AdeAtlas
Invariants / DC-EPOCH-05

DC-EPOCH-05

DC derived enforced

Epoch N+1 validation and leadership may NOT observe epoch-N seed inputs (S3f-4b). The active epoch view is a ONE-WAY ActiveEpochView transition: Seed (the recovered seed view is authoritative) -> Promoted(view) (the bound N+1 view is authoritative). There is NO config that selects between them -- the activation predicate is the gate, not a flag. ActiveEpochView::promoted() is Some ONLY after a promotion, so N+1 leadership reading it can NEVER observe the seed inputs as if they were the N+1 view; before promotion it is None (the seed is authoritative on its own seed-epoch path). A re-promotion with the SAME view is idempotent; with a DIFFERENT view it is the terminal EpochViewActivationConflict (never a silent swap).

Source

docs/clusters/EPOCH-CONSENSUS-VIEW/SLICE-3f4-activation-flip.md (S3f-4b); user directive 2026-06-21 (no runtime flag; promoted view fully replaces the seed view)

Introduced in
EPOCH-CONSENSUS-VIEW-S3f-4b

Enforcement trace

Code

Tests 3

  • active_view_one_way_promote_and_idempotence
  • active_view_conflicting_promotion_is_terminal
  • seed_exposes_no_n1_view_until_promotion

CI 1

Cross-references

DC-EPOCH-04DC-EPOCH-07DC-EVIEW-11DC-EVIEW-07

Attack rationale

N+1 must never run on the stale seed view: the active view is one-way (no path back to Seed once Promoted) and exposes the N+1 view ONLY via promoted() which is Some solely after a promotion -- so there is no 'choose old or new by config' state and no fallback. A differing re-promotion is a terminal conflict, not a silent overwrite (no two-view ambiguity). The promotion is atomic (a single enum replace), so a reader sees either the seed or the fully-published promoted view, never a partial.

Evidence notes

Introduced at EPOCH-CONSENSUS-VIEW S3f-4b (2026-06-21). The CONTAINER semantics only -- 3 hermetic tests + the gate. cargo test -p ade_node --lib (epoch_activation 5) green. The LIVE leadership read (promoted view replaces the seed view at the wall) is S3f-4d, gated on the live proofs. Next: S3f-4c (durable-before-visible + replay application + crash recovery), then S3f-4d.