Use deterministic time check in CheckBlock to fix Tor chain splits (v5.7.9)

Replace FutureDrift(GetAdjustedTime()) with GetTime() + 15min in CheckBlock
and header-sync validation. GetAdjustedTime() incorporates peer-reported
time offsets that vary between Tor nodes, causing the same block to be
accepted by some nodes and rejected by others — the primary cause of
persistent chain forks. AcceptBlock still enforces tight 3-min drift rules
deterministically against the previous block timestamp.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CMakeLists.txt

@@ -6,7 +6,7 @@ if(POLICY CMP0167)
 endif()
 
 project(Triangles
-    VERSION 5.7.6.0
+    VERSION 5.7.9.0
     DESCRIPTION "Cryptographic Triangles Wallet"
     LANGUAGES C CXX
 )

src/clientversion.h

@@ -8,7 +8,7 @@
 // These need to be macros, as version.cpp's and triangles-qt.rc's voodoo requires it
 #define CLIENT_VERSION_MAJOR       5
 #define CLIENT_VERSION_MINOR       7
-#define CLIENT_VERSION_REVISION    7
+#define CLIENT_VERSION_REVISION    9
 #define CLIENT_VERSION_BUILD       0
 
 // Converts the parameter X to a string after macro replacement on X has been performed.

src/main.cpp

@@ -247,7 +247,7 @@ static bool AddHeaderSyncNode(const CBlock& header, const uint256& hashHeader)
         return false;
     }
 
-    if (header.GetBlockTime() > FutureDrift(GetAdjustedTime()))
+    if (header.GetBlockTime() > GetTime() + 15 * 60)
     {
         printf("IBD-DIAG: header rejected (future time) hash=%s time=%u\n",
             hashHeader.ToString().substr(0,20).c_str(), header.nTime);
@@ -2341,6 +2341,12 @@ bool static Reorganize(CTxDB& txdb, CBlockIndex* pindexNew)
                 vResurrect.push_back(tx);
     }
 
+    // Remove disconnected PoS blocks from setStakeSeen so they don't
+    // block acceptance of valid blocks on the winning chain.
+    for (CBlockIndex* pindex : vDisconnect)
+        if (pindex->IsProofOfStake())
+            setStakeSeen.erase(make_pair(pindex->prevoutStake, pindex->nStakeTime));
+
     // Connect longer branch
     vector<CTransaction> vDelete;
     for (unsigned int i = 0; i < vConnect.size(); i++)
@@ -2765,13 +2771,22 @@ bool CBlock::AddToBlockIndex(unsigned int nFile, unsigned int nBlockPos, const u
 
     // New best — keep the batch open so SetBestChain can add ConnectBlock
     // writes to the same transaction, cutting the per-block commit count in half.
-    // v5.4: deterministic tiebreaker — when two chains have equal trust,
-    // all nodes agree on the one whose tip has the lower block hash.
-    // This prevents permanent forks from PoS blocks with identical difficulty.
+    //
+    // Chain selection rules:
+    //   1. Strictly greater trust always wins (normal case).
+    //   2. Equal trust with shallow fork (parent in main chain): use
+    //      deterministic hash tiebreaker — lower tip hash wins. This
+    //      resolves single-block PoS races where two stakers find valid
+    //      blocks at the same height with identical difficulty.
+    //   3. Equal trust with deep fork (parent NOT in main chain): do NOT
+    //      reorg. Without this rule, Tor-latency-induced multi-block
+    //      forks cause nodes to oscillate between competing chains of
+    //      similar trust, preventing convergence.
     bool fNewBest = false;
     if (pindexNew->nChainTrust > nBestChainTrust)
         fNewBest = true;
     else if (pindexNew->nChainTrust == nBestChainTrust && pindexBest &&
+             pindexNew->pprev && pindexNew->pprev->IsInMainChain() &&
              pindexNew->GetBlockHash() < pindexBest->GetBlockHash())
         fNewBest = true;
 
@@ -2814,8 +2829,14 @@ bool CBlock::CheckBlock(bool fCheckPOW, bool fCheckMerkleRoot, bool fCheckSig) c
     if (fCheckPOW && IsProofOfWork() && !CheckProofOfWork(GetHash(), nBits))
         return DoS(50, error("CheckBlock() : proof of work failed"));
 
-    // Check timestamp
-    if (GetBlockTime() > FutureDrift(GetAdjustedTime()))
+    // Check timestamp: reject blocks obviously too far in the future.
+    // Use a generous 15-minute window from the raw system clock.
+    // GetAdjustedTime() is NOT used here because it incorporates peer-reported
+    // time offsets that differ between Tor nodes, causing nondeterministic
+    // block rejection — the primary cause of persistent chain splits.
+    // The deterministic timestamp checks in AcceptBlock (median-time-past,
+    // prev-block-time with 3-min drift) still enforce tight rules.
+    if (GetBlockTime() > GetTime() + 15 * 60)
         return error("CheckBlock() : block timestamp too far in the future");
 
     // First transaction must be coinbase, the rest must not be

src/main.h

@@ -62,8 +62,12 @@ static const uint256 hashGenesisBlockTestNet ("0x7e7a6e4dd5fe895106fca912dfbacae
 inline int64_t GetMaxTimeDrift(int nHeight) { return (nHeight >= FORK_HEIGHT_V5_4) ? 3 * 60 : 10 * 60; }
 inline int64_t PastDrift(int64_t nTime, int nHeight)   { return nTime - GetMaxTimeDrift(nHeight); }
 inline int64_t FutureDrift(int64_t nTime, int nHeight)  { return nTime + GetMaxTimeDrift(nHeight); }
-inline int64_t PastDrift(int64_t nTime)   { return PastDrift(nTime, nBestHeight); }
-inline int64_t FutureDrift(int64_t nTime) { return FutureDrift(nTime, nBestHeight); }
+// Height-less overloads always use post-V5.4 rules (3-min drift).
+// All nodes are well past FORK_HEIGHT_V5_4; using the global nBestHeight
+// here previously caused nodes at different heights to disagree on block
+// validity during the fork transition — a consensus-splitting bug.
+inline int64_t PastDrift(int64_t nTime)   { return PastDrift(nTime, FORK_HEIGHT_V5_4); }
+inline int64_t FutureDrift(int64_t nTime) { return FutureDrift(nTime, FORK_HEIGHT_V5_4); }
 
 
 extern CScript COINBASE_FLAGS;