fix(x/audit): bootstrap-recovery exception when active set is empty

[mateeullahmalik]

Summary

Fixes the empty active set deadlock in the audit module: when all supernodes are simultaneously POSTPONED, the existing peer-port recovery rule in shouldRecoverAtEpochEnd becomes unsatisfiable by construction (zero probers ⇒ zero peer reports ⇒ no SN can recover). The chain cannot self-heal and recovery requires every validator key holder to perform a manual deregister + re-register cycle out-of-band — a distributed coordination problem on mainnet.

This PR adds a bootstrap-recovery exception: when the epoch's anchored active set is empty AND the POSTPONED SN submits a compliant self host-report, the SN recovers to ACTIVE.

Why this matters (live mainnet evidence)

Queried lumera.audit.v1.Query/Params at mainnet height 5,001,129:

required_open_ports:            [4444, 4445, 8002]
consecutive_epochs_to_postpone: 1     ← one missed epoch postpones
peer_port_postpone_threshold_percent: 100
epoch_length_blocks: 400              (~40 min epochs)

Current state: 15 ACTIVE / 11 POSTPONED / 2 DISABLED — thin active margin.

Realistic upgrade-day trigger: an upgrade-halt window plus rolling restart lag of >40 min for a subset of SNs ⇒ those SNs miss one epoch ⇒ POSTPONED in lockstep. If the surviving active set drops to zero, the deadlock locks in permanently.

Two governance escape hatches that LOOK viable but DON'T WORK were verified on devnet 2026-05-08 (gov proposal 33 PASSED on-chain but silently no-op'd):

• MsgUpdateParams with required_open_ports=[] is silently re-filled to defaults by Params.WithDefaults() (x/audit/v1/types/params.go:406-407)
• Even if step 1 were bypassed, Params.Validate() line 619 rejects empty list

The deadlock is a real protocol-level design gap, not a devnet quirk.

What changed

x/audit/v1/keeper/enforcement.go::shouldRecoverAtEpochEnd — adds an 11-line branch that fires when GetEpochAnchor(epochID).ActiveSupernodeAccounts is empty, after the existing storage-truth / action-finalization redirects and after selfHostCompliant. A misbehaving SN cannot self-recover via this branch — self-compliance still gates it.

Invariants preserved

Invariant	Status
Determinism	✓ Reads existing deterministic state (EpochAnchor) frozen at epoch start
Cosmos replay-safety	✓ No new external calls, no wall-clock, no map iteration
Storage-truth recovery semantics	✓ Redirect to shouldRecoverFromStorageTruthPostponement runs first, bootstrap branch NOT taken
Action-finalization recovery semantics	✓ Redirect to shouldRecoverFromActionFinalizationPostponement runs first, bootstrap branch NOT taken
Self-compliance gate	✓ Still mandatory before the bootstrap branch
Legacy peer-port recovery (non-empty anchor)	✓ Unchanged when anchor has ≥1 active account

Test matrix (5 cells, all PASS)

x/audit/v1/keeper/enforcement_empty_active_set_test.go:

Anchor active count	Self-report	Self-compliant	Peer all-open	Expected	Test
0	yes	yes	n/a	recover ✓	TestEnforceEpochEnd_EmptyActiveSet_PostponedRecoversViaBootstrapException
0	no	n/a	n/a	NO recover	TestEnforceEpochEnd_EmptyActiveSet_NoSelfReport_NoRecover
0	yes	no (disk > min)	n/a	NO recover	TestEnforceEpochEnd_EmptyActiveSet_NonCompliantSelf_NoRecover
≥1	yes	yes	no	NO recover (legacy)	TestEnforceEpochEnd_NonEmptyActiveSet_NoPeerObs_NoRecover
no anchor	yes	yes	n/a	NO recover (legacy)	TestEnforceEpochEnd_NoEpochAnchor_FallsThroughToLegacyPath

The pre-existing test TestEnforceEpochEnd_EmptyActiveSet_PostponedCannotRecover that asserted the deadlock is inverted to the new contract (Times(2) recovery instead of Times(0)).

Risk

LOW. The bootstrap branch is reachable only when:

1. No storage-truth postponement at this epoch, AND
2. No action-finalization postponement at this epoch, AND
3. SN submitted a compliant self host-report, AND
4. Epoch anchor exists AND active set is empty

In any normal operating state (≥1 ACTIVE), the branch is skipped and the legacy peer-port path runs unchanged. Determinism preserved.

Rollback

git revert <commit>. The legacy peer-port deadlock returns; recovery still possible via the documented deregister + re-register procedure (internal runbook: lumera-supernode-postponed-recovery).

Migration / upgrade notes

None. Pure logic change in EnforceEpochEnd's recovery branch. No state-key changes, no proto changes, no consensus version bump. Safe to ship as a minor-version logic patch (e.g. v1.20.x). Activates the moment the upgraded binary runs — no proposal-side toggle required.

IBC / interop

N/A — audit module is not IBC-bound.

Devnet rehearsal

Unit-level test matrix covers the bootstrap branch + the legacy-preservation cases with mocked supernode keeper. Live devnet rehearsal (force all SNs POSTPONED, wait for next epoch end, verify auto-recovery without manual deregister/register) is planned as part of the v1.20 upgrade-rehearsal gate.

Follow-ups (not in this PR)

• PR-B (deferred): allow governance to clear RequiredOpenPorts via a sentinel value. Currently blocked by Params.WithDefaults silently re-filling the list. With PR-A landed, this is less urgent.
• PR-C (deferred): bump ConsecutiveEpochsToPostpone default from 1 to 3 (or enforce a floor in Params.Validate). Reduces the probability of triggering the empty-set condition. Can be folded into the v1.12.0 upgrade handler (proposal not yet on chain) to apply at activation without a separate gov proposal.

Files changed

• x/audit/v1/keeper/enforcement.go — +11 lines, bootstrap branch
• x/audit/v1/keeper/enforcement_empty_active_set_test.go — test matrix