fix: validate PTC duty assignments

[shane-moore]

Problem, Evidence, and Context

Addresses the PTC assignment portion of #1295. Incoming PTC partial signatures currently have no duty-assignment check. SIP-94 section 7 requires ignoring messages for known unassigned slots while tolerating unknown duty views.

Change Overview

• Poll current-epoch PTC duties for all locally known indexed validators, including validators whose messages this operator only relays.
• Track the exact queried indices in an atomically replaced snapshot. A queried validator omitted from the response is known unassigned; an index learned during the request remains unknown until queried. Failed or malformed responses retain the prior snapshot, and the previous epoch remains available for late messages.
• Apply the existing NoDuty/Ignore result only to known unassigned PTC messages. Unknown views continue through the existing validation checks. Proposer preferences, envelope duties, and Lighthouse are unchanged; The proposer preferences duty and the execution payload envelope duty have no tolerance for a stale duty view #1295 remains open for its other concerns.

Risks, Trade-offs, and Mitigations

Querying all known indices adds beacon-node work. Lighthouse's producer cache covers local shares and does not record the query coverage needed for this receive-side check. The tracker therefore owns this snapshot. Full-network query capacity and a hard one-slot freshness bound are not established. Transition tests cover concurrent registration, failed refreshes, and epoch retention.

Validation

• cargo test -p duties_tracker -p message_validator --locked: 161 passed, including eight new HTTP, snapshot, and admission regression tests.
• make cargo-fmt-check, make lint, make sort, and git diff --check: passed.
• Latest make test: 312 passed before two unchanged public-RPC tests failed. Direct probes confirmed hostname-resolution failures for their endpoints, eth.merkle.io and ethereum-rpc.publicnode.com.
• Local ssv-mini with one Anchor, three Go operators, Lodestar/Geth, and ten managed validators: 108 Go PTC partials across 36 validator duties matched Anchor's post-admission traces, with no new PTC polling or invalid-schedule errors. Runtime coverage is ordinary PTC receive traffic; known-negative rejection and concurrent registration are covered by regression tests. The runtime used the implementation commit; subsequent cleanup changes only tests and dev dependencies.

Rollback

Revert this PR. The snapshot is in memory; no configuration or database migration is required.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 99.00000% with 1 line in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (epbs@ff74ca0). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
anchor/duties_tracker/src/duties_tracker.rs	98.24%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             epbs    #1299   +/-   ##
=======================================
  Coverage        ?   78.97%           
=======================================
  Files           ?      179           
  Lines           ?    39732           
  Branches        ?        0           
=======================================
  Hits            ?    31377           
  Misses          ?     8355           
  Partials        ?        0           

Flag	Coverage Δ
rust	78.97% <99.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[shane-moore]

Reviewed b9880834 against epbs at ff74ca08.

No findings survived the three-pass review. The snapshot records exactly the queried indices, preserves unknown coverage during registration changes, and replaces assignments atomically. The PTC gate ignores known-unassigned messages without consuming accepted-duty state; unknown views continue through the remaining checks.

Verified CI logs for the PR merge checkout: 952 tests passed in both debug and release, including all eight new PTC tests. Tests were not rerun locally for this review.

Full-network polling cost and a hard one-slot refresh bound remain unmeasured, as documented in the PR. No blocker found within this PTC-only scope; the remaining proposer/envelope concerns in #1295 are outside it.

Reviewed by gpt-6-astra high.