Peer-table eclipse hardening for the head path: pin anchor peers + head-source diversity

[Reiers]

Problem

The running-head fork-choice hardening in #79 raises the cost of a peer-table eclipse, but it's only as good as the diversity of the peer set feeding the head. If an attacker can fully capture the gossip peer table (the "get into your peer table 5 times" attack, zenground0 / fil-curio-dev 2026-06-30), they control every candidate the fork-choice rule sees.

Lantern already has the primitives: net/bitswap PreferredPeers (warm-pinned), gossipsub peer-scoring (net/blockpub, net/hello), and MinPeers/MaxPeers connection-manager bounds (net/libp2p/host.go). They are not yet wired into a deliberate anti-eclipse posture for the head path.

Proposed fix (pure-Go)

1. Pin trusted anchor/beacon peers as an un-evictable floor. The trusted beacon floor already exists for cert-exchange (cmd/lantern/beacon_peer_provider.go, security Security: bootstrap/beacon peer trust — operator-pinned + DHT-discovered peers feed cert-exchange without an authenticity floor #59). Ensure the head-following peer set always retains those pinned peers so the table can't be fully replaced by attacker-dialed peers.
2. Diversity requirement on head-bearing peers. Don't let a single peer (or single ASN/IP prefix, best-effort) be the sole source of a head advance. Require head candidates from a minimum number of distinct, scored peers before adopting.
3. Lean on existing gossipsub peer-score so peers that forward non-canonical / non-advancing blocks decay out of the mesh.

What this does NOT do

Same boundary as #79: hardening, not a finality guarantee. Closing the unfinalized-tip fork against a powerful adversary is F3's job. This is eclipse-resistance hygiene, pure-Go, no ffi.

Acceptance

• Trusted anchor/beacon peers are an un-evictable floor in the head-following peer set
• Head advance requires corroboration from >=N distinct scored peers (config, sane default)
• Tests: single-peer-only head advance is held; pinned floor survives a flood of attacker dials

Context: fil-curio-dev thread w/ zenground0, 2026-06-30. Pairs with #79.

[Reiers]

Part 1 (un-evictable trusted peer floor via connmgr.Protect) shipped in v1.8.5 (PR #84). Remaining/deferred: head-source diversity — require head candidates from ≥N distinct scored peers before adopting a head advance (needs source-peer plumbing through blockpub→blockingest; interacts with the #79 fork choice). Keeping this issue open scoped to that follow-up.

[Reiers]

Part 2 design (head-source diversity) — settled

Key simplification: gossipsub already gives us corroboration counting for free. The pubsub validator sees each message once, but a pubsub event tracer sees every DuplicateMessage with the forwarding peer ID. Every duplicate of the same block CID from a distinct peer is a corroboration vote. No new protocol, no blockpub→blockingest re-plumbing.

Design:

1. Tracer in net/blockpub: per-block-CID windowed set of distinct forwarder peer IDs.
2. Adoption rule plugs into the existing Running-head fork choice: heaviest-ParentWeight + periodic re-quorum (not boot-only) #79 head-adoption gate (same chokepoint): adopt head H only if forwarders(H) ≥ N (default 2) or the forwarder set includes ≥1 trusted beacon/anchor peer (the part-1 floor peers count as super-votes).
3. Graceful degradation (same pattern as headcheck StatusInsufficient): a 1-peer node must never wedge. Config HeadCorroborationPeers, 0 = off. Light/PDP default off, Full default on.
4. Honesty boundary for TRUST-MODEL: distinct peer IDs are Sybil-cheap; this bites only in combination with peer-score decay + the trusted floor (+ per-topic score params, see Adopt lotus per-topic gossipsub score params for /fil/blocks + /fil/msgs (topic map is empty) #97). ASN/IP-prefix diversity beyond gossipsub's built-in IP-colocation penalty stays best-effort/deferred. F3 remains the finality guarantee.

Tests: single-source head held; multi-source adopted; trusted-peer super-vote adopts; 1-peer node not wedged; floor-survives-dial-flood (exists from part 1).

Pairs with #97 (per-topic score params), which is what makes "distinct scored peers" meaningful against Sybils.