fix(tbtc): remove frequency gate on reservation checklist actions - #4278

…oordination

Implementation-plan.md Milestone 3, 'multi-signer simulated
integration test' item (per user decision: build the test, leave the
testnet-drill item as an agent-not-actionable tracked item since it
needs live infra and calendar time, not code).

Scales TestCoordinationExecutor_Coordinate's existing 3-operator
harness - deterministic keypairs, real per-operator localChain fakes,
a real shared netlocal.BroadcastChannel, one goroutine per operator
running coordinationExecutor.coordinate concurrently - to
ReservationAnchorProposal and ReservationReanchorProposal. This
exercises the real leader/follower coordination round-trip
(checklist generation -> leader election -> broadcast -> follower
validation -> convergence) that no mocked pkg/tbtcpg unit test can
cover, since those call task.Run(request) directly and never go
through coordinationExecutor.coordinate. It also exercises PR
#4277's protobuf marshaling of both proposal types over a real wire
round-trip, since every follower unmarshals the leader's broadcast
coordinationMessage.

Depends on PR #4278 (this branch's parent): before that fix,
ActionReservationAnchor/ActionReservationReanchor never appeared in
getActionsChecklist's output, so every operator's checklist search in
these tests would fall through to NoopProposal and fail - confirmed
by temporarily reverting the checklist fix and re-running (both new
tests failed with the expected NoopProposal mismatch), then restoring
it.

Found and fixed one bug in this test's own harness during
verification: both new tests initially shared one netlocal broadcast
channel name. getBroadcastChannel's registry is keyed by name and
never releases old channels, so under -race (which changed
goroutine/channel-delivery timing enough to surface it in ~every
run), the reanchor test's follower sometimes received a stale
broadcast left over from the anchor test's leader. Fixed by giving
each test its own channel name; re-verified stable across 10
repeated -race runs plus the full non-race and race suites.

Testing:
- go test ./pkg/tbtc/...: 365/365 pass.
- go test -race ./pkg/tbtc/...: clean, no data races, including
  -count=10 on just the two new tests.
- go build ./... && go test ./...: full repo, 49 packages, zero FAIL.
- gofmt -l / go vet: clean.

Resolves all 11 confirmed findings from review of the reservation
multi-signer coordination test:

- Bound runReservationCoordinationRound's report wait with a 30s
  timeout instead of an unbounded channel receive: at
  coordinationBlock=24562800, coordinate()'s only cancel path takes
  ~28 simulated days to fire, so any follower-rejects-proposal
  regression would hang the goroutine and the test forever, killing
  every other pkg/tbtc test via the package-wide go test timeout.

- Derive each test's broadcast channel name from t.Name() plus a
  per-invocation nonce instead of a hardcoded literal: the
  coordination leader intentionally keeps retransmitting for the
  active phase's duration, so a hardcoded name risks an earlier
  invocation's leader retransmitting into a later invocation's
  followers under -count=N or a future test reusing the name.

- Migrate TestCoordinationExecutor_Coordinate onto the shared
  reservation-coordination helpers instead of its own duplicated
  inline fixture/report/sort logic, and collapse
  TestCoordinationExecutor_Coordinate_ReservationAnchor/Reanchor into
  one table-driven TestCoordinationExecutor_Coordinate_ReservationProposals.

- Drop the now-unused sort in runReservationCoordinationRound (no
  assertion depended on report order) and the tautological
  reports-count assertions.

- Stop aliasing the mock generator's returned pointer as the expected
  result in assertions, so the leader-side comparison isn't a
  vacuous pointer-identity check.

- Correct four doc comments that overclaimed shared-state absence,
  stale branch provenance, and reanchor test chronology; add the
  missing public-key-hash comment in newReservationCoordinationWallet.

Verified: go build ./..., go vet ./pkg/tbtc/..., gofmt clean,
go test ./pkg/tbtc/... (145s, all pass), and the three affected
tests under -race -count=10 (clean).

Removing the tautological reports-count assertion (previous commit)
also removed the only check that all three operators actually
reported: len(reports) == len(operators) holds by loop construction
regardless of *which* operators reported, so a fan-in bug returning
two reports for one operator while another's is lost would pass
silently. Add an explicit check in runReservationCoordinationRound
(which owns the fan-in) that every operator index 1..len(operators)
appears at least once among the collected reports.

Verified: go build ./..., go vet ./pkg/tbtc/..., gofmt clean,
the three affected tests individually confirmed via raw (non-
summarized) test output, -race -count=10 clean, and the full
pkg/tbtc suite (146s, all pass).

…eports"

This reverts commit 276e64b.

Root-causes finding P1-#2's minimum fix (unique channel name per test
invocation, previous commit): pkg/net/local's broadcastChannels registry
is append-only and process-global, and each retransmission ticker was
started with context.Background(), so it retransmits forever with no
way to stop it externally. A later test/invocation reusing a channel
name would keep receiving an earlier invocation's stale, still-
retransmitting messages for the lifetime of the test binary - three
pre-existing tests (ExecuteLeaderRoutine, ExecuteFollowerRoutine,
ExecuteFollowerRoutine_WithIdleLeader) still hardcode "test"/"test-idle"
and were never covered by the minimum fix.

- pkg/net/local/broadcast_channel_manager.go: give each channel a
  cancellable context instead of context.Background(), track the
  cancel funcs, and add ResetForTesting() to cancel every outstanding
  ticker and clear the registry.
- pkg/tbtc/coordination_test.go: wire t.Cleanup(netlocal.ResetForTesting)
  into all four broadcast-channel-creation sites in this file (the
  shared reservation-coordination helper plus the three pre-existing
  hardcoded-name tests), so every test starts from an empty registry
  regardless of channel-name convention - removing the need for the
  per-invocation-nonce workaround to be the only safeguard.

Verified: go build ./..., go vet ./pkg/tbtc/... ./pkg/net/local/...,
gofmt clean. All 5 affected tests together under -race -count=10
(50/50 pass, proving cross-invocation isolation actually holds now).
Full pkg/net/local and pkg/tbtc suites pass (145s).

ResetForTesting (previous commit) already makes channel-name reuse
safe by cancelling every outstanding ticker and clearing the registry
between invocations - proven experimentally: forcing all operators
onto one fixed colliding name still passed 20/20 under -race -count=10
with the hook active, and failed under the same forced collision with
the hook disabled (reanchor received a stale anchor proposal from an
earlier subtest's still-retransmitting leader).

The per-invocation time.Now().UnixNano() nonce was therefore dead
weight, and the doc comment claiming a name "should be unique per
test invocation" was no longer true. Dropped the nonce (channelName
is now just t.Name(), kept for attributing a leak to its source test,
not for uniqueness) and rewrote the comment to describe the actual
current invariant.

Verified: go build ./..., go vet ./pkg/tbtc/..., gofmt clean. The five
netlocal-using tests together under -race -count=20 (100/100 pass,
genuine repeated-invocation collision on the same fixed name, not a
synthetic one). Full pkg/tbtc suite (146s) green.

…r cleanup

- Rescope ResetForTesting to a name-keyed ReleaseBroadcastChannel(name)
  instead of wiping the entire process-global channel registry, so
  tests (and any future caller) can release one channel without
  destroying every other channel's retransmission ticker.
- Guard the retransmission Ticker's post-loop handler cleanup with the
  same mutex used everywhere else in the type, closing a race between
  concurrent onTick/onUnregister callers and ticker shutdown.
- Add TestReleaseBroadcastChannel covering release-stops-retransmission
  and reuse-after-release-only-delivers-to-the-new-channel behavior.

- Fix checklist-ordering doc comment to match the actual actionPriority
  map.
- Hoist the 30s fan-in deadline outside the report-collection loop so
  it bounds the whole wait instead of re-arming on every report.
- Rewrite the protocolLatch doc comment: it does not serialize
  concurrent operator goroutines, only bounds in-flight work.
- Rename reservationCoordination* test helpers to drop the misleading
  "reservation" prefix; they exercise the general coordination path.
- Fix the leader-goroutine/waiter leak in waitForBlockHeight by
  translating the requested absolute block height into the local
  chain fake's own relative counter frame before waiting, instead of
  waiting on the raw absolute height (which could take days of
  simulated block time to reach for mainnet-scale values).
- Correct the fixture doc comment's chain-sharing overclaim.
- Fix coordination.go's redemption-priority comment to describe the
  actual post-activation gating behavior.
- Rename TestReservationProposals_UnmarshalRejectsMissingIntegers to
  TestReservationProposals_UnmarshalRejectsInvalidPayloads, matching
  what the test actually covers.

…ion doc comment

The rebase's conflict resolution left the doc comment referencing the
function's pre-export lowercase name.

…oordination (#4279)

## Summary

Implements `implementation-plan.md` Milestone 3's "multi-signer
simulated
integration test" item - the last piece of the full M1
keep-core-readiness
implementation plan (M0 is an external release-coordination gate, not a
code
task; M1's four rows and M2's test-coverage backfill are covered by
[#4276](#4276),
[#4277](#4277),
[#4278](#4278), and a
separate M2 follow-up PR).

Stacked on `m1/reservation-coordination-checklist`
([#4278](#4278)).

**Scope note (per explicit decision this session):** Milestone 3 has two
items - this test, and a "testnet round with a forced liveness/stranding
drill" (~2 weeks, needs a live testnet deployment and real
multi-operator
wall-clock timing). Only the former is code; the latter is tracked as an
agent-not-actionable item in the plan doc, unchanged by this PR.

## Change

Scales `TestCoordinationExecutor_Coordinate`'s existing 3-operator
harness -
deterministic keypairs, real per-operator `localChain` fakes, a real
shared
`netlocal.BroadcastChannel`, one goroutine per operator running
`coordinationExecutor.coordinate` concurrently - to
`ReservationAnchorProposal`
and `ReservationReanchorProposal`, added as one table-driven test with
`anchor`/`reanchor` subtests:

- `TestCoordinationExecutor_Coordinate_ReservationProposals`

This exercises the real leader/follower coordination round-trip
(checklist
generation -> leader election -> broadcast -> follower validation ->
convergence) that no mocked `pkg/tbtcpg` unit test can cover, since
those
call `task.Run(request)` directly and never go through
`coordinationExecutor.coordinate`. It also exercises #4277's protobuf
marshaling of both proposal types over a real wire round-trip, since
every
follower unmarshals the leader's broadcast `coordinationMessage`.

**Depends on #4278** (this branch's parent): before that fix,
`ActionReservationAnchor`/`ActionReservationReanchor` never appeared in
`getActionsChecklist`'s output, so every operator's checklist search in
these tests fell through to `NoopProposal` and failed. Verified
directly:
temporarily reverted #4278's checklist change, re-ran the new test (both
subtests failed with the expected `NoopProposal` mismatch), then
restored it.

## A bug found in this test's own harness, and its root-cause fix

The two reservation subtests initially shared one `netlocal` broadcast
channel name. `getBroadcastChannel`'s registry is keyed by name, is
process-global, and never released old channels' retransmission tickers
(they were wired to `context.Background()`), so under `-race` the
reanchor
subtest's follower sometimes received a stale broadcast left over from
the
anchor subtest's leader - a cross-test data race in the test harness
itself, not in the production code under test.

Root-caused and fixed in `pkg/net/local` (production, non-test code,
since
the registry it fixes is used by every test file that exercises a
simulated
local network): each broadcast channel's retransmission ticker context
is
now cancellable, and a new `ReleaseBroadcastChannel(name string)`
cancels
and de-registers a channel's own ticker(s) by name (scoped to the
caller's
own channel, not a global reset) on `t.Cleanup`. This is now wired into
all
four broadcast-channel-creation sites in `pkg/tbtc/coordination_test.go`
(the shared operator helper plus three pre-existing hardcoded-name
tests),
each releasing under its own channel name.

## Testing

- `go build ./...`, `go vet ./...`, `gofmt -l`: clean.
- `go test ./pkg/tbtc/...` and `go test -race ./pkg/tbtc/...`: full
suite
  green, including `-count=10` targeted at the new/changed coordination
  tests.
- `go test ./pkg/net/local/... ./pkg/net/retransmission/...` (incl.
`-race`):
  green, including new coverage for `ReleaseBroadcastChannel`'s actual
effect (a released channel's ticker stops retransmitting; releasing and
  reopening under the same name only delivers to the new registration).

## Not in this PR

- The testnet-round liveness/stranding drill (Milestone 3's other item)
-
  operational, not code; tracked separately.
- Milestone 2's test-coverage backfill - separate follow-up PR.