[KSlashh]

Audit item M8. Open against dev.

Only the operator gave up a setup at the instance's abandon height (H_p + T0 + B). On verifier and committee nodes nothing ended a graph whose operator went offline, or a graph left out because other graphs carried the instance:

• The Setup and Signing outbox rows were resent every 10 minutes forever. That includes the verifier's GenCircuits, about 11.5 MiB.
• An OperatorPresigned graph got a full chain scan on every block.

The abandon scan now runs on every role. On a non-operator it reports two kinds of setup:

• Every OperatorPresigned graph, whichever operator it belongs to.
• Every setup this verifier admitted (InitGraph) whose graph never arrived.

Past the abandon height:

• An OperatorPresigned graph turns Obsoleted. The existing status mirror then closes its deliveries and cancels its setup jobs, and the scan stops reporting it.
• An admitted setup without a graph row has its deliveries closed and its setup jobs cancelled directly, and is marked abandoned so it is reported only once.

On a non-operator, a failed instance does not skip the check: the instance cleanup obsoletes graph rows but never reaches a setup that has no row. The operator path is unchanged.

Review notes

• A node whose copy is still OperatorPresigned while the network has the finalized copy will mark it Obsoleted too. An Obsoleted graph is still probed for its Pre-Kickoff and gets a full scan every 16 heights, so it comes back before a kickoff matters. A Goat post alone does not bring it back (the Goat event only moves graphs out of the early states).
• The scan reads one new store query, list_engine_aggregates_by_status, over graph aggregates with no graph row.

Tests: a committee graph unfinished at the abandon height turns Obsoleted and closes its nonce delivery, while a finalized graph is left alone; a verifier setup whose graph never arrives closes its GenCircuits delivery and is reported once. Node and store tests, workspace clippy with -D warnings and fmt pass.

The test coverage and validation notes above are from the zkm PR notes. Branch scope and diff formatting were checked locally; builds and tests were not rerun during publication.