Full-node tier: pure-Go block-validation pipeline + tunable resident state

[Reiers]

Part of #87 (Full Node epic). Stage A.

Wire the Full node tier (already reserved in pkg/nodeprofile.TierFull) as a real class:

• Persistent block cache with a bigger cap than PDP (suggest 8-16 GB default, vs PDP 3 GB; tunable).
• Full pure-Go block-validation pipeline on ingest: lift the Lotus filcns checks MINUS the ffi VerifyWinningPoSt call — keep block sanity, miner-min-power, election-proof VRF, ticket VRF, beacon values, block sig, win-count. (All pure-Go BLS/arith we already have.)
• Trust F3 finality for the SNARK + FVM state-transition it doesn't re-derive.
• Bounded resident state — do NOT hold all of state (that defeats the point; cap ~single-to-low-double-digit GB).

Note: profile machinery (nodeprofile, install-time selector, daemon cache-tier switch) already landed on branch fix/lightnode-messages-2026-07-01.

[Reiers]

Progress 2026-07-01 — validation pipeline landed (pure-Go, CGO-off)

New package chain/fullvalidate on branch fix/lightnode-messages-2026-07-01 (local).

What it does — second-pass consensus validation a Full node can run because it has resident F3-anchored state (light clients can't). Extends chain/header.ValidateHeader (structural/beacon/parent-linkage) with:

• block signature over the worker key (crypto/sigs.CheckBlockSignature)
• election-proof VRF (VerifyVRF over DrawRandomnessFromBase(..., ElectionProofProduction, ...))
• ticket VRF (TicketProduction domain)
• win-count recompute vs parent miner/total QA-power (ElectionProof.ComputeWinCount)
• winner-claim sanity (WinCount >= 1)

All pure-Go BLS/arith Lantern already ships. Byte-for-byte mirrors Lotus filcns (miner-addr CBOR entropy, last-beacon-else-prev, blake2b base).

Trust boundary made explicit — Result reports WinningPoStVerified=false and StateReExecuted=false until #88 (SNARK) / #89 (FVM) land. The node re-verifies VRF/sig/win-count itself; it still F3-trusts the WinningPoSt SNARK + FVM state transition. A test pins those flags false so the honest surface can't silently drift.

State surface — a small StateView interface (WorkerKey, MinerQAPower), satisfiable by the existing StateMinerInfo/StateAccountKey/StateMinerPower handlers.

Build + vet + gofmt + tests green; full module compiles CGO_ENABLED=0.

Next: (a) implement a StateView adapter over the daemon's state accessor; (b) call ValidateBlockConsensus from the Full-tier ingest path (gate on nodeprofile TierFull); (c) MinerEligibleToMine min-power + slashed check (needs a small extra state read).

[Reiers]

Progress 2026-07-01 (2) — wired into ingest, tier-gated, observe-by-default

chain/fullvalidate is now connected to the header-sync ingest path.

• Sync.SetBlockValidator(fn, fatal) runs the consensus check per ingested block after the Phase-1 shape check. nil on Light/PDP = zero cost. The Full tier wires it via nodeprofile.Profile.FullValidation() (true only for TierFull).
• Observe mode (default): validation failures are logged, ingest is NOT blocked — so a Full node can be brought up + watched on calibration before we trust the pipeline to gate head. Config.FullValidationFatal=false.
• Fatal mode: a rejected block becomes a fetch "hole" and simply never becomes head (rides the existing pkg/daemon embedded mode: head store falls behind chain (mainnet standalone does not) #33 non-stall design — the poll doesn't crash, it just refuses to advance past the bad block). Safe by construction.
• Wired in both paths: CLI (cmd/lantern, gated on the loaded profile) and embedded (pkg/daemon, via Config.FullValidation/FullValidationFatal so curio-core can opt in).

Tests: observe mode advances head despite an always-fail validator + confirms the validator is invoked; fatal mode refuses to advance head to a rejected block. Full module builds/vets/gofmt/tests green (CGO off).

Design note surfaced: because pollAndApply treats a per-epoch fetch error as non-fatal-skip (#33), fatal validation naturally degrades to "don't adopt this block as head" rather than "crash the daemon" — which is the behavior we want anyway.

Commits 1bee18d (pipeline) + d920b86 (ingest wiring) on branch fix/lightnode-messages-2026-07-01.

Remaining before close: (a) prevBeacon plumbing so entry-less blocks validate fully (currently observe-only for those); (b) MinerEligibleToMine min-power + slashed check; (c) calibration soak in observe mode to confirm zero false-positives before flipping any node to fatal.

[Reiers]

Progress 2026-07-01 (3) — feature-complete (commit 07fb178)

Closed the two remaining gaps from the last update:

• Miner eligibility — StateView.MinerEligible mirrors Lotus MinerEligibleToMine (post-v3 actors): non-empty QA-power claim + no fee debt + no active consensus fault. The adapter reads the power claim, miner FeeDebt(), and ConsensusFaultElapsed vs head. A block from an ineligible miner now fails validation (Result.EligibilityOK).
• prevBeacon plumbing — Store.LatestBeaconEntry walks a block's own entries, then parents (bounded 20 tipsets, matching Lotus), to supply prevBeacon. Beacon-entry-less blocks now validate fully instead of observe-only. Both CLI + embedded closures pass the resolved prevBeacon.

The pipeline now runs the complete pure-Go consensus check set a Full node can do without ffi: signature, election VRF, ticket VRF, miner eligibility, win-count. Only WinningPoSt SNARK (#88) and FVM re-exec (#89) remain F3-trusted — by design, tracked separately.

Build/vet/gofmt/tests green (CGO off). Commits 1bee18d + d920b86 + 07fb178.

Only gate left before flipping any node to fatal: a calibration observe-mode soak to confirm zero false-positives against real chain data. That's a live-node task (next calibration session), not a code task. Leaving #90 open until that soak passes.