RootDigest

A hash of sender's whole state, sent on the anti-entropy tick in place of the state itself (#1955). The recipient compares it with its own root and replies with a FullStateRequest only if they differ, so a converged round costs one small frame instead of the entire CRDT.

upThrough carries the same own-delta high-water as FullState.upThrough, and for the same reason: an anti-entropy round must resync the recipient's receive cursor whether or not it ships state. Omitting it here would reintroduce the #1266 livelock for a peer whose state matches while its delta cursor lags.

upThrough deliberately has no default: omitting it must be a compile error, not a silent 0L that disables the resync. (FullState.upThrough carries a default only because it predates its callers.)

root is advisory, and a collision costs more than a missed heal: the recipient takes the match branch, so it also fast-forwards its receive cursor to upThrough, acks it, and drops buffered inbound deltas at or below it — the exact harm the mismatch branch refuses to risk, inflicted here on a false match. It stays recoverable: the next state mutation on either side changes both roots, and any FullState — from a third peer, the first-contact path, or a later round whose roots then differ — re-merges the state and re-resyncs the cursor. So a stall, never divergence that survives a FullState.

That stall is not bounded by the next round, though. Between two quiescent peers neither state changes, so the same two roots collide again identically on every subsequent round, in both directions; recovery needs a local mutation or a FullState from a third peer. At 2⁻⁶⁴ per pair this is worth recording, not engineering around — but the bound is "until something changes", not "one round".