fix sync: avoid spurious mhash pulls and encode race

Stop blind pulls to unpublished 32=sv prefixes on inline FULL mhash
mismatch (spec §5.6: merge inline first). Clone SvMap before encoding
outside the mutex to avoid concurrent map mutation panics.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

std/sync/svs.go

@@ -493,8 +493,11 @@ func (s *SvSync) sendSyncInterestWith(dataWire enc.Wire) {
 func (s *SvSync) encodeSyncData(reason syncSendReason, sender enc.Name) enc.Wire {
 	s.mutex.Lock()
 	s.enterSteadyState()
-	stateSnap := s.state
-	mtimeSnap := s.mtime
+	stateSnap := cloneSvMap(s.state)
+	mtimeSnap := make(map[string]time.Time, len(s.mtime))
+	for k, v := range s.mtime {
+		mtimeSnap[k] = v
+	}
 	repair, propagation := s.partialTargets()
 	s.mutex.Unlock()
 

std/sync/svs_map.go

@@ -29,6 +29,15 @@ func NewSvMap[V any](size int) SvMap[V] {
 	return make(SvMap[V], size)
 }
 
+// cloneSvMap returns a shallow copy safe for use without holding SvSync.mutex.
+func cloneSvMap[V any](m SvMap[V]) SvMap[V] {
+	out := NewSvMap[V](len(m))
+	for hash, vals := range m {
+		out[hash] = slices.Clone(vals)
+	}
+	return out
+}
+
 // Get seq entry for a bootstrap time.
 func (m SvMap[V]) Get(hash string, boot uint64) (value V) {
 	entry := SvMapVal[V]{boot, value}

std/sync/svs_pull.go

@@ -105,12 +105,11 @@ func (s *SvSync) handleMhashMismatch(args svSyncRecvSvArgs, recvSv SvMap[uint64]
 		return
 	}
 
-	ref := args.svsDataRef
-	if len(ref) == 0 {
-		ref = trustPrefix
-	}
-	if len(ref) > 0 {
-		log.Debug(s, "sync recovery path", "action", "pull", "ref", ref)
-		go s.pullFullVector(ref, trustPrefix)
+	// Inline FULL is already merged in onReceiveStateVector (spec §5.6 step 2).
+	// Pull only when the sender provided a retrievable SvsDataRef (announce-only sync).
+	if len(args.svsDataRef) == 0 {
+		return
 	}
+	log.Debug(s, "sync recovery path", "action", "pull", "ref", args.svsDataRef)
+	go s.pullFullVector(args.svsDataRef, trustPrefix)
 }

std/sync/svs_test.go

@@ -159,6 +159,28 @@ func TestSvSyncJoinLargeGroup(t *testing.T) {
 	require.EqualValues(t, 3, mesh.node("carol").svs.GetSeqNo(mesh.node("alice").producer))
 }
 
+func TestHandleMhashMismatchNoBlindPull(t *testing.T) {
+	tu.SetT(t)
+
+	mesh := newTestMesh(t, []string{"alice", "bob"}, nil)
+	defer mesh.stop()
+
+	alice := mesh.node("alice").svs
+	bobOnly := NewSvMap[uint64](0)
+	bobOnly.Set(mesh.node("bob").producer.TlvStr(), testMeshBoot, 1)
+	partialSv := bobOnly.Encode(func(s uint64) uint64 { return s })
+
+	// Bob's inline FULL with mismatched mhash; alice is not a strict superset.
+	alice.onReceiveStateVector(svSyncRecvSvArgs{
+		sv:         partialSv,
+		vectorType: optional.Some(spec_svs.VectorTypeFull),
+		mhash:      ComputeMhash(bobOnly),
+	})
+
+	// Should not hang or panic from blind pull to unpublished 32=sv prefix.
+	mesh.wait(100 * time.Millisecond)
+}
+
 func TestSvSyncMhashMismatchSenderAnnounce(t *testing.T) {
 	tu.SetT(t)