fix(consensus): correct weighted round-robin proposer selection

Author: qj0r9j0vc2

crates/consensus/src/proposer_selector.rs

@@ -30,6 +30,8 @@ pub struct ProposerSelector {
     total_voting_power: RwLock<u64>,
     /// Last (height, round) where priorities were synchronized
     last_synced: RwLock<(ConsensusHeight, Round)>,
+    /// Proposer from the last advance (for idempotent queries)
+    last_proposer: RwLock<Option<ConsensusAddress>>,
 }
 
 impl ProposerSelector {
@@ -53,6 +55,7 @@ impl ProposerSelector {
             priorities: RwLock::new(priorities),
             total_voting_power: RwLock::new(total_voting_power),
             last_synced: RwLock::new((initial_height, Round::Nil)),
+            last_proposer: RwLock::new(None),
         }
     }
 
@@ -69,30 +72,32 @@ impl ProposerSelector {
         let mut priorities = self.priorities.write();
         let total_power = *self.total_voting_power.read();
         let mut last_synced = self.last_synced.write();
+        let mut last_proposer = self.last_proposer.write();
 
         let (last_height, last_round) = *last_synced;
 
         // Calculate total advances needed from last synced point to (height, round)
         let advances = Self::compute_advances(last_height, last_round, height, round);
 
+        // Track the proposer from advances (the proposer is determined DURING advance,
+        // not after, because advance_one_round penalizes the proposer)
+        let mut proposer_addr = None;
         for _ in 0..advances {
-            Self::advance_one_round(&mut priorities, total_power);
+            proposer_addr = Self::advance_one_round(&mut priorities, total_power);
         }
 
+        // If no advances needed, use the cached last_proposer (idempotent query)
+        let proposer_addr = if advances == 0 {
+            last_proposer.expect("last_proposer should be set after first advance")
+        } else {
+            let addr = proposer_addr.expect("should have proposer after advances");
+            *last_proposer = Some(addr);
+            addr
+        };
+
         // Update sync point
         *last_synced = (height, round);
 
-        // Find proposer (highest priority, tie-break by address for determinism)
-        let proposer_addr = priorities
-            .iter()
-            .max_by(|a, b| {
-                a.priority
-                    .cmp(&b.priority)
-                    .then_with(|| a.address.cmp(&b.address))
-            })
-            .map(|p| p.address)
-            .expect("validator set must not be empty");
-
         // Return reference from the validator set
         validator_set
             .as_slice()
@@ -137,17 +142,20 @@ impl ProposerSelector {
         }
 
         // Different heights:
-        // Each height transition + target round advances
-        // height_diff accounts for moving through heights, to_r for rounds in target
-        // Add 1 because entering a new height's round 0 is itself an advance
+        // Each height transition counts as one advance, plus any rounds within the target height.
+        // Example: (1,0) -> (2,0) = 1 advance, (1,0) -> (2,1) = 2 advances, (1,0) -> (3,0) = 2 advances
         let height_diff = to_h - from_h;
-        height_diff + (to_r as u64) + 1
+        height_diff + (to_r as u64)
     }
 
     /// Single round advancement of the Tendermint algorithm.
-    fn advance_one_round(priorities: &mut [ValidatorPriority], total_power: u64) {
+    /// Returns the proposer address for this round.
+    fn advance_one_round(
+        priorities: &mut [ValidatorPriority],
+        total_power: u64,
+    ) -> Option<ConsensusAddress> {
         if priorities.is_empty() || total_power == 0 {
-            return;
+            return None;
         }
 
         // Step 1: Increase all priorities by their voting power
@@ -167,10 +175,14 @@ impl ProposerSelector {
             .map(|(idx, _)| idx)
             .unwrap();
 
+        let proposer_addr = priorities[proposer_idx].address;
+
         // Step 3: Decrease proposer's priority by total voting power
         priorities[proposer_idx].priority = priorities[proposer_idx]
             .priority
             .saturating_sub(total_power as i64);
+
+        Some(proposer_addr)
     }
 
     /// Center priorities around zero to prevent overflow.
@@ -264,6 +276,7 @@ impl Clone for ProposerSelector {
             priorities: RwLock::new(self.priorities.read().clone()),
             total_voting_power: RwLock::new(*self.total_voting_power.read()),
             last_synced: RwLock::new(*self.last_synced.read()),
+            last_proposer: RwLock::new(*self.last_proposer.read()),
         }
     }
 }