fix(jwk): preserve certification on duplicate observations

[ByteYue]

Summary

• treat an observation matching the active InProgress or Finished proposal as an idempotent no-op
• reject quorum-certified updates that do not match the currently active proposal
• extend the JWK manager state-transition test across regular JWK observations and nonce-backed Gravity observations

Root cause

Observers periodically replay cached results. The manager previously compared each result only with on-chain state, then unconditionally replaced its local consensus state. Replaying an identical proposal could therefore drop the existing reliable-broadcast guard while certification was in progress, or drop the validator-transaction guard after certification and remove the transaction from the pool. A quorum certificate from a replaced session could also finish the newer session because it was not bound to the active proposal.

Live reproduction

A four-validator Wave 7 live soak using real Binance testnet closed one-minute index klines reproduced the failure on the current aptos-node base:

• the built-in coordinated node4 restart at hour 12 completed successfully; RPC recovered, block height caught up, all three feeds returned to 4/4 source progress, and nonces continued advancing
• near hour 15, every validator had fetched BTCUSDT and ETHUSDT nonce 901 while execution remained at nonce 900
• duplicate observations repeatedly restarted certification at local voting power 2, below the quorum threshold of 6
• NVDAUSDT continued to nonce 906 and the chain remained live, isolating the failure to per-proposal JWK certification progress
• the soak detected the stall after 367 seconds

This is direct production-like evidence for Galxe/gravity-audit#910. A post-fix live soak remains the merge-follow-up verification.

Compatibility

This is a local JWK manager state-machine fix. It does not change serialized types, validator messages, on-chain storage, quorum thresholds, or execution payloads. Different observations can still replace an in-progress proposal; only exact proposal replays are suppressed.

Testing

• cargo test -p aptos-jwk-consensus (2 passed)
• git diff origin/aptos-node...HEAD --check
• rebased onto current aptos-node commit a64f8adc27

Closes Galxe/gravity-audit#910

[ByteYue]

CI triage update:

• test-fuzzers is an infrastructure failure. The hosted runner reported only 7 MB free and failed both nightly toolchain installations with No space left on device (os error 28).
• rust-cargo-deny is unrelated to this two-file JWK state-machine diff. The job rejects the existing dependency tree's Unicode-3.0 licenses (ICU4X and related crates); this PR changes neither dependencies nor Cargo.lock.
• Local package validation remains green: cargo test -p aptos-jwk-consensus passes 2/2, and git diff origin/aptos-node...HEAD --check passes.

I will also exercise this exact PR commit in an isolated four-validator Wave 7 multi-restart live regression while review proceeds. The formal 24-hour run will use the final merged aptos-node SHA.

[ByteYue]

Additional live evidence for this fix: PASS.

The exact head commit was used in a coordinated 4-validator Oracle build. A 1,204.657-second live run consumed real Binance testnet NVDAUSDT/BTCUSDT/ETHUSDT index klines plus a finalized Polygon/Polymarket settlement, and restarted node4 three times. Recovery durations were 13.169s / 13.171s / 13.168s. After every restart all three price feeds returned to 4/4 quorum and continued advancing; final advances were 21 / 22 / 21 with callback counts matching final nonces exactly. No duplicate-observation certifier stall reproduced.

The previously reported CI failures remain unrelated hosted-runner disk/license-policy failures; local aptos-jwk-consensus tests and this cross-repo live regression both pass.

[ByteYue]

24-hour integration evidence

This PR head (c7cb7f1b07a00e47fecb53fb7e810e13b971c27f) was included in the Wave 7 candidate used for the completed 24-hour live soak:

• 4 validators with real Binance testnet feeds and finalized Polygon input.
• All three one-minute feeds advanced 1,440 rounds and finished at 4/4 relayer quorum.
• The epoch-guarded midpoint node4 restart completed, caught up, and the cluster continued for roughly another 12 hours without losing quorum.

The only end-of-run failure was an SDK report query exceeding the RPC eth_getLogs range limit; it did not originate in JWK consensus or validator recovery and has been fixed in SDK PR aptos-labs#807.