[heifner]

regsnapprov billed its snapprovs row to the producer, and votesnaphash billed each snapvotes row to the snapshot account (later agreeing voters were appended to the first voter's row at its expense). Accounts created through sysio.roa hold only newaccount_ram and no CPU/NET, so a producer's regsnapprov failed: it needs 1208 bytes against a 1144-byte quota. Every other row on the producer path is already billed to sysio.

Changes

• snapprovs and snapvotes rows are billed to sysio. A vote row opened before this change moves to sysio the next time a vote is appended to it.
• Pending votes are bounded. Account RAM was the only limit when no height reaches quorum, so votesnaphash accepts votes only for the two most recent scheduled heights (max_pending_vote_heights) and purges pending rows below that window, at most 60 per call. snapvotes holds at most 60 rows.
• A vote or an exact retry below the window fails with snapshot block is older than the pending vote window. A matching late vote on a finalized record still succeeds, and a mismatch still returns error 9001.
• The emissions test no longer grants the producer RAM for its regsnapprov row.

Notes

• No ABI change; only sysio.system.wasm moves.
• A height stays votable for two snapshot periods (25,000 to 50,000 blocks at the default spacing), at least four times the node's verification grace. An honest vote is refused only after a finality stall or outage longer than that; producer_plugin logs the failure and keeps running.
• At a spacing of 1 or 2 blocks the window is shorter than finality lag. The node already treats those spacings as test-only.
• snapprovs rows already on a chain stay billed to their producers until rotated, deleted or pruned.