fix(sysio): preserve epoch batch reward rosters (WIRE-343) - #576

Design looks sound — the roster recorded by rcrdbatch is read after the window slide so it matches the epoch/group accrueepoch credits, the KV key is big-endian so batchepochs iterates in ascending epoch order (contiguity walk is valid), the erase(it) loop is safe, and ABI table_id 22503 has no collisions.

5 findings inline: 2 chain-halt risks on the mandatory advance inline path, 1 missing build artifact, 2 minor.

Re-reviewed at 1ab98aff5 (after the artifact refresh). Status of the 2026-08-20 findings, plus one new one.

Resolved

• sysio.system.abi:2124 — artifact mismatch. 1ab98aff5 adds both sysio.system.wasm and sysio.epoch.wasm, so the source-tree pair is consistent again. One nit for the squash: that commit touches only the two .wasm files with no accompanying source change, which is the shape commit-wasm-only-with-source-change.md bans per-commit. The PR as a whole pairs source with artifacts, so this is history hygiene rather than a provenance gap.

Still open, unchanged at head

• emissions.cpp:684 — rcrdbatch's cap throw on the mandatory inline advance path.
• emissions.cpp:823 — incomplete-history hard abort. One more concrete trigger added in that thread.
• emissions.cpp:1043 — the clear loop is still outside the accrued_epochs > 0 guard: the guard opens at L1035 and closes at L1039, and batch_history.erase runs unconditionally at L1043.
• sysio.epoch.cpp:889 — payepoch's now-unused second parameter is still serialized on every pay epoch.

New

• emissions.cpp:678 — an O(cadence × roster) deserialize on every advance, used only to produce a count. Inline below.

Re-reviewed at 619f5d0a5. All six findings from the previous rounds are fixed — confirmed against the source, so I'm resolving those threads:

The effective_pay_cadence_epochs clamp is a good addition I hadn't asked for. Payout math, roster/epoch attribution, the contiguity triple, big-endian KV ordering, and erase(const_iterator) safety in the clear loop all verified sound.

Four new findings inline. The first one is a refinement of my own earlier suggestion — I proposed "print and retain in treasury" to remove the halt cliff, and retained turns out to mean permanently absorbed, which isn't what I intended.

Re-reviewed at dab8091ed. Converging — the previous round's four findings are addressed and only two new ones surfaced, one of which is a residual of finding 1 rather than something new.

Verified this round: the period length is provably <= MAX_PAY_CADENCE_EPOCHS, so rcrdbatch's exact epoch_index - 10 prune holds the table at <= 10 rows; sum(active_epochs) == accrued_epochs by construction, so the two integer divisions partition the pools exactly with no div-by-zero; batch_payout_credits is provably <= 100 for any setter-accepted config; the runtime credit cap is fail-safe (it routes to retention rather than paying some operators and not others); and the reworked epochlog prune is exact.

Two items below, plus a question about the cadence ceiling that I think needs a decision before this merges.

Re-reviewed at 5acf5d6c44. The four findings from the previous round are fixed. Since the change since then is the master merge, I checked the merge itself rather than just the source diff:

• Both conflicted wasms were rebuilt from merged source, not resolved by picking a side: each blob differs from both parents, the merged sysio.epoch.wasm carries master's SOL-378 withhold diagnostic alongside this PR's cadence check, and master's removed delsnapprov is absent from the merged sysio.system.wasm.
• The merge tree differs from the mechanical auto-merge in exactly those two blobs — no source edits rode along — and every other contract artifact is byte-identical to master.
• The merged ABI is the exact union: rcrdbatch / batch_epoch / batchepochs / the three epochlog fields added, master's delsnapprov and threshold_pct dropped.
• No semantic conflict with SOL-378: rcrdbatch still receives the group on duty now while the attestation ships the lookahead index, and the empty-group withhold skips the queueout without returning from advance — so rcrdbatch still pairs with every accrueepoch and this PR's contiguity invariant holds.
• WIRE-375's symbol refactor is constant-only (same {"WIRE", 9}) and leaves drainrewards untouched, so the fee-deferral path is unaffected.

On the round-4 fixes: the credit-cap trip and the over-long-history break both set batch_history_complete = false before the drain gate, so an over-budget roster no longer sweeps a bucket it cannot distribute; effective_pay_cadence_epochs divides by max(operators_per_epoch, 1); and the reserv side tolerates deferral (add_capped_u64 accrual, get_reserv_rewards_balance clamped to asset::max_amount).

Two low items inline. Worth watching this head's CI specifically: the merge pairs master's regenerated unittests/snapshots/* and deep-mind.log with two freshly rebuilt production wasms, a combination neither side has run.