Resolves the actors-refactor (#691) collision: gossip now starts in
sequencer_service::run() after ExecutorActor construction (which exposes
its mempool handle), and the RPC-side publish hook threads through
RpcServerActor::new into the actor's Service.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
BREAKING CHANGE: the sequencer database moves from <home>/rocksdb to <home>/rocksdb-<channel id>; an existing home fresh-starts (with a warning naming the old directory) unless the directory is renamed.
Every guest moved, not only the ones whose source changed: adding real
dependencies (borsh to two cores, cross_zone_inbox_core to two targets) changes
the build graph, and with it the metadata hash of every crate in the guest build.
Piece A moved only three because it added a dev-dependency, which the guest build
never sees.
BREAKING CHANGE: InboxConfig is just self_zone; allowed_routes, InboxConfig::permits
and routes_permit are gone, and build_inbox_init_config_tx no longer takes the
cross-zone config. The operator's per-peer routes still configure the same thing,
fanned out at genesis into each target's own config instead. The watcher keeps
only a hygiene filter refusing a peer that names a sequencer-only program, kept
host-side so it cannot make the verifier disagree.
BREAKING CHANGE: ping_receiver gains a config PDA holding the deliverer and the
peer sources it accepts, ReceiverInstruction gains InitConfig, and Record takes
[source marker, config, record] instead of the record alone. Every emitter aimed
at ping_receiver must name its config account in target_accounts. The
ping_receiver and ping_sender image ids move, and a fresh genesis is required.
BREAKING CHANGE: the wrapped-token config PDA holds a borsh WrappedTokenConfig
(minter plus authorized source pairs) rather than a bare minter id, and
Instruction::InitConfig takes it as a single field. Mint now refuses a source the
token has not authorized, checked against the inbox's source marker. The
wrapped_token image id moves, and bridge_lock's with it, since it links
wrapped_token_core.
BREAKING CHANGE: an inbox dispatch now declares [config, seen shard, source
marker, ...target accounts], and a target's chained call receives the marker at
position 0, so wrapped_token::Mint and ping_receiver::Record each take one more
leading account. The inbox, wrapped_token and ping_receiver image ids move,
relocating their PDAs and requiring a fresh genesis.
BREAKING CHANGE: Instruction::Lock drops outbox_program_id and takes the
bridge-lock config PDA as its first account, changing both the instruction
encoding and the account list. bridge_lock's image id moves, relocating its
escrow and config PDAs and requiring a fresh genesis. Sequencer, indexer and
every peer zone must upgrade together: a stale decoder re-derives a different
dispatch and reports Forged.
BREAKING CHANGE: SenderInstruction::Send drops outbox_program_id and takes the
sender config PDA as its first account, changing both the instruction encoding
and the account list. ping_sender's image id moves, relocating its PDAs and
requiring a fresh genesis. Sequencer, indexer and every peer zone must upgrade
together: a stale decoder re-derives a different dispatch and reports Forged.
Closes#675.
BREAKING CHANGE: an outbox message PDA is now derived from the emitting program
as well as the destination zone and ordinal, and the seed domain moves to
/00001/, so every outbox record address changes. `OutboxRecord` gains `emitter`
and `ordinal`, changing its borsh layout, so records written by earlier code are
orphaned at their old addresses and no longer decode. A second `Emit` at the same
(emitter, target_zone, ordinal) now fails the transaction instead of silently
overwriting the record, so a caller must choose an ordinal the chain does not
already hold rather than counting from zero. A fresh genesis is required.
Sergio Chouhy