bug: MsgSet::rm() does not advance next_sequence past buffered successors on applied removal

[coderabbitai]

Description

In src/message_pool/msgpool/msg_set.rs, the rm() method's applied=true branch for a known message (one that is present in the pool) stops advancing next_sequence at sequence + 1. This is inconsistent with the unknown message branch above it, which runs a gap-filling loop to advance past any consecutive buffered messages.

Example: If nonce 5 is applied on-chain while nonce 6 is already buffered in self.msgs, next_sequence becomes 6 instead of 7. Any caller querying the next sequence for this sender will be told they can reuse nonce 6, even though it is still pending.

Affected Code

File: src/message_pool/msgpool/msg_set.rs

if applied {
    // we removed a (known) message because it was applied in a tipset
    // we can't possibly have filled a gap in this case
    if sequence >= self.next_sequence {
        self.next_sequence = sequence + 1;
        // ❌ Missing gap-filling loop here
    }
}

Suggested Fix

 if applied {
     // we removed a (known) message because it was applied in a tipset
     if sequence >= self.next_sequence {
         self.next_sequence = sequence + 1;
+        while self.msgs.contains_key(&self.next_sequence) {
+            self.next_sequence += 1;
+        }
     }
 }

Context

This bug was carried over from the original msg_pool.rs implementation and surfaced during the refactor in PR #6965. It needs verification and a targeted fix.

References

• Identified in: refactor: msg pool to make more structured #6965 (comment)
• Reported by: @akaladarshi