What a View Change Is: A Bounded Wait, the Same Bug Fixed Twice, and a Backoff That Inverts If You Push It Far Enough

The problem

One participant leads each round. If it says nothing, everybody else waits, and nobody is in charge of noticing.

A view change is how a group with no coordinator agrees to give up on a round and move to the next one. It is the part of a consensus protocol that decides whether a network survives a leader going quiet or hangs waiting for it.

The sequence, exactly

Every round carries a deadline. It starts at two seconds.

When the deadline passes with no certified block, the participant broadcasts a vote to abandon that round.

Then it pushes its own deadline forward without changing the round. The comment explains why: otherwise the loop spins against an already-expired deadline while it waits for either enough abandon-votes to gather or a late proposal to arrive.

When enough abandon-votes gather, they aggregate into a certificate and the round advances, with the wait doubled.

If an ordinary certificate arrives instead, the round advances and the deadline resets to two seconds, with the failure counter cleared.

The bounded wait, which is the property that matters

The doubling is capped at sixteen seconds.

So no participant waits longer than that on a stuck round before moving on. A leader that stops speaking costs a bounded delay, once, and the next round begins under somebody else.

Silence is survivable by construction rather than by anybody intervening, and that is the whole reason this machinery exists.

The same bug, found and fixed in both places it could occur

A participant that broadcasts its own abandon-vote does not receive it back, because broadcast skips the sender.

So without special handling, a certificate to abandon a round would need every other participant to vote, leaving no margin for a single failure.

The code records the participant's own abandon-vote explicitly, exactly as it does for ordinary votes on a block. Two paths, the same defect, the same fix, and each names the other in its comment.

That is worth more than either fix alone. A bug fixed once is a bug fixed; a bug fixed everywhere it can occur is a bug understood.

And the backoff inverts if you push it far enough

The wait is computed as the base doubled once per consecutive failure, and only then clamped to the cap.

The doubling happens first, in a fixed-width integer. At fifty-four consecutive failed rounds, that multiplication exceeds the range of the type holding it and wraps around.

What gets clamped afterwards is therefore no longer the doubling. The wait can collapse to a small value precisely when it should be at its longest, which is the opposite of what a backoff is for.

How far is fifty-four rounds? Each failure costs at most sixteen seconds, so roughly fourteen minutes of unbroken failure, with nothing succeeding in between.

It is not reached on this network, and that is measured rather than assumed. During the quiet periods this chain shows, the round advances in exact step with the height, so no rounds are being lost and the consecutive-failure counter is sitting at zero.

The fix is a one-line change to clamp before multiplying rather than after. It is filed.

What a view change would look like from outside

With leadership rotating in order, abandoning a round moves the turn along, so the participant who proposes next is not the one whose turn it would have been.

That is exactly the shape of an anomaly this estate has already reported: a block whose round advanced by one rather than three, with a proposer out of turn.

We cannot confirm the connection, because no certificate for an abandoned round is published and the artefact that would prove it cannot be fetched. The shape matches. That is not the same as knowing.

What you can check yourself

solidus_getBlock across a dozen heights, then compare each block's round with its height

If the two move in step, no rounds were abandoned between them. If the round runs ahead, rounds were spent without producing a block, and the gap counts them.