feat(stages): handle partial trie unwinds

[mediocregopher]

Extracts the staged pipeline unwind handling from #24100.

On startup, a lagging partial_state_trie frontier first unwinds to the durable trie tip with full changed-branch walks. A lower RocksDB/static-file target then runs as a separate normal unwind.

walk_all_changed_branch_children

This new flag is required when unwinding to partial_state_trie in order to handle the following scenario:

• Block 10: hash of child 2 of trie node N is updated
• Block 14: hash of child 4 of trie node N is updated
• Block 10->12 is persisted, 13->14 masking
  • trie node N is not persisted, because it is masked
• kill -9

In this situation we would unwind 14->12. However when doing the unwind only N's child 4 will be in the prefix set which is used; 2 will not be in the prefix set because it was only updated in block 10. Because of this a stale hash for 2 would get used, and any ancestor cached hashes would end up incorrect as well.

The fix is to enable this walk_all_changed_branch_children mode, under which the TrieWalker will visit all children of a branch when just one child of the branch is in the prefix set. This way any stale sibling hashes are also refreshed.

A durable metadata marker records the original Finish and partial-state-trie frontiers before recovery starts. Interrupted recovery resumes from this marker, which is deleted only after the special unwind completes successfully.

[mediocregopher]

cyclops audit

[github-actions]

cc @mediocregopher

Cyclops audit event published. View workflow run

Config: config: default, iterations: default, hours: default

[tempoxyz-bot]

👁️ Cyclops Security Review

eaa869d

🧭 Auditing · mode=normal · workers 0/2 done (2 left) · verify pending 0

Worker	Engine	Latest Status	Status
pr-26543-w1	gpt-5.5	Not started	Running
pr-26543-w2	claude-opus-5	Not started	Running

⚙️ Controls

• 🚀 Keep only 1 remaining iteration per worker after the current work finishes.
• 👀 Keep only 2 remaining iterations per worker after the current work finishes.
• ❤️ Let only worker 1 continue; other workers skip queued iterations.
• 😄 Let only worker 2 continue; other workers skip queued iterations.
• 🎉 End faster by skipping queued iterations and moving toward consolidation.
• 😕 Stop active workers/verifiers now and start consolidation immediately.

[tempoxyz-bot]

👁️ Cyclops Review

Found 3 actionable findings, all in the new partial-trie startup recovery orchestration. The trie-walker flag propagation appears targeted, but the startup unwind scheduler needs stronger crash-consistency, target-readability, and pruning-retention checks before this recovery path is safe.

Reviewer Callouts

• ⚡ Crash consistency of startup unwinds: The new recovery path relies on normal per-stage pipeline commits; review every crash point between FinishStage and MerkleUnwind for resumability.
• ⚡ Partial persistence with pruning: Review how num_state_masking_blocks, persistence thresholds, and account/storage prune modes interact so crash-recovery history cannot be pruned away.
• ⚡ Combined recovery ordering: Re-check mixed partial-trie and storage/static-file inconsistency cases, especially Headers, so the first queued target is always readable and lower repair targets are not skipped.
• ⚡ Trie walker resumed stacks: with_walk_all_changed_branch_children does not recompute can_skip_current_node after constructing a walker from an existing stack; current partial recovery uses fresh walkers, but future resumed use of this mode should be audited.