[Epic] Running-head trust: eclipse resistance + observed finality (pre-mainnet-F3)

[Reiers]

Epic: harden the one remaining live trust surface — the running head

Boot trust is solved (multi-source F3-finalized quorum, BLS-verified). Historical trust is solved (CID verification + F3 certs). The remaining live attack surface is the head between finality and now — especially on networks where F3 finality is not yet live at the tip, where an eclipse of the unfinalized tip range is the credible attack (raised in community discussion, 2026-06-30).

Already shipped (v1.8.5 / v1.9.0-rc1): heaviest-ParentWeight fork choice (#79), lag-aware catch-up (#83), header-propagation integrity gate + divergence monitor (#85/#86), head-adoption divergence gate (#79 item 2), un-evictable trusted peer floor (#80 part 1).

Remaining children

• Peer-table eclipse hardening for the head path: pin anchor peers + head-source diversity #80 part 2 (shipped v-next: PR feat(#80 part 2, #97): head-source corroboration + per-topic gossipsub scoring #101) — head-source diversity: ≥N distinct scored forwarders (or a trusted-floor super-vote) before adopting a head advance
• Adopt lotus per-topic gossipsub score params for /fil/blocks + /fil/msgs (topic map is empty) #97 (shipped: PR feat(#80 part 2, #97): head-source corroboration + per-topic gossipsub scoring #101) — per-topic gossipsub score params for /fil/blocks + /fil/msgs (makes "scored peers" meaningful against Sybil swarms)
• Lift FRC-0089 EC finality calculator (lotus chain/ecfinality): observed-data finality without F3 #96 (shipped: PR feat(#96): FRC-0089 EC finality calculator (observed-data finality) #105) — FRC-0089 EC finality calculator: quantified, locally-computed finality depth from observed block counts (the principled bound on how deep a tip eclipse can reorg)

Outcome

When these land, the honest claim is: fork choice by heaviest ParentWeight; no head adopted without multi-source corroboration; delivery-history peer scoring + IP-colocation penalties + un-evictable trusted floor; divergence gate holds the head when sources disagree; observed-data finality bound computed locally. F3 closes the residual when live; until then this is materially more tip-hardening than default node peering provides.

Boundary (unchanged): hardening, not a finality guarantee. Closing the unfinalized-tip fork against a powerful adversary is F3's job.

[Reiers]

All three children shipped: #80 part 2 + #97 (PR #101), #96 (PR #105). The running-head trust surface now has: heaviest-ParentWeight fork choice, divergence gate, un-evictable trusted floor, N-distinct-scored-peer corroboration with trusted-floor super-vote, per-topic delivery scoring + IP-colocation penalties, and a locally-computed FRC-0089 finality bound quantifying tip-eclipse depth. Live validation happens in the #104 calibration soak (Phase 2 checkboxes). Boundary unchanged: hardening, not finality; F3 closes the residual.