOnTicketReceived(cb) {
-        this.onTicketReceivedCallback = cb;
+    replacePool(epochIndex, tickets) {
+        this.pool.replace(epochIndex, tickets);
+    }
+    /**
+     * Register the validator that decides whether tickets received from peers should be
+     * accepted (and therefore redistributed). The default is {@link DenyTicketsValidator},
+     * so the caller must install a real validator for any peer ticket to make it through.
+     */
+    setTicketValidator(validator) {
+        this.validator = validator;
     }
     onTicketReceived(epochIndex, ticket) {
         logger.trace `Received ticket for epoch ${epochIndex}, attempt ${ticket.attempt}`;
-        if (this.onTicketReceivedCallback !== null) {
-            // Validate first; only redistribute if valid to avoid spreading tampered tickets.
-            // Wrap with Promise.resolve().then() to catch both sync throws and async rejections.
-            const cb = this.onTicketReceivedCallback;
-            Promise.resolve()
-                .then(() => cb(epochIndex, ticket))
-                .then((isValid) => {
-                if (isValid) {
-                    this.addTicket(epochIndex, ticket);
-                }
-                else {
-                    logger.warn `Dropping invalid ticket for epoch ${epochIndex} (validation failed)`;
-                }
-            })
-                .catch((error) => {
-                logger.error `Error validating ticket for epoch ${epochIndex}, attempt ${ticket.attempt}: ${error}`;
-            });
-        }
-        else {
-            this.addTicket(epochIndex, ticket);
-        }
+        const validator = this.validator;
+        // Wrap with Promise.resolve().then() so a synchronous throw inside the validator
+        // funnels into the same .catch() as an async rejection.
+        Promise.resolve()
+            .then(() => validator.validate(epochIndex, ticket))
+            .then((result) => {
+            if (result.isOk) {
+                this.addTicket(epochIndex, ticket);
+            }
+            else {
+                logger.trace `Dropping ticket for epoch ${epochIndex}: ${result.error}`;
+            }
+        })
+            .catch((error) => {
+            logger.error `Error validating ticket for epoch ${epochIndex}, attempt ${ticket.attempt}: ${error}`;
+        });
     }
 }

package/packages/jam/jamnp-s/tasks/ticket-distribution.test.js

@@ -8,7 +8,8 @@ import { tinyChainSpec } from "#@typeberry/config";
 import { BANDERSNATCH_PROOF_BYTES } from "#@typeberry/crypto";
 import { Logger } from "#@typeberry/logger";
 import { createTestPeerPair, MockNetwork } from "#@typeberry/networking/testing.js";
-import { OK } from "#@typeberry/utils";
+import { AcceptTicketsValidator, ValidationError } from "#@typeberry/ticket-pool";
+import { OK, Result } from "#@typeberry/utils";
 import { Connections } from "../peers.js";
 import { StreamManager } from "../stream-manager.js";
 import { TicketDistributionTask } from "./ticket-distribution.js";
@@ -34,6 +35,9 @@ describe("TicketDistributionTask", () => {
         const receivedTickets = [];
         // Use real TicketDistributionTask
         const ticketTask = TicketDistributionTask.start(streamManager, connections, tinyChainSpec);
+        // Default validator accepts every ticket so the test asserts purely on distribution
+        // behaviour. Tests that exercise the rejection path overwrite this.
+        ticketTask.setTicketValidator(new AcceptTicketsValidator());
         // Intercept received tickets by wrapping onTicketReceived behavior
         // The task already adds received tickets to pending queue via addTicket,
         // so we can track them by checking the pending queue growth or by
@@ -217,7 +221,7 @@ describe("TicketDistributionTask", () => {
         assert.strictEqual(peer2.receivedTickets.length, 1);
         assert.deepStrictEqual(peer2.receivedTickets[0].ticket, ticket);
     });
-    it("should NOT redistribute ticket if validation callback returns false", async () => {
+    it("should NOT redistribute ticket if validator rejects", async () => {
         const self = await init("self");
         const peer1 = await init("peer1");
         const peer2 = await init("peer2");
@@ -225,35 +229,53 @@ describe("TicketDistributionTask", () => {
         self.openConnection(peer2);
         await tick();
         // Validation always rejects
-        self.ticketTask.setOnTicketReceived(async () => false);
+        self.ticketTask.setTicketValidator({
+            validate: async () => Result.error(ValidationError.InvalidProof, () => "rejected"),
+        });
         const ticket = createTestTicket(0);
         peer1.ticketTask.addTicket(TEST_EPOCH, ticket);
         peer1.ticketTask.maintainDistribution();
         await tick();
-        // self.addTicket was NOT called (callback returned false), so nothing to redistribute
+        // self.addTicket was NOT called (validator rejected), so nothing to redistribute
         assert.strictEqual(self.receivedTickets.length, 0);
         self.ticketTask.maintainDistribution();
         await tick();
         assert.strictEqual(peer2.receivedTickets.length, 0);
     });
-    it("should redistribute ticket if validation callback returns true", async () => {
+    it("should redistribute ticket if validator accepts", async () => {
         const self = await init("self");
         const peer1 = await init("peer1");
         const peer2 = await init("peer2");
         self.openConnection(peer1);
         self.openConnection(peer2);
         await tick();
-        // Validation always accepts
-        self.ticketTask.setOnTicketReceived(async () => true);
+        // Default init() already wires an AcceptTicketsValidator
         const ticket = createTestTicket(0);
         peer1.ticketTask.addTicket(TEST_EPOCH, ticket);
         peer1.ticketTask.maintainDistribution();
         await tick();
-        // self.addTicket WAS called (callback returned true)
+        // self.addTicket WAS called
         assert.strictEqual(self.receivedTickets.length, 1);
         self.ticketTask.maintainDistribution();
         await tick();
         assert.strictEqual(peer2.receivedTickets.length, 1);
         assert.deepStrictEqual(peer2.receivedTickets[0].ticket, ticket);
     });
+    it("replacePool overwrites the redistribution pool", async () => {
+        const self = await init("self");
+        const peer1 = await init("peer1");
+        self.openConnection(peer1);
+        await tick();
+        // Locally added tickets first
+        self.ticketTask.addTicket(TEST_EPOCH, createTestTicket(0));
+        self.ticketTask.addTicket(TEST_EPOCH, createTestTicket(1));
+        // Pool dump replaces with a different set
+        const dump = [createTestTicket(2), createTestTicket(3)];
+        self.ticketTask.replacePool(TEST_EPOCH, dump);
+        self.ticketTask.maintainDistribution();
+        await tick();
+        assert.strictEqual(peer1.receivedTickets.length, 2);
+        assert.deepStrictEqual(peer1.receivedTickets[0].ticket, dump[0]);
+        assert.deepStrictEqual(peer1.receivedTickets[1].ticket, dump[1]);
+    });
 });

package/packages/jam/ticket-pool/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./pending-ticket-pool.js";
+export * from "./ticket-validator.js";
+export * from "./verified-ticket-pool.js";
+//# sourceMappingURL=index.d.ts.map

package/packages/jam/ticket-pool/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../packages/jam/ticket-pool/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC"}

package/packages/jam/ticket-pool/index.js

@@ -0,0 +1,3 @@
+export * from "./pending-ticket-pool.js";
+export * from "./ticket-validator.js";
+export * from "./verified-ticket-pool.js";

package/packages/jam/ticket-pool/pending-ticket-pool.d.ts

@@ -0,0 +1,30 @@
+import type { Epoch } from "#@typeberry/block";
+import type { SignedTicket } from "#@typeberry/block/tickets.js";
+/**
+ * An ordered, signature-deduplicated pool of tickets waiting to be redistributed to peers.
+ *
+ * Used on the networking side. Indices are stable within an epoch so callers can track
+ * per-peer "sent" sets by index. The pool is cleared whenever a new epoch is observed,
+ * and tickets for older epochs are dropped (can happen when an async validation completes
+ * after the epoch already advanced).
+ */
+export declare class PendingTicketPool {
+    private tickets;
+    private currentEpochValue;
+    /** Epoch the pool is currently holding tickets for, or `null` if empty. */
+    get currentEpoch(): Epoch | null;
+    /** Returns the ordered tickets currently in the pool. Caller must not mutate the array. */
+    getTickets(): readonly {
+        epochIndex: Epoch;
+        ticket: SignedTicket;
+    }[];
+    /** Returns true if the ticket was added, false if it was a duplicate or dropped (old epoch). */
+    addTicket(epochIndex: Epoch, ticket: SignedTicket): boolean;
+    /**
+     * Replace the pool contents for the given epoch with the supplied tickets. Used when the
+     * authorship worker pushes an authoritative pool dump on an epoch boundary; any tickets
+     * that aren't in the dump are dropped, and dedup runs over the new set.
+     */
+    replace(epochIndex: Epoch, tickets: readonly SignedTicket[]): void;
+}
+//# sourceMappingURL=pending-ticket-pool.d.ts.map

package/packages/jam/ticket-pool/pending-ticket-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-ticket-pool.d.ts","sourceRoot":"","sources":["../../../../../packages/jam/ticket-pool/pending-ticket-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAKhE;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,OAAO,CAA0D;IACzE,OAAO,CAAC,iBAAiB,CAAsB;IAE/C,2EAA2E;IAC3E,IAAI,YAAY,IAAI,KAAK,GAAG,IAAI,CAE/B;IAED,2FAA2F;IAC3F,UAAU,IAAI,SAAS;QAAE,UAAU,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE,EAAE;IAIpE,gGAAgG;IAChG,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO;IAyB3D;;;;OAIG;IACH,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,IAAI;CAWnE"}

package/packages/jam/ticket-pool/pending-ticket-pool.js

@@ -0,0 +1,56 @@
+import { Logger } from "#@typeberry/logger";
+const logger = Logger.new(import.meta.filename, "pending-pool");
+/**
+ * An ordered, signature-deduplicated pool of tickets waiting to be redistributed to peers.
+ *
+ * Used on the networking side. Indices are stable within an epoch so callers can track
+ * per-peer "sent" sets by index. The pool is cleared whenever a new epoch is observed,
+ * and tickets for older epochs are dropped (can happen when an async validation completes
+ * after the epoch already advanced).
+ */
+export class PendingTicketPool {
+    tickets = [];
+    currentEpochValue = null;
+    /** Epoch the pool is currently holding tickets for, or `null` if empty. */
+    get currentEpoch() {
+        return this.currentEpochValue;
+    }
+    /** Returns the ordered tickets currently in the pool. Caller must not mutate the array. */
+    getTickets() {
+        return this.tickets;
+    }
+    /** Returns true if the ticket was added, false if it was a duplicate or dropped (old epoch). */
+    addTicket(epochIndex, ticket) {
+        if (this.currentEpochValue !== null && epochIndex < this.currentEpochValue) {
+            return false;
+        }
+        if (this.currentEpochValue !== null && epochIndex > this.currentEpochValue) {
+            logger.log `Epoch changed from ${this.currentEpochValue} to ${epochIndex}, clearing ${this.tickets.length} old tickets`;
+            this.tickets = [];
+        }
+        this.currentEpochValue = epochIndex;
+        const isDuplicate = this.tickets.some((pending) => pending.epochIndex === epochIndex && pending.ticket.signature.isEqualTo(ticket.signature));
+        if (isDuplicate) {
+            return false;
+        }
+        this.tickets.push({ epochIndex, ticket });
+        logger.info `[addTicket] Added ticket for epoch ${epochIndex}, total: ${this.tickets.length}`;
+        return true;
+    }
+    /**
+     * Replace the pool contents for the given epoch with the supplied tickets. Used when the
+     * authorship worker pushes an authoritative pool dump on an epoch boundary; any tickets
+     * that aren't in the dump are dropped, and dedup runs over the new set.
+     */
+    replace(epochIndex, tickets) {
+        this.tickets = [];
+        this.currentEpochValue = epochIndex;
+        for (const ticket of tickets) {
+            const isDuplicate = this.tickets.some((pending) => pending.ticket.signature.isEqualTo(ticket.signature));
+            if (!isDuplicate) {
+                this.tickets.push({ epochIndex, ticket });
+            }
+        }
+        logger.log `Pool replaced for epoch ${epochIndex} with ${this.tickets.length} tickets`;
+    }
+}

package/packages/jam/ticket-pool/pending-ticket-pool.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pending-ticket-pool.test.d.ts.map

package/packages/jam/ticket-pool/pending-ticket-pool.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-ticket-pool.test.d.ts","sourceRoot":"","sources":["../../../../../packages/jam/ticket-pool/pending-ticket-pool.test.ts"],"names":[],"mappings":""}

package/packages/jam/ticket-pool/pending-ticket-pool.test.js

@@ -0,0 +1,67 @@
+import assert from "node:assert";
+import { describe, it } from "node:test";
+import { tryAsEpoch } from "#@typeberry/block";
+import { SignedTicket, tryAsTicketAttempt } from "#@typeberry/block/tickets.js";
+import { Bytes } from "#@typeberry/bytes";
+import { BANDERSNATCH_PROOF_BYTES } from "#@typeberry/crypto";
+import { PendingTicketPool } from "./pending-ticket-pool.js";
+const E1 = tryAsEpoch(1);
+const E2 = tryAsEpoch(2);
+function makeTicket(seed, attempt = 0) {
+    const sig = Bytes.zero(BANDERSNATCH_PROOF_BYTES);
+    sig.raw[0] = seed;
+    return SignedTicket.create({
+        attempt: tryAsTicketAttempt(attempt),
+        signature: sig.asOpaque(),
+    });
+}
+describe("PendingTicketPool", () => {
+    it("starts empty with no current epoch", () => {
+        const pool = new PendingTicketPool();
+        assert.strictEqual(pool.currentEpoch, null);
+        assert.deepStrictEqual(pool.getTickets(), []);
+    });
+    it("adds a ticket and tracks the epoch", () => {
+        const pool = new PendingTicketPool();
+        const t = makeTicket(1);
+        assert.strictEqual(pool.addTicket(E1, t), true);
+        assert.strictEqual(pool.currentEpoch, E1);
+        assert.strictEqual(pool.getTickets().length, 1);
+    });
+    it("dedups by signature within an epoch", () => {
+        const pool = new PendingTicketPool();
+        const t = makeTicket(1);
+        pool.addTicket(E1, t);
+        assert.strictEqual(pool.addTicket(E1, t), false);
+        assert.strictEqual(pool.getTickets().length, 1);
+    });
+    it("clears tickets when a newer epoch arrives", () => {
+        const pool = new PendingTicketPool();
+        pool.addTicket(E1, makeTicket(1));
+        pool.addTicket(E1, makeTicket(2));
+        pool.addTicket(E2, makeTicket(3));
+        const tickets = pool.getTickets();
+        assert.strictEqual(tickets.length, 1);
+        assert.strictEqual(tickets[0].epochIndex, E2);
+        assert.strictEqual(pool.currentEpoch, E2);
+    });
+    it("drops late tickets for older epochs", () => {
+        const pool = new PendingTicketPool();
+        pool.addTicket(E2, makeTicket(1));
+        assert.strictEqual(pool.addTicket(E1, makeTicket(2)), false);
+        assert.strictEqual(pool.getTickets().length, 1);
+        assert.strictEqual(pool.currentEpoch, E2);
+    });
+    it("replace clears existing tickets and dedups the new set", () => {
+        const pool = new PendingTicketPool();
+        pool.addTicket(E1, makeTicket(1));
+        pool.addTicket(E1, makeTicket(2));
+        const dump = [makeTicket(3), makeTicket(4), makeTicket(3)];
+        pool.replace(E2, dump);
+        const tickets = pool.getTickets();
+        assert.strictEqual(tickets.length, 2);
+        assert.strictEqual(pool.currentEpoch, E2);
+        assert.strictEqual(tickets[0].ticket.signature.raw[0], 3);
+        assert.strictEqual(tickets[1].ticket.signature.raw[0], 4);
+    });
+});

package/packages/jam/ticket-pool/ticket-validator.d.ts

@@ -0,0 +1,46 @@
+import type { EntropyHash, Epoch } from "#@typeberry/block";
+import type { SignedTicket } from "#@typeberry/block/tickets.js";
+import { Result } from "#@typeberry/utils";
+/**
+ * Outcome of a successful validation.
+ *
+ * `id` is the entropy hash the validator computed for this ticket. It is `null` when the
+ * concrete validator doesn't actually verify (e.g. {@link AcceptTicketsValidator}) or when
+ * it delegates to another process that doesn't bother to send the id back over the wire.
+ */
+export type ValidatedTicket = {
+    id: EntropyHash | null;
+};
+/** Reasons a ticket may fail validation. */
+export declare enum ValidationError {
+    /** Verifier rejected the signature / proof. */
+    InvalidProof = "invalid_proof",
+    /** Validator could not run (e.g. state unavailable, transient internal failure). */
+    ValidatorUnavailable = "validator_unavailable",
+    /** Ticket is for an epoch outside the validator's window of interest. */
+    WrongEpoch = "wrong_epoch"
+}
+/**
+ * Strategy for verifying tickets arriving from peers.
+ *
+ * The concrete implementation may call into the bandersnatch verifier, defer to another
+ * worker via IPC, or short-circuit (Accept/Deny defaults for tests).
+ */
+export interface TicketValidator {
+    validate(epochIndex: Epoch, ticket: SignedTicket): Promise<Result<ValidatedTicket, ValidationError>>;
+}
+/**
+ * Accepts every ticket without inspection. Useful for unit tests where the validator
+ * isn't the subject under test. Must never be used in production.
+ */
+export declare class AcceptTicketsValidator implements TicketValidator {
+    validate(_epochIndex: Epoch, _ticket: SignedTicket): Promise<Result<ValidatedTicket, ValidationError>>;
+}
+/**
+ * Rejects every ticket. Used as the default for any task that needs an explicit, real
+ * validator wired in before it will accept anything from the network.
+ */
+export declare class DenyTicketsValidator implements TicketValidator {
+    validate(_epochIndex: Epoch, _ticket: SignedTicket): Promise<Result<ValidatedTicket, ValidationError>>;
+}
+//# sourceMappingURL=ticket-validator.d.ts.map

package/packages/jam/ticket-pool/ticket-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ticket-validator.d.ts","sourceRoot":"","sources":["../../../../../packages/jam/ticket-pool/ticket-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,WAAW,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,4CAA4C;AAC5C,oBAAY,eAAe;IACzB,+CAA+C;IAC/C,YAAY,kBAAkB;IAC9B,oFAAoF;IACpF,oBAAoB,0BAA0B;IAC9C,yEAAyE;IACzE,UAAU,gBAAgB;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;CACtG;AAED;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,eAAe;IACtD,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;CAG7G;AAED;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,eAAe;IACpD,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;CAG7G"}

package/packages/jam/ticket-pool/ticket-validator.js

@@ -0,0 +1,29 @@
+import { Result } from "#@typeberry/utils";
+/** Reasons a ticket may fail validation. */
+export var ValidationError;
+(function (ValidationError) {
+    /** Verifier rejected the signature / proof. */
+    ValidationError["InvalidProof"] = "invalid_proof";
+    /** Validator could not run (e.g. state unavailable, transient internal failure). */
+    ValidationError["ValidatorUnavailable"] = "validator_unavailable";
+    /** Ticket is for an epoch outside the validator's window of interest. */
+    ValidationError["WrongEpoch"] = "wrong_epoch";
+})(ValidationError || (ValidationError = {}));
+/**
+ * Accepts every ticket without inspection. Useful for unit tests where the validator
+ * isn't the subject under test. Must never be used in production.
+ */
+export class AcceptTicketsValidator {
+    async validate(_epochIndex, _ticket) {
+        return Result.ok({ id: null });
+    }
+}
+/**
+ * Rejects every ticket. Used as the default for any task that needs an explicit, real
+ * validator wired in before it will accept anything from the network.
+ */
+export class DenyTicketsValidator {
+    async validate(_epochIndex, _ticket) {
+        return Result.error(ValidationError.ValidatorUnavailable, () => "no ticket validator wired");
+    }
+}

package/packages/jam/ticket-pool/ticket-validator.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ticket-validator.test.d.ts.map

package/packages/jam/ticket-pool/ticket-validator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ticket-validator.test.d.ts","sourceRoot":"","sources":["../../../../../packages/jam/ticket-pool/ticket-validator.test.ts"],"names":[],"mappings":""}

package/packages/jam/ticket-pool/ticket-validator.test.js

@@ -0,0 +1,34 @@
+import assert from "node:assert";
+import { describe, it } from "node:test";
+import { tryAsEpoch } from "#@typeberry/block";
+import { SignedTicket, tryAsTicketAttempt } from "#@typeberry/block/tickets.js";
+import { Bytes } from "#@typeberry/bytes";
+import { BANDERSNATCH_PROOF_BYTES } from "#@typeberry/crypto";
+import { AcceptTicketsValidator, DenyTicketsValidator, ValidationError } from "./ticket-validator.js";
+const E1 = tryAsEpoch(1);
+function makeTicket() {
+    return SignedTicket.create({
+        attempt: tryAsTicketAttempt(0),
+        signature: Bytes.zero(BANDERSNATCH_PROOF_BYTES).asOpaque(),
+    });
+}
+describe("AcceptTicketsValidator", () => {
+    it("returns ok with null id", async () => {
+        const v = new AcceptTicketsValidator();
+        const res = await v.validate(E1, makeTicket());
+        assert.strictEqual(res.isOk, true);
+        if (res.isOk) {
+            assert.strictEqual(res.ok.id, null);
+        }
+    });
+});
+describe("DenyTicketsValidator", () => {
+    it("returns ValidatorUnavailable", async () => {
+        const v = new DenyTicketsValidator();
+        const res = await v.validate(E1, makeTicket());
+        assert.strictEqual(res.isError, true);
+        if (res.isError) {
+            assert.strictEqual(res.error, ValidationError.ValidatorUnavailable);
+        }
+    });
+});

package/packages/jam/ticket-pool/verified-ticket-pool.d.ts

@@ -0,0 +1,24 @@
+import type { EntropyHash, Epoch } from "#@typeberry/block";
+import type { SignedTicket } from "#@typeberry/block/tickets.js";
+/** A ticket the validator already verified, paired with the entropy hash (ticket id). */
+export type VerifiedTicket = {
+    ticket: SignedTicket;
+    id: EntropyHash;
+};
+/**
+ * In-memory pool of verified tickets for the current epoch, keyed by ticket id.
+ *
+ * Used on the authorship side. Tickets are stored per epoch and deduplicated by their
+ * computed entropy hash (so duplicates arriving via different peers / paths are coalesced
+ * cheaply). The pool only ever needs to hold tickets for one epoch at a time; switching
+ * to a new epoch clears everything older.
+ */
+export declare class VerifiedTicketPool {
+    private readonly perEpoch;
+    private readonly idSets;
+    /** Add pre-verified tickets to the pool, deduping by id. */
+    add(epochIndex: Epoch, verifiedTickets: readonly VerifiedTicket[]): void;
+    /** Returns the verified tickets for the given epoch, or an empty array if none. */
+    getForEpoch(epochIndex: Epoch): readonly VerifiedTicket[];
+}
+//# sourceMappingURL=verified-ticket-pool.d.ts.map

package/packages/jam/ticket-pool/verified-ticket-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-ticket-pool.d.ts","sourceRoot":"","sources":["../../../../../packages/jam/ticket-pool/verified-ticket-pool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,EAAE,EAAE,WAAW,CAAC;CACjB,CAAC;AAEF;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsC;IAC/D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,4DAA4D;IAC5D,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;IAoBxE,mFAAmF;IACnF,WAAW,CAAC,UAAU,EAAE,KAAK,GAAG,SAAS,cAAc,EAAE;CAG1D"}

package/packages/jam/ticket-pool/verified-ticket-pool.js

@@ -0,0 +1,37 @@
+import { HashSet } from "#@typeberry/collections/hash-set.js";
+/**
+ * In-memory pool of verified tickets for the current epoch, keyed by ticket id.
+ *
+ * Used on the authorship side. Tickets are stored per epoch and deduplicated by their
+ * computed entropy hash (so duplicates arriving via different peers / paths are coalesced
+ * cheaply). The pool only ever needs to hold tickets for one epoch at a time; switching
+ * to a new epoch clears everything older.
+ */
+export class VerifiedTicketPool {
+    perEpoch = new Map();
+    idSets = new Map();
+    /** Add pre-verified tickets to the pool, deduping by id. */
+    add(epochIndex, verifiedTickets) {
+        if (this.perEpoch.size > 0 && !this.perEpoch.has(epochIndex)) {
+            this.perEpoch.clear();
+            this.idSets.clear();
+        }
+        const existing = this.perEpoch.get(epochIndex) ?? [];
+        let idSet = this.idSets.get(epochIndex) ?? null;
+        if (idSet === null) {
+            idSet = HashSet.new();
+            this.idSets.set(epochIndex, idSet);
+        }
+        for (const entry of verifiedTickets) {
+            if (!idSet.has(entry.id)) {
+                existing.push(entry);
+                idSet.insert(entry.id);
+            }
+        }
+        this.perEpoch.set(epochIndex, existing);
+    }
+    /** Returns the verified tickets for the given epoch, or an empty array if none. */
+    getForEpoch(epochIndex) {
+        return this.perEpoch.get(epochIndex) ?? [];
+    }
+}

package/packages/jam/ticket-pool/verified-ticket-pool.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verified-ticket-pool.test.d.ts.map

package/packages/jam/ticket-pool/verified-ticket-pool.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-ticket-pool.test.d.ts","sourceRoot":"","sources":["../../../../../packages/jam/ticket-pool/verified-ticket-pool.test.ts"],"names":[],"mappings":""}

package/packages/jam/ticket-pool/verified-ticket-pool.test.js

@@ -0,0 +1,54 @@
+import assert from "node:assert";
+import { describe, it } from "node:test";
+import { tryAsEpoch } from "#@typeberry/block";
+import { SignedTicket, tryAsTicketAttempt } from "#@typeberry/block/tickets.js";
+import { Bytes } from "#@typeberry/bytes";
+import { BANDERSNATCH_PROOF_BYTES } from "#@typeberry/crypto";
+import { HASH_SIZE } from "#@typeberry/hash";
+import { VerifiedTicketPool } from "./verified-ticket-pool.js";
+const E1 = tryAsEpoch(1);
+const E2 = tryAsEpoch(2);
+function makeTicket(seed) {
+    const sig = Bytes.zero(BANDERSNATCH_PROOF_BYTES);
+    sig.raw[0] = seed;
+    return SignedTicket.create({
+        attempt: tryAsTicketAttempt(0),
+        signature: sig.asOpaque(),
+    });
+}
+function makeId(byte) {
+    return Bytes.fill(HASH_SIZE, byte).asOpaque();
+}
+describe("VerifiedTicketPool", () => {
+    it("starts empty", () => {
+        const pool = new VerifiedTicketPool();
+        assert.deepStrictEqual(pool.getForEpoch(E1), []);
+    });
+    it("adds and retrieves tickets per epoch", () => {
+        const pool = new VerifiedTicketPool();
+        pool.add(E1, [{ ticket: makeTicket(1), id: makeId(0xaa) }]);
+        assert.strictEqual(pool.getForEpoch(E1).length, 1);
+        assert.deepStrictEqual(pool.getForEpoch(E2), []);
+    });
+    it("dedups by id", () => {
+        const pool = new VerifiedTicketPool();
+        const id = makeId(0x01);
+        pool.add(E1, [{ ticket: makeTicket(1), id }]);
+        pool.add(E1, [{ ticket: makeTicket(2), id }]);
+        assert.strictEqual(pool.getForEpoch(E1).length, 1);
+        assert.strictEqual(pool.getForEpoch(E1)[0].ticket.signature.raw[0], 1);
+    });
+    it("clears previous epochs when a new epoch is added", () => {
+        const pool = new VerifiedTicketPool();
+        pool.add(E1, [{ ticket: makeTicket(1), id: makeId(1) }]);
+        pool.add(E2, [{ ticket: makeTicket(2), id: makeId(2) }]);
+        assert.deepStrictEqual(pool.getForEpoch(E1), []);
+        assert.strictEqual(pool.getForEpoch(E2).length, 1);
+    });
+    it("appends across multiple add() calls for the same epoch", () => {
+        const pool = new VerifiedTicketPool();
+        pool.add(E1, [{ ticket: makeTicket(1), id: makeId(1) }]);
+        pool.add(E1, [{ ticket: makeTicket(2), id: makeId(2) }]);
+        assert.strictEqual(pool.getForEpoch(E1).length, 2);
+    });
+});

package/packages/workers/block-authorship/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../../../../packages/workers/block-authorship/main.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAiB3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAK9E,KAAK,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAwBlD,wBAAsB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,iBAmapG"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../../../../packages/workers/block-authorship/main.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAkB3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAM9E,KAAK,MAAM,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;AAwBlD,wBAAsB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,iBAuWpG"}

package/packages/workers/block-authorship/main.js

@@ -13,9 +13,11 @@ import bandersnatchVrf from "#@typeberry/safrole/bandersnatch-vrf.js";
 import { BandernsatchWasm } from "#@typeberry/safrole/bandersnatch-wasm.js";
 import { JAM_FALLBACK_SEAL, JAM_TICKET_SEAL } from "#@typeberry/safrole/constants.js";
 import { SafroleSealingKeysKind } from "#@typeberry/state";
+import { VerifiedTicketPool } from "#@typeberry/ticket-pool";
 import { asOpaqueType, Result } from "#@typeberry/utils";
 import { Generator } from "./generator.js";
 import { generateTickets } from "./ticket-generator.js";
+import { BandersnatchTicketValidator } from "./ticket-validator.js";
 const logger = Logger.new(import.meta.filename, "author");
 export async function main(config, comms, networkingComms) {
     await initWasm();
@@ -181,80 +183,16 @@ export async function main(config, comms, networkingComms) {
         }
         return Result.ok(state.sealingKeySeries);
     }
-    // Ticket pool: epochIndex -> {ticket, id}[]
-    // IDs (entropyHash) are computed at receipt time via verifyTickets(), enabling O(1) dedup by ID.
-    const ticketPool = new Map();
-    const ticketIdSets = new Map();
-    /**
-     * Adds pre-verified tickets to the in-memory ticket pool for the given epoch.
-     *
-     * Clears the pool when the epoch changes (we only ever need tickets for one epoch at a time).
-     * Deduplicates by ticket ID using a HashSet for O(1) lookup — prevents double-counting
-     * tickets received from multiple peers or via both CE-131 and CE-132 paths.
-     */
-    function addToPool(epochIndex, verifiedTickets) {
-        if (ticketPool.size > 0 && !ticketPool.has(epochIndex)) {
-            ticketPool.clear();
-            ticketIdSets.clear();
-        }
-        const existing = ticketPool.get(epochIndex) ?? [];
-        let idSet = ticketIdSets.get(epochIndex) ?? null;
-        if (idSet === null) {
-            idSet = HashSet.new();
-            ticketIdSets.set(epochIndex, idSet);
-        }
-        for (const entry of verifiedTickets) {
-            if (!idSet.has(entry.id)) {
-                existing.push(entry);
-                idSet.insert(entry.id);
-            }
-        }
-        ticketPool.set(epochIndex, existing);
-    }
-    /**
-     * Returns the correct tickets entropy for verification given the current state.
-     *
-     * When `state` is from epoch E-1 (i.e. we haven't produced epoch E's first block yet),
-     * the ticket entropy for epoch E is at index 1 (not yet shifted).
-     * After the epoch transition it moves to index 2.
-     */
-    function getTicketEntropy(epochIndex, state) {
-        const stateEpoch = Math.floor(state.timeslot / chainSpec.epochLength);
-        return epochIndex > stateEpoch ? state.entropy[1] : state.entropy[2];
-    }
-    /**
-     * Verifies tickets against the ring commitment and current epoch entropy, then adds valid
-     * ones to the pool with their computed IDs.
-     *
-     * Called both for own generated tickets and for tickets relayed from peers.
-     * Verification computes the ticket ID (entropyHash) which is then used for
-     * deduplication in the pool and later when building the extrinsic.
-     */
-    async function verifyAndAddToPool(epochIndex, tickets, state) {
-        const results = await bandersnatchVrf.verifyTickets(bandersnatch, state.designatedValidatorData.length, state.epochRoot, tickets, getTicketEntropy(epochIndex, state));
-        if (results.tickets.length !== tickets.length) {
-            logger.error `verifyTickets returned ${results.tickets.length} results for ${tickets.length} tickets`;
-            return false;
-        }
-        // Batch verification: either the whole batch is valid or none of the tickets are.
-        if (!results.isValid) {
-            return false;
-        }
-        const verified = tickets.map((ticket, i) => ({ ticket, id: results.tickets[i] }));
-        addToPool(epochIndex, verified);
-        return verified.length > 0;
-    }
+    // Verified tickets for the current epoch, keyed by entropy hash (ticket id).
+    // Tickets enter via `validator.validate(...)` which both verifies and inserts.
+    const verifiedPool = new VerifiedTicketPool();
+    const ticketValidator = new BandersnatchTicketValidator(bandersnatch, chainSpec, verifiedPool, () => states.getState(blocks.getBestHeaderHash()));
     // Receive a single ticket from peers (via jam-network worker).
     // Returns true if the ticket passed validation so jam-network can decide whether to redistribute it.
     networkingComms.setOnReceivedTickets(async ({ epochIndex, ticket }) => {
         logger.log `Received ticket from peer for epoch ${epochIndex}`;
-        const hash = blocks.getBestHeaderHash();
-        const state = states.getState(hash);
-        if (state === null) {
-            logger.warn `Cannot verify received ticket: no state available`;
-            return false;
-        }
-        return await verifyAndAddToPool(epochIndex, [ticket], state);
+        const result = await ticketValidator.validate(epochIndex, ticket);
+        return result.isOk;
     });
     const isFastForward = config.workerParams.isFastForward;
     let lastGeneratedSlot = startTimeSlot;
@@ -303,8 +241,10 @@ export async function main(config, comms, networkingComms) {
                 }
                 else {
                     logger.log `Generated ${ticketsResult.ok.length} tickets for epoch ${epoch}. Distributing...`;
-                    // Verify own tickets to get IDs, then add to pool
-                    await verifyAndAddToPool(epoch, ticketsResult.ok, state);
+                    // Verify own tickets (validator stores them in the pool with computed ids).
+                    for (const ticket of ticketsResult.ok) {
+                        await ticketValidator.validate(epoch, ticket);
+                    }
                     // Send directly to network worker (bypasses main thread)
                     await networkingComms.sendTickets({ epochIndex: epoch, tickets: ticketsResult.ok });
                 }
@@ -330,6 +270,12 @@ export async function main(config, comms, networkingComms) {
             }
             await buildTicketAuthorshipCache(selingKeySeriesResult.ok, entropy);
         }
+        // On every epoch boundary, push the authoritative ticket pool to networking so it
+        // can replace its redistribution set; this keeps the two sides from drifting.
+        if (isNewEpoch) {
+            const dumpTickets = verifiedPool.getForEpoch(epoch).map((entry) => entry.ticket);
+            await networkingComms.sendReplaceTicketPool({ epochIndex: epoch, tickets: dumpTickets });
+        }
         const sealData = getSealData(selingKeySeriesResult.ok, keys, timeSlot, entropy);
         if (sealData !== null && currentValidatorData !== null) {
             const { key, sealPayload } = sealData;
@@ -338,8 +284,10 @@ export async function main(config, comms, networkingComms) {
                 continue;
             }
             logger.log `Attempting to create a block using ${sealData.logId} located at validator index ${validatorIndex}.`;
-            const currentEpochTickets = ticketPool.get(epoch) ?? [];
-            const newBlock = await generator.nextBlockView(validatorIndex, key.bandersnatchSecret, sealPayload, timeSlot, currentEpochTickets);
+            const currentEpochTickets = verifiedPool.getForEpoch(epoch);
+            const newBlock = await generator.nextBlockView(validatorIndex, key.bandersnatchSecret, sealPayload, timeSlot, 
+            // VerifiedTicket has the same `{ ticket, id }` shape the generator expects.
+            [...currentEpochTickets]);
             counter += 1;
             lastGeneratedSlot = timeSlot;
             logger.trace `Sending block ${counter}`;

package/packages/workers/block-authorship/ticket-validator.d.ts

@@ -0,0 +1,32 @@
+import type { Epoch } from "#@typeberry/block";
+import type { SignedTicket } from "#@typeberry/block/tickets.js";
+import type { ChainSpec } from "#@typeberry/config";
+import type { BandernsatchWasm } from "#@typeberry/safrole/bandersnatch-wasm.js";
+import type { State } from "#@typeberry/state";
+import { type TicketValidator, type ValidatedTicket, ValidationError, type VerifiedTicketPool } from "#@typeberry/ticket-pool";
+import { Result } from "#@typeberry/utils";
+/**
+ * Real {@link TicketValidator} implementation that verifies a ticket against the ring
+ * commitment and current epoch entropy using bandersnatch, then stores the verified
+ * ticket (with its computed id) into the supplied {@link VerifiedTicketPool}.
+ *
+ * `getState` is a thunk because state advances continuously while validation is in
+ * flight; we want the latest available state for each call.
+ */
+export declare class BandersnatchTicketValidator implements TicketValidator {
+    private readonly bandersnatch;
+    private readonly chainSpec;
+    private readonly pool;
+    private readonly getState;
+    constructor(bandersnatch: BandernsatchWasm, chainSpec: ChainSpec, pool: VerifiedTicketPool, getState: () => State | null);
+    validate(epochIndex: Epoch, ticket: SignedTicket): Promise<Result<ValidatedTicket, ValidationError>>;
+    /**
+     * Returns the correct tickets entropy for verification given the current state.
+     *
+     * When `state` is from epoch E-1 (i.e. we haven't produced epoch E's first block yet),
+     * the ticket entropy for epoch E is at index 1 (not yet shifted). After the epoch
+     * transition it moves to index 2.
+     */
+    private getTicketEntropy;
+}
+//# sourceMappingURL=ticket-validator.d.ts.map

package/packages/workers/block-authorship/ticket-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ticket-validator.d.ts","sourceRoot":"","sources":["../../../../../packages/workers/block-authorship/ticket-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAChF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,eAAe,EAEf,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAI1C;;;;;;;GAOG;AACH,qBAAa,2BAA4B,YAAW,eAAe;IAE/D,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAHR,YAAY,EAAE,gBAAgB,EAC9B,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,MAAM,KAAK,GAAG,IAAI;IAGzC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IA+B1G;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;CAIzB"}

package/packages/workers/block-authorship/ticket-validator.js

@@ -0,0 +1,56 @@
+import { Logger } from "#@typeberry/logger";
+import bandersnatchVrf from "#@typeberry/safrole/bandersnatch-vrf.js";
+import { ValidationError, } from "#@typeberry/ticket-pool";
+import { Result } from "#@typeberry/utils";
+const logger = Logger.new(import.meta.filename, "ticket-validator");
+/**
+ * Real {@link TicketValidator} implementation that verifies a ticket against the ring
+ * commitment and current epoch entropy using bandersnatch, then stores the verified
+ * ticket (with its computed id) into the supplied {@link VerifiedTicketPool}.
+ *
+ * `getState` is a thunk because state advances continuously while validation is in
+ * flight; we want the latest available state for each call.
+ */
+export class BandersnatchTicketValidator {
+    bandersnatch;
+    chainSpec;
+    pool;
+    getState;
+    constructor(bandersnatch, chainSpec, pool, getState) {
+        this.bandersnatch = bandersnatch;
+        this.chainSpec = chainSpec;
+        this.pool = pool;
+        this.getState = getState;
+    }
+    async validate(epochIndex, ticket) {
+        const state = this.getState();
+        if (state === null) {
+            return Result.error(ValidationError.ValidatorUnavailable, () => "no state available");
+        }
+        const entropy = this.getTicketEntropy(epochIndex, state);
+        // Batch verifier: a single `isValid` covers the whole batch and `tickets` holds the
+        // computed id per input ticket. We only ever pass one ticket here.
+        const { isValid, tickets } = await bandersnatchVrf.verifyTickets(this.bandersnatch, state.designatedValidatorData.length, state.epochRoot, [ticket], entropy);
+        if (tickets.length !== 1) {
+            logger.error `verifyTickets returned ${tickets.length} results for 1 ticket`;
+            return Result.error(ValidationError.ValidatorUnavailable, () => "verifier returned unexpected result count");
+        }
+        if (!isValid) {
+            return Result.error(ValidationError.InvalidProof, () => "bandersnatch proof rejected");
+        }
+        const verified = { ticket, id: tickets[0] };
+        this.pool.add(epochIndex, [verified]);
+        return Result.ok({ id: tickets[0] });
+    }
+    /**
+     * Returns the correct tickets entropy for verification given the current state.
+     *
+     * When `state` is from epoch E-1 (i.e. we haven't produced epoch E's first block yet),
+     * the ticket entropy for epoch E is at index 1 (not yet shifted). After the epoch
+     * transition it moves to index 2.
+     */
+    getTicketEntropy(epochIndex, state) {
+        const stateEpoch = Math.floor(state.timeslot / this.chainSpec.epochLength);
+        return epochIndex > stateEpoch ? state.entropy[1] : state.entropy[2];
+    }
+}

package/packages/workers/comms-authorship-network/protocol.d.ts

@@ -21,6 +21,16 @@ export declare const protocol: import("@typeberry/workers-api").LousyProtocol<{
         }>>;
         response: import("@typeberry/codec").Descriptor<void, void>;
     };
+    replaceTicketPool: {
+        request: import("@typeberry/codec").Descriptor<TicketsMessage, import("@typeberry/codec").ViewOf<TicketsMessage, {
+            epochIndex: import("@typeberry/codec").Descriptor<number & import("@typeberry/numbers").WithBytesRepresentation<4> & import("@typeberry/utils").WithOpaque<"Epoch">, import("@typeberry/bytes").Bytes<4>>;
+            tickets: import("@typeberry/codec").Descriptor<import("@typeberry/block").SignedTicket[], import("@typeberry/codec").SequenceView<import("@typeberry/block").SignedTicket, import("@typeberry/codec").ViewOf<import("@typeberry/block").SignedTicket, {
+                attempt: import("@typeberry/codec").Descriptor<number & import("@typeberry/numbers").WithBytesRepresentation<1> & import("@typeberry/utils").WithOpaque<"TicketAttempt[u8]">, import("@typeberry/numbers").U32>;
+                signature: import("@typeberry/codec").Descriptor<import("@typeberry/bytes").Bytes<784> & import("@typeberry/utils").WithOpaque<"BandersnatchRingSignature">, import("@typeberry/bytes").Bytes<784>>;
+            }>>>;
+        }>>;
+        response: import("@typeberry/codec").Descriptor<void, void>;
+    };
 }, {
     receivedTickets: {
         request: import("@typeberry/codec").Descriptor<ReceivedTicketMessage, import("@typeberry/codec").ViewOf<ReceivedTicketMessage, {

package/packages/workers/comms-authorship-network/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../../../packages/workers/comms-authorship-network/protocol.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,GAAG,EAAkB,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;EAiBnB,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC;AACnD,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../../../packages/workers/comms-authorship-network/protocol.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,GAAG,EAAkB,KAAK,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,uBAAuB,uBAAuB,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBnB,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC;AACnD,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,QAAQ,CAAC,CAAC"}

package/packages/workers/comms-authorship-network/protocol.js

@@ -12,12 +12,19 @@ export const AUTHORSHIP_NETWORK_PORT = "authorship-network";
  * This bypasses the main thread for ticket distribution, reducing latency.
  */
 export const protocol = createProtocol("authorship-network", {
-    // Messages from block-authorship to jam-network
+    // Messages from block-authorship to jam-network.
     toWorker: {
+        // Newly generated own tickets; networking should add them to its redistribution pool.
         tickets: {
             request: TicketsMessage.Codec,
             response: codec.nothing,
         },
+        // Authoritative pool snapshot for the given epoch; networking replaces its local
+        // pool with these tickets (one-way, source of truth lives in block-authorship).
+        replaceTicketPool: {
+            request: TicketsMessage.Codec,
+            response: codec.nothing,
+        },
     },
     // Messages from jam-network to block-authorship (one ticket per relay).
     // Response indicates whether the ticket passed validation — used by jam-network

package/packages/workers/jam-network/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../../../../packages/workers/jam-network/main.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAK3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAI1E;;;;;;GAMG;AACH,wBAAsB,IAAI,CACxB,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,EACtC,KAAK,EAAE,kBAAkB,EACzB,eAAe,EAAE,eAAe,iBAyDjC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../../../../packages/workers/jam-network/main.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAO3E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAI1E;;;;;;GAMG;AACH,wBAAsB,IAAI,CACxB,MAAM,EAAE,YAAY,CAAC,gBAAgB,CAAC,EACtC,KAAK,EAAE,kBAAkB,EACzB,eAAe,EAAE,eAAe,iBAwEjC"}

package/packages/workers/jam-network/main.js

@@ -2,6 +2,8 @@ import { parseBootnode } from "#@typeberry/config-node";
 import { ed25519, initWasm } from "#@typeberry/crypto";
 import { setup } from "#@typeberry/jamnp-s";
 import { Logger } from "#@typeberry/logger";
+import { ValidationError } from "#@typeberry/ticket-pool";
+import { Result } from "#@typeberry/utils";
 const logger = Logger.new(import.meta.filename, "net");
 /**
  * JAM networking worker.
@@ -38,11 +40,25 @@ export async function main(config, comms, authorshipComms) {
             network.ticketTask.addTicket(epochIndex, ticket);
         }
     });
-    // Relay tickets received from peers back to block-authorship (one ticket at a time).
-    // Returns the validation result so ticket-distribution knows whether to redistribute.
-    network.ticketTask.setOnTicketReceived(async (epochIndex, ticket) => {
-        return await authorshipComms.sendReceivedTickets({ epochIndex, ticket });
+    // Authorship pushes the authoritative ticket pool on epoch boundaries; networking
+    // replaces its redistribution pool wholesale so the two sides cannot drift.
+    authorshipComms.setOnReplaceTicketPool(async ({ epochIndex, tickets }) => {
+        logger.log `Replacing redistribution pool from block-authorship for epoch ${epochIndex} (${tickets.length} tickets)`;
+        network.ticketTask.replacePool(epochIndex, tickets);
     });
+    // Validator that hands a received ticket to block-authorship over IPC and waits
+    // for an accept/reject decision. The wire protocol stays a simple bool; the
+    // computed id stays inside authorship (it owns the verified pool).
+    const ipcValidator = {
+        validate: async (epochIndex, ticket) => {
+            const ok = await authorshipComms.sendReceivedTickets({ epochIndex, ticket });
+            if (!ok) {
+                return Result.error(ValidationError.InvalidProof, () => "authorship rejected the ticket");
+            }
+            return Result.ok({ id: null });
+        },
+    };
+    network.ticketTask.setTicketValidator(ipcValidator);
     await network.network.start();
     // stop the network when the worker is finishing.
     await waitForFinish;