mempool: fixes

crates/brk_query/src/impl/block/info.rs

@@ -499,10 +499,11 @@ impl Query {
 
     // === Helper methods ===
 
-    /// Hash to height. The prefix store keys on the first 8 bytes of
-    /// the hash, so the resolved height is verified against the full
-    /// `blockhash[height]` before being returned. Prefix collisions
-    /// (or unknown hashes) surface as `NotFound`.
+    /// Hash to height, clamped to the safe-lengths snapshot. The prefix
+    /// store keys on the first 8 bytes of the hash, so the resolved
+    /// height is verified against the full `blockhash[height]` before
+    /// being returned. Prefix collisions, unknown hashes, and hashes
+    /// past the snapshot all surface as `NotFound`.
     pub fn height_by_hash(&self, hash: &BlockHash) -> Result<Height> {
         let indexer = self.indexer();
         let prefix = BlockHashPrefix::from(hash);
@@ -512,6 +513,9 @@ impl Query {
             .get(&prefix)?
             .map(|h| *h)
             .ok_or(Error::NotFound("Block not found".into()))?;
+        if height >= self.safe_lengths().height {
+            return Err(Error::NotFound("Block not found".into()));
+        }
         match indexer.vecs.blocks.blockhash.get(height) {
             Some(stored) if &stored == hash => Ok(height),
             _ => Err(Error::NotFound("Block not found".into())),

crates/brk_query/src/impl/series.rs

@@ -184,8 +184,8 @@ impl Query {
         }
 
         // Snapshot tip-derived state together so the historical-branch ETag stays
-        // self-consistent: stable_count is computed from tip_height, hash_prefix
-        // is the live tip.
+        // self-consistent: tip_height and hash_prefix both reflect the safe-bound
+        // tip, and stable_count is computed from tip_height.
         let tip_height = self.height();
         let hash_prefix = self.tip_hash_prefix();
         let stable_count = self.stable_count(params.index, total, tip_height);