Backport release/v6.7: Fix FlatKV state sync bad-hash scenario.

[seidroid]

Backport of #4370 to release/v6.7.

[seidroid]

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-4370-to-release/v6.7
git worktree add --checkout .worktree/backport-4370-to-release/v6.7 backport-4370-to-release/v6.7
cd .worktree/backport-4370-to-release/v6.7
git reset --hard HEAD^
git cherry-pick -x 712fa98e10eb7dd3c245df4d155c4f6cbbd7a7bb
git push --force-with-lease

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 29, 2026, 6:02 PM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.55%. Comparing base (3558509) to head (c9dc93d).

Additional details and impacted files

@@               Coverage Diff                @@
##           release/v6.7    #4377      +/-   ##
================================================
- Coverage         61.37%   60.55%   -0.82%     
================================================
  Files              2163     2081      -82     
  Lines            189080   179949    -9131     
================================================
- Hits             116051   108976    -7075     
+ Misses            62295    60942    -1353     
+ Partials          10734    10031     -703     

Flag	Coverage Δ
sei-chain-pr	33.18% <100.00%> (?)
sei-db	69.80% <ø> (ø)
sei-db-state-db	?
sei-db-state-db-pr	76.49% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
sei-db/state_db/sc/flatkv/exporter.go	81.08% <ø> (ø)
sei-db/state_db/sc/flatkv/importer.go	92.03% <100.00%> (+0.78%)	⬆️
sei-db/state_db/sc/flatkv/store.go	79.28% <100.00%> (+0.19%)	⬆️
...cmd/seidb/operations/import_flatkv_from_memiavl.go	41.42% <100.00%> (ø)

... and 111 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cody-littley]

@seidroid review

[cursor]

PR Summary

High Risk
Changes state-sync import validation and LtHash integrity boundaries; incorrect ordering or caller choice between Importer vs TrustedImporter could break restores or leave a bad hash undetected on trusted paths.

Overview
Hardens FlatKV state sync by treating strictly ascending physical key order as part of the snapshot contract and rejecting imports that violate it.

CommitStore.Importer (untrusted peers / state sync) now wires KVImporter with ascending-key checks in dispatch: duplicate keys and out-of-order keys fail the import and do not finalize the store. TrustedImporter skips that check for offline migrations (e.g. memiavl → FlatKV), which may emit keys in arbitrary order. Exporter comments document the required global lexicographic order.

New tests cover duplicate-key rejection (LtHash wrap attack), descending-key rejection, and trusted import behavior; existing import tests feed nodes via addNodesInKeyOrder.

^{Reviewed by Cursor Bugbot for commit c9dc93d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

This is a clean backport of #4370. CommitStore.Importer, which handles untrusted state-sync data, now rejects the import unless physical keys arrive in strictly ascending order. That closes the gap where a peer could repeat a forged pair until its LtHash limbs wrapped to zero, so it no longer changes the root hash. The offline memiavl→FlatKV migration switches to the new TrustedImporter, which accepts keys in any order. The check sits in the single dispatch loop that every node passes through. KVExporter already emits keys in that order through RawGlobalIterator, and the tests that fed keys out of order now sort them first. I found nothing blocking.

Findings: 0 blocking | 0 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• None at the file/PR level.