review pass 64 (Codex): reset recheck validation provenance on a stale re-latch (crash-loop follow-up)

P1 (real bug in the pass-63 A1 fix): the STALE re-latch preserved the
`validated` bit. When a peer/remote import latches with validated=true and a
later import then advances the mirror via optimistic_sync (SYNCING commit, no
new_payload) WITHOUT replacing the latch, the recheck's staleness guard
re-latches onto that optimistic mirror — and carried validated=true onto it.
A subsequent INVALID then hit `validated && target == mirror` and fail-stopped
the node: the very crash loop A1 removed, re-openable by repeated remote
input. Fix: the stale re-latch resets `validated` to false (the mirror moved
via another path, so the old target's provenance does not transfer). The
INVALID re-latch still preserves it (it re-latches onto the same just-probed
mirror). The stale-latch test now pins the reset.

P3 (operator-message defects, self-inflicted in pass 63): the plaintext-http
warning and the signed-block canonicality-fallback log had `\`-continuations
that the pass-63 edit tooling collapsed into 18-34-space gaps — the exact
B13 class. Both collapsed to normal spacing.

Verification: build clean; chain-orchestrator + rollup-node unit tests 51/51
(the 6 recheck tests included); clippy -D warnings clean; sync +
remote_block_source + e2e suites 20/22 — the two failures are
test_chain_orchestrator_l1_reorg and test_chain_orchestrator_reorg_with_gap_above_head,
both the tracked issue #44 nippy-jar storage flake (reorg tests under battery
memory pressure), each passing standalone (18s/22s); neither path is touched
by this change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: vmarkushin

crates/chain-orchestrator/src/lib.rs

@@ -548,7 +548,7 @@ impl<
                                 target: "scroll::chain_orchestrator",
                                 block_number = block.header.number,
                                 ?outcome,
-                                "Could not confirm signed-block canonicality; proceeding on the                                  full path (anchor write is monotone)"
+                                "Could not confirm signed-block canonicality; proceeding on the full path (anchor write is monotone)"
                             );
                             true
                         }
@@ -2274,8 +2274,13 @@ impl<
                 ?mirror,
                 "Engine head moved since the L2 sync latch; re-latching onto the current head"
             );
+            // Reset `validated`: the mirror moved via ANOTHER path (possibly
+            // optimistic_sync, which commits on SYNCING without a new_payload),
+            // so the old target's validation provenance does not transfer to
+            // this new head. Carrying it would let a later INVALID fail-stop the
+            // node on an optimistically-committed head — the crash loop A1 fixed.
             self.l2_sync_recheck_target =
-                Some(L2SyncRecheck { target: mirror, latched_from: mirror, validated });
+                Some(L2SyncRecheck { target: mirror, latched_from: mirror, validated: false });
             return Ok(());
         }
 
@@ -3560,7 +3565,9 @@ mod run_loop_policy_tests {
             Some(super::L2SyncRecheck {
                 target: info(SAFE, 0x11),
                 latched_from: info(SAFE, 0x11),
-                validated: true,
+                // Provenance is RESET on a stale re-latch: the mirror moved via
+                // another path, so the old validated bit must not transfer.
+                validated: false,
             }),
             "the stale latch must be REPLACED by one onto the current mirror: clearing it would \
                          leave L2 syncing with no recovery target, and on a quiescent chain nothing reopens that gate"

crates/node/src/args.rs

@@ -252,7 +252,7 @@ impl ScrollRollupNodeConfig {
                     tracing::warn!(
                         target: "scroll::node::args",
                         host,
-                        "remote-source.url is plaintext http to a non-loopback host;                          remote-source imports bypass consensus/signer validation and can                          rewind the local head — prefer https"
+                        "remote-source.url is plaintext http to a non-loopback host; remote-source imports bypass consensus/signer validation and can rewind the local head — prefer https"
                     );
                 }
             }