huskies: merge 537_bug_delete_item_sets_stage_to_deleted_string_instead_of_writing_a_crdt_tombstone

crates/bft-json-crdt/src/json_crdt.rs

@@ -287,14 +287,22 @@ impl<T: CrdtNode + DebugView> BaseCrdt<T> {
         // self.log_actually_apply(&op);
         let status = self.doc.apply(op.inner);
         // self.debug_view();
-        self.received.insert(op_id);
 
-        // apply all of its causal dependents if there are any
-        let dependent_queue = self.message_q.remove(&op_id);
-        if let Some(mut q) = dependent_queue {
-            self.queue_len = self.queue_len.saturating_sub(q.len());
-            for dependent in q.drain(..) {
-                self.apply(dependent);
+        // Only record the op as seen when it applied successfully.  If the op
+        // was rejected (e.g. ErrHashMismatch from a tampered payload), we must
+        // NOT add its signed_digest to `received`: a legitimate op that shares
+        // the same signed_digest (e.g. the un-tampered original) would otherwise
+        // be silently dropped as AlreadySeen.
+        if status == OpState::Ok {
+            self.received.insert(op_id);
+
+            // apply all of its causal dependents if there are any
+            let dependent_queue = self.message_q.remove(&op_id);
+            if let Some(mut q) = dependent_queue {
+                self.queue_len = self.queue_len.saturating_sub(q.len());
+                for dependent in q.drain(..) {
+                    self.apply(dependent);
+                }
             }
         }
         status