Very infrequent root validation error

Description

Very infrequently, the preloader fails to submit a chain from argon to arche: the preloader receives a 400 Bad Request, and TesseraCT logs W0609 15:03:15.978916 17707 handlers.go:168] arche2025h1.staging.ct.transparency.dev: AddChain handler error: failed to verify add-chain contents: chain failed to validate: no RFC compliant path to root found when trying to validate chain.

Each time I saw it happening, I searched for the cert on crt.sh, reconstructed the chain, tried to submit it again, and it worked. It might be worth getting the full chain from the source log rather, which is sometimes a bit tricky because the preloader does not log the index of the chain in the source log. Also, TesseraCT does not log any chain identifier when the submission fails (we probably should), so the only way to match errors between the two binaries is to look at log timestamps.

Log samples

To find other instances:

• This Logs Explorer search finds preloader errors, with the domain name and the index range in which this chain was found
• This Logs Explorer search finds TesseraCT errors

# Preloader
Will run preloader between 766695877 to 767055877
E0609 15:03:15.980031   17880 preloader.go:108] failed to add chain with CN santsalvadordeguardiola.cat: got HTTP status "400 Bad Request"

# TesseraCT
W0609 15:03:15.978916   17707 handlers.go:168] arche2025h1.staging.ct.transparency.dev: AddChain handler error: failed to verify add-chain contents: chain failed to validate: no RFC compliant path to root found when trying to validate chain

# Preloader
Will run preloader between 749715658 and 750075658
E0606 10:21:50.580660    2362 preloader.go:108] failed to add chain with CN www.bancosanjuan.com: got HTTP status "400 Bad Request""

# TesseraCT
"W0606 10:21:50.578310       1 handlers.go:164] arche2025h1.staging.ct.transparency.dev: AddChain handler error: failed to verify add-chain contents: chain failed to validate: no RFC compliant path to root found when trying to validate chain"

Start by comparing the logging paths in preloader.go and handlers.go with the provided preloader and TesseraCT log samples. Trace how a failed chain submission is identified across both binaries, including the source-log index and chain information. Done means the intermittent validation failure can be matched to the original chain without relying only on timestamps.