Errata records

[tinker-michaelj]

Background

Bugs in consensus node software can cause export of incomplete or incorrect data in the record stream; so we need a way to issue errata records.

There are three actions we might want to support:

1. Issue an errata record at time T2 that mirror nodes can use to correct a mistake at time T1 < T2.
2. Issue an errata record at time T3 that mirror nodes can use to correct an errata issued at time T2.
3. "Recall" a bad record from T0 by injecting a sidecar errata at position T0 in the record stream.

In this idea we address (1) and (2); but not (3), since mirror node sync times are sufficiently long that there is no practical reason to ever start a sync from any but the latest snapshot. This means there is no practical benefit to decorating the stream with an errata at some time T0 << now, since no syncing node will ever "be there" to appreciate it.

Proposal

Define a new TransactionBody type,

message RecordStreamErrataTransactionBody {
    // The (past) consensus time at which an export error occurred
    Timestamp consensus_time_of_error = 1;

    // The data that should have been exported (unset if no data should have 
    // been exported); allows mirror nodes to fix transaction history tables
    RecordStreamItem correct_item = 2;

    // One or more synthetic transactions whose side effects, when incorporated
    // in the mirror node database in the normal way, will bring its present state
    // back in alignment with the consensus node state; these items must NOT
    // be inserted in any transaction history tables
    repeated RecordStreamItem compensating_items = 3;
}

Add a NetworkService RPC named issueRecordStreamErrata to submit this transaction body and require a superuser payer account (either 0.0.2 or 0.0.50). If an incorrect errata for time T1 is issued at time T2, it can be resolved by simply issuing another errata for time T1 at T3, where the compensating_items at T3 take into account the effects of the compensating_items issued at T2.

Please note this idea does not propose, or even address, a mechanism to change any consensus node state other than the record stream running hash. Its sole goal is to support bringing mirror nodes back in sync with consensus nodes.