DC-EPOCH-04

DC derived enforced

For a target epoch, AT MOST ONE canonically bound EpochConsensusView may activate (S3f-4a substrate). A distinct WalEntry::EpochConsensusViewActivated (append-only TAG 4) is the durable proof that THIS exact view became authoritative for target_epoch at THIS exact selected-chain transition; it records the ENTIRE activation identity -- target_epoch, network_magic, era, transition_point, source_checkpoint_commitment, snapshot_phase, nonce_commitment, stake_view_canonical_hash, full view_canonical_hash -- not merely hash + point. Like SeedEpochConsensusInputsImported it carries no prior_fp/post_fp and never advances the fingerprint chain. Activation idempotence is EXPLICIT and does NOT weaken the seed's DuplicateProvenance: activation_replay_outcome(existing, new) for the SAME target epoch returns Idempotent iff the records are byte-identical (structural equality of the whole record), else Conflict (fail closed). The record canonically encodes/decodes byte-identically (replay-equivalent).

Source: docs/clusters/EPOCH-CONSENSUS-VIEW/SLICE-3f4-activation-flip.md (S3f-4a); user directive 2026-06-21 (one atomic WAL-backed activation; explicit activation idempotence)
Introduced in: EPOCH-CONSENSUS-VIEW-S3f-4a

Enforcement trace

Code

Tests 3

wal_epoch_view_activated_round_trips_byte_identical
wal_epoch_view_activated_uses_tag_four
activation_replay_idempotent_vs_conflict

CI 1

ci_check_eview_activation_wal.sh

Cross-references

Attack rationale

Two different bound views must NEVER both activate for one target epoch: the durable record pins the full activation identity, and activation_replay_outcome makes same-epoch divergence a structured Conflict (fail closed), not a silent overwrite. Idempotence is restricted to byte-identical records (structural equality), so a record differing in ANY binding/hash for the same epoch is a Conflict. The seed's DuplicateProvenance is untouched (CI-pinned) -- the activation rule is a SEPARATE, narrower idempotence, not a broad weakening. The record carries no fingerprint-chain fields, so it cannot corrupt the AdmitBlock chain. Canonical encode/decode is byte-identical (replay-equivalent), and an unknown era/phase code or out-of-range network fails closed on decode.

Evidence notes

Introduced at EPOCH-CONSENSUS-VIEW S3f-4a (2026-06-21), the first sub-slice of the activation flip. The DURABLE SUBSTRATE only -- the WAL record + the pure idempotence/conflict decision + a stake-distribution commitment (stake_view_canonical_hash, distinct from the full-view hash). 3 hermetic tests + ci_check_eview_activation_wal.sh; updated 6 WalEntry match sites (replay main-loop + compute_superseded, store_trait, restart, node_lifecycle, 2 tests) to handle the non-transition entry; ade_ledger wal 29 green, no regression. NOT yet emitted or applied live. Next: S3f-4b (the activation predicate + atomic publish + the terminal EpochViewActivation* states), S3f-4c (durable-before-visible + the replay application + crash recovery), S3f-4d (the live flip), with DC-EPOCH-05/06/07 introduced at their sub-slices.