[consensus] slim block codec

[arun-koshy]

Description

Strips a block's ancestor digests out of the subscription payload and rebuilds them at the receiver. Emission is gated by consensus_slim_block_propagation, off on every chain, so nothing changes until it is enabled.

A block's ancestors are 32 bytes each, and a receiver at the frontier already holds those blocks. The slim form carries ancestor authors in proposal order plus an override for the ones the receiver cannot infer: a non-parent round, a slot it cannot resolve uniquely, or an ancestor below the GC horizon. Everything else is looked up locally.

Reconstruction is self-validating. The rebuilt bytes must hash to the digest the author claimed before the block goes anywhere, and the signature is checked afterwards on the normal path — so a wrong or hostile digest costs a fetch, never a bad block. The rebuild must reproduce the author's exact serialization, since that is what the signature covers.

The encoding is produced once at proposal time, where every ancestor is already accepted, so the whole subscription fan-out shares it. Catch-up replay and the liveness re-broadcast stay on the full form.

Both directions scope their DagState guard to the part that needs it: only ancestor resolution reads local state, so cloning, serializing, and hashing the block happen outside the lock that accept and commit contend for.

A receiver that cannot rebuild a block drops it rather than passing it on to be rejected as a peer fault, since the usual cause is an ancestor it has not accepted yet. Failures are counted by peer and reason, and logged by kind: a malformed payload is the peer's fault and stays at info, an unresolvable ancestor is local and drops to debug.

Not in this PR, both required before the flag can be enabled

• No per-subscriber gate. The flag gates emission globally, but nothing here decides full-vs-slim per peer: a subscriber trailing the horizon cannot rebuild anything and must be served full blocks. Observable rather than theoretical — setting the flag in ConsensusProtocolConfig::for_testing hangs the authority_node committee tests.
• No recovery for a block whose ancestors have not arrived yet; it is dropped and refetched by ordinary block sync.

Stacked on #27695 — review that first; this targets its branch.

Test plan

Fourteen tests on the codec and resolver. The load-bearing ones: byte-identical round trip across all block versions; ancestors carried in proposal order rather than authority order (a decoder that sorted would pass every other test); the GC horizon boundary, where an ancestor sitting exactly on it keeps its digest; a unique-but-wrong local block caught as a digest mismatch; and twelve malformed inputs rejected without panicking.

---

Release notes

Check each box that your changes affect. If none of the boxes relate to your changes, release notes aren't required.

For each box you select, include information after the relevant heading that describes the impact of your changes that a user might notice and any actions they must take to implement updates.

• Protocol:
• Nodes (Validators and Full nodes):
• gRPC:
• JSON-RPC:
• GraphQL:
• CLI:
• Rust SDK:
• Indexing Framework:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
sui-docs	Ready	Preview	Aug 20, 2026 9:57pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
multisig-toolkit	Ignored	Preview	Aug 20, 2026 9:57pm
sui-kiosk	Ignored	Preview	Aug 20, 2026 9:57pm

[akichidis]

why not just block instead of skeleton?

[arun-koshy]

Renamed, though to stripped_block rather than plain block: the rebuild phase has the finished block in scope too, and the point of this local is that it is not a complete block yet (empty ancestors, unverified).