The v2 room spec incorrectly seems to imply that you have to transitively walk the DAG for state res to work

It says: The room state S(E) before E is the resolution of the set of states {S'(E1), S'(E2), …} consisting of the states after each of E's prev_events {E1, E2, …}, where the resolution of a set of states is given in the algorithm below. This seems to imply that to correctly calculate the state S(E) you need to have all prev_events, and recurse to have all prev_events. It's pedantic, but we need something to spell out that it's acceptable to not have retrieved all prev_events, and calculate current state on the state that you have access to instead.

Relatedly, @ahmedcharles has a scenario at https://gist.github.com/ahmedcharles/de8ab212d4c8acf859d3afb88190d897 which tries to exploit the lack of full DAG where a malicious event can introduce a form of state reset (which needs to be reviewed), cc @neilalexander, @erikjohnston

Start with the v2 room state resolution wording quoted in the issue and review the linked Ahmed Charles gist describing incomplete-DAG state reset. Determine how the specification should clarify calculating state with only retrieved prev_events, while also resolving whether the security scenario changes the expected behavior.

Written by the indexing model from the issue text.