Answer

Solution implemented and verified in ~/ctfork (full write-up at ~/ctfork/SOLUTION.md, copied to ~/SOLUTION.md). One command reproduces everything: cd ~/ctfork && ./verify.sh.

Detecting CT Log Equivocation from Asynchronous STHs — minimal witnesses + bounded gossip repair

1. Root-cause analysis

A CT log commits to (tree_size, root_hash) under its key; the append-only promise is that a size-m tree is a prefix of every larger tree. Equivocation = two signed heads that cannot coexist in one history. The failure modes a naive detector hits:

1. No trusted latest head across monitors. Asynchronous + partially connected monitors can each hold a different same-size head (a split view). Detection must combine observations.
2. Consistency is not transitive. union-find over "consistent" edges is unsound: a log can give valid A→B and valid A→C while B and C diverge after A. Heads must be compared pairwise (or via a proof).
3. Stale / duplicate / out-of-order input. Must be idempotent, and proofs that arrive before their STH must be buffered.
4. The RFC 6962/9162 iterative verifier terminal condition is commonly wrong. The usual final assert sn == 0 fails for non-power-of-two trees: consistency 5→6 and inclusion 2/3 correctly end at fn = sn = 1. The correct terminal test is reconstructed-root equality, with an in-loop if (sn === 0) return false guard against over-long proofs.
5. Unbounded gossip floods or loses evidence. Need MTU-bounded messages, a per-node byte budget, persistent per-neighbour queues, and proof requests.

2. Exact fix

Three layers, in src/:

• merkle.js — RFC 6962 hashing (0x00‖leaf, 0x01‖l‖r), MerkleTree proof generation, and iterative verifyInclusion / verifyConsistency using the corrected terminal condition:

function verifyInclusion(leafIndex, treeSize, leafHashValue, path, root) {
  let fn = leafIndex, sn = treeSize - 1, r = toBuffer(leafHashValue);
  for (const p of path) {
    if (sn === 0) return false;                            // proof too long
    const pb = toBuffer(p);
    if ((fn & 1) === 1 || fn === sn) r = nodeHash(pb, r);  // left sibling
    else                             r = nodeHash(r, pb);  // right sibling
    fn >>>= 1; sn >>>= 1;
  }
  return Buffer.compare(r, toBuffer(root)) === 0;          // root equality
}

function verifyConsistency(firstSize, secondSize, firstRoot, secondRoot, path) {
  if (firstSize === secondSize) return path.length === 0 && eq(firstRoot, secondRoot);
  if (firstSize === 0)          return path.length === 0 && eq(firstRoot, EMPTY_ROOT);
  if (path.length === 0)        return false;
  const p = isPowerOfTwo(firstSize) ? [firstRoot, ...path] : path;
  let fn = firstSize - 1, sn = secondSize - 1;
  while (fn & 1) { fn >>>= 1; sn >>>= 1; }
  let fr = p[0], sr = p[0];
  for (let i = 1; i < p.length; i++) {
    if (sn === 0) return false;
    const c = p[i];
    if ((fn & 1) === 1 || fn === sn) { fr = nodeHash(c, fr); sr = nodeHash(c, sr); }
    else                             { sr = nodeHash(sr, c); }
    fn >>>= 1; sn >>>= 1;
  }
  return eq(fr, firstRoot) && eq(sr, secondRoot);
}

• detector.js — streaming ForkDetector, one per log. Verifies Ed25519 signatures, dedupes by content, buffers early proofs. Sound rules: R1 same size + different root (split view, cost 0); R2 same leaf index + different hash; R3 failing consistency proof; R4 inclusion proof failing against its signed root. Every conflict carries a cost (0 for R1, else total proof hashes); minimalWitness() returns the cheapest, re-verified pair.

• gossip.js — GossipNetwork / MonitorNode: epidemic push anti-entropy with request/repair. Per-neighbour persistent queues (items dequeued only on successful send), bytesPerRound per node, maxMessageBytes MTU with batch trimming, witness broadcast, and TTL-bounded REQ for missing consistency proofs. WITNESS messages are always re-verified locally.

Eventual detection: under recurrent connectivity (for every cut and every time, a crossing link comes up later), each queued item crosses every cut in finitely many rounds, so a monitor eventually holds both conflicting heads, and R1/R2/R3/R4 fires.

3. Verification (all green)

$ cd ~/ctfork && ./verify.sh
node v22.23.2
--- unit + property tests ---
1..18
# tests 18   # pass 18   # fail 0

What is proven:

• Inclusion proofs verify for every leaf of every n ≤ 64; consistency proofs for all 1 ≤ m ≤ n ≤ 64.
• Forked roots are rejected; bit-flipped/truncated/extended proofs are rejected (0/11497 and 0/11825 mutations accepted).
• Genuine history fed shuffled/duplicated/stale produces no false fork; split-view, leaf conflict, and invalid consistency proof all detected; proofs arriving before STHs are buffered; wrong-key signatures rejected.
• Minimal witness prefers a cost 0 split view over a leaf conflict.
• Gossip: 6-node ring converges to all heads with no false fork; injected split view detected in 3 rounds; detection survives 8 rounds of a cut node; a monitor fetches a missing consistency proof from a peer ("gossip repair"); per-round and per-message bytes stay within budget.

End-to-end demo (node demo/run.js) prints the minimal witness (two signed heads, cost 0), first detection round 3, and a sample bandwidth-bounded schedule (ITEMS 340 B, WITNESS 792 B, ≤4096 B/node/round).