DC-EPOCH-10

DC derived enforced

The boundary activation orchestration is ONE atomic, ordered, durable-before-visible path (S3f-4d-3a). activate_at_boundary sequences, in order: validate the durable source window (DC-EPOCH-08) -> derive the candidate (DC-EPOCH-09) -> the activation predicate BEFORE the WAL (DC-EPOCH-05/07: transition eligible + bindings verify + the candidate's point IS the selected-chain point) -> write the durable WAL activation record (DC-EPOCH-06) -> publish via activate_durable_before_visible ONLY if the write is durable -> atomically promote the active view. A predicate decline is NotYet (NOT terminal -- the seed view stays authoritative, retry the next boundary; NO WAL is written). A failure AFTER the predicate passes -- a non-durable WAL write, or a conflicting already-active view -- is a TERMINAL EpochViewActivationError the caller must halt on (no admit/forge/follow, NEVER a fallback to the seed view). An invalid (corrupt/forked/incomplete) window or a derivation failure is terminal BEFORE any WAL write.

Source: docs/clusters/EPOCH-CONSENSUS-VIEW/SLICE-3f4d-live-flip.md (S3f-4d-3a); user directive 2026-06-21 (one atomic path; durable-before-visible; halt on terminal)
Introduced in: EPOCH-CONSENSUS-VIEW-S3f-4d-3a

Enforcement trace

Code

Tests 5

happy_path_promotes_after_durable_wal
non_durable_wal_is_terminal_and_does_not_publish
not_eligible_transition_is_not_yet_not_terminal
invalid_window_is_terminal_before_any_wal
selected_point_mismatch_declines

CI 1

ci_check_eview_activate.sh

Cross-references

Attack rationale

The ordering is the safety property: the predicate (incl. bindings + selected-point) runs BEFORE the WAL, the WAL write is the ONLY durability gate, and publication (activate_durable_before_visible) follows ONLY a durable write -- so the active view can never become visible before its activation is durable (proven: a non-durable write yields terminal + no publish). A decline is NotYet (no WAL, seed stays) -- distinct from a terminal halt, so a not-yet-ready boundary does not corrupt state. A post-predicate failure (non-durable / conflict) halts, NEVER falls back to the epoch-wrong seed view. An invalid window or a derivation failure is terminal BEFORE any WAL write (proven: no write on an invalid window), so a corrupt durable chain cannot produce a half-activation. The orchestration adds only the sequencing over individually-proven, deterministic pieces.

Evidence notes

Introduced at EPOCH-CONSENSUS-VIEW S3f-4d-3a (2026-06-21), the orchestration sub-slice of the live flip. The sequenced activation with a MOCK WAL writer -- 5 hermetic proofs (happy path -> Promoted; non-durable WAL -> terminal + no publish; predicate decline -> NotYet + no WAL; invalid window -> terminal before any WAL; selected-point mismatch -> NotYet). ci_check_eview_activate.sh; cargo test -p ade_node --lib (epoch_activate 5) green. The activation machinery is now fully composable: validate (4d-1) -> derive (4d-2) -> orchestrate (4d-3a). The ONLY remaining piece is S3f-4d-3b (the LIVE call into run_relay_loop_with_sched + the wall feed + warm-start), gated on the two live proofs.