Fix endorsed certificate data race

[Amaury Chamayou (achamayou)]

Summary

• publish HashedTxHistory's endorsed certificate as an immutable atomic snapshot
• make pending signature transactions retain the certificate snapshot captured when they are created
• add deterministic coverage for certificate replacement while a signature is queued, plus concurrent update/emission coverage for TSAN

Why

The node-endorsed-certificate local hook can call set_endorsed_certificate() while the periodic signature task is constructing a PrimarySignature. The setter replaced an optional<Pem> while MerkleTreeHistoryPendingTx retained a reference to its contents, producing the data race reported by the Long Test TSAN job for #8243.

No existing history lock is appropriate here: the setter runs from a KV hook while map locks are held, so taking state_lock or signature_lock would add a new lock-order edge. Atomic publication of an immutable snapshot gives readers stable ownership without extending the hook's lock chain.

This is independent of the #8243-#8246 stack. #8209 and the #8238 test harness also touch history.h and should preserve this snapshot ownership when rebased.

Testing

• Debug build of history_test
• build/tests.sh -R '^history_test$'
• TSAN build of history_test
• build-tsan/tests.sh -R '^history_test$'
• C++ formatting and source dependency checks

Long Test CI is enabled on this draft.

Closes #8273

[Copilot]

🟡 Changes recommended

The new TSAN coverage test introduces a tight busy-loop updater that can cause unnecessary CPU/malloc churn and slow or destabilize CI under sanitizers.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR fixes a TSAN-reported data race in the node history signature path by changing endorsed-certificate publication from a mutable in-place object to an immutably-owned snapshot, so pending signature transactions retain stable certificate ownership even if the certificate is concurrently replaced.

Changes:

• Publish HashedTxHistory’s endorsed certificate via std::atomic<std::shared_ptr<const Pem>> and load an immutable snapshot when emitting signatures.
• Update MerkleTreeHistoryPendingTx to own the certificate snapshot (shared_ptr) rather than referencing history-owned storage.
• Add unit test coverage to deterministically validate snapshot retention across a queued signature, plus concurrent update/emission coverage for TSAN.

Custom instructions used: None (no repository instruction files were explicitly loaded during this review).

File summaries

File	Description
src/node/history.h	Replace mutable optional endorsed cert with atomically-published immutable snapshot; pending signature tx owns snapshot via shared_ptr.
src/node/test/history.cpp	Add deterministic regression test for cert snapshot retention and a concurrent updater/emitter loop for TSAN coverage.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.