fix(consensus): make leader election converge across nodes (testnet fork fix)

[lai3d]

Fixes the root cause of the testnet's three-way consensus fork — validators diverged from block #1 into three independent chains and could never reconcile. (Full investigation in the session; the running staging-sha-8cf3cb0 image exhibits it live.)

Root cause

Leader election was not a pure, node-agnostic function of (validator set, epoch seed, slot), so different nodes elected different producers and never agreed. Two defects in qfc-consensus:

② select_producer — zero-score fallback was order-dependent

if total_score == 0 { return Some(validators[0].address); }   // before

validators[0]'s identity depends on each node's internal list order, so every node elected itself and forked at block #1. Now:

• filter to active validators and sort by address (canonical, node-agnostic),
• zero total score → deterministic round-robin sorted[slot % len],
• the weighted path also iterates the sorted set, so it's order-independent even with non-zero scores.

③ maybe_advance_epoch — seed came from the local chain head

seed.copy_from_slice(head_hash.as_bytes());   // before — per-node, divergent

Once two nodes diverged, their seeds diverged and the fork became permanent. Now the seed is a hash chain rooted at the genesis seed (seed_n = blake3(seed_{n-1} || n)), walked from the current epoch to the target — identical on every node regardless of chain head. Dropped the now-unused head_hash param (updated producer.rs / miner.rs callers). Deterministic ⇒ predictable beacon, an acceptable trade for convergence on this chain.

Tests (27 qfc-consensus pass; 20 qfc-node)

• test_producer_selection_is_order_independent — two nodes holding the set in opposite order elect the same producer for 200 slots (weighted path).
• test_zero_score_round_robin — zero-score path round-robins deterministically and covers every validator, order-independent.
• test_epoch_seed_is_deterministic_hash_chain — epoch seed is the genesis-rooted hash chain, independent of head.

Scope / follow-ups

• Not fixed here: Defect ④ (qfc-node sync MAX_PENDING_BLOCKS=1000 can't bridge a deep fork) and contribution-score scaling on the old deployed image — separate PRs.
• A testnet reset is still required: the three existing chains diverge at block feat: implement v2.0 AI inference compute system #1 and cannot reconcile; they need a fresh genesis on this fixed binary. This PR makes a reset stick (nodes will converge instead of re-forking).

🤖 Generated with Claude Code