DC-EPOCH-11

DC derived declared

The live reduced-UTxO checkpoint (S3f-4d-mat) -- the authoritative reduced-stake state Ade maintains on the selected-chain admission path so it derives its OWN next-epoch view (not just imports one). It is NOT a new parallel stake system: it makes the already-built reduced-checkpoint/window machinery (DC-EVIEW-04 reduce, DC-EVIEW-10 window driver) live. Locked points: (1) BLUE-authoritative content (a deterministic, replay- equivalent projection of the single ledger UTxO; the same blocks -> byte-identical checkpoint), not a cache; (2) advances only after selected-chain DURABLE admission (lockstep with the WAL AdmitBlock chain); (3) ChainDB/ WAL order only -- no peer-arrival/scheduler influence; (4) reorg restores/re-materializes the exact rollback lineage; (5) the bootstrap checkpoint is bound to the same seed/cert-state/chain-point/manifest (DC-EVIEW-09); (6) a missing/corrupt/lagging checkpoint BLOCKS EpochConsensusView production and fails closed; (7) no full UTxO resident in the live path (track_utxo=false preserved); bounded + disk-backed (redb); (8) existing current-epoch follow/forge stays BYTE-IDENTICAL until S3f-4d-wire activates a promoted view. -mat-1 (DONE): build the checkpoint from the seed UTxO at bootstrap (reduce_txout each output -> build_from), disk-backed, GATED on the EVIEW cert-state package (non-EVIEW bootstrap unchanged), before drop(utxo), fail-closed.

Source: docs/clusters/EPOCH-CONSENSUS-VIEW/SLICE-3f4d-mat-live-checkpoint.md; user directive 2026-06-21 (make the reduced-checkpoint machinery live on the admission path; 8 locked points)
Introduced in: EPOCH-CONSENSUS-VIEW-S3f-4d-mat-1

Enforcement trace

Code

Tests 1

live_reduced_checkpoint_builds_durable_deterministic

CI 1

ci_check_eview_live_checkpoint.sh

Cross-references

Strengthened in

Attack rationale

The reduced checkpoint is authoritative, not a cache: -mat-1 builds it deterministically (replay-equivalent fingerprint, proven) and fail-closes a build failure (no silent skip). It changes NO existing bootstrap output and is gated on the EVIEW cert-state, so a non-EVIEW bootstrap is byte-identical (the existing track_utxo=false drop(utxo) is preserved -- no resident full UTxO in steady state). The build runs BEFORE drop(utxo) (CI-pinned), so the seed UTxO is still resident -- a build after the drop would see an empty UTxO. The transient reduced map (~70 bytes/entry, ~130 MB at 1.9M entries) is freed at the end of the build; the durable artifact is the bounded redb checkpoint. The remaining points (advance lockstep with durable admission, reorg lineage, fail-closed lagging) are owed sub-slices that keep the checkpoint a faithful, replay-equivalent shadow of the selected chain.

Evidence notes

S3f-4d-mat-shadow derive mechanism DONE: ReducedUtxoCheckpoint::derive_stake_by_pool(delegation) composes sum_base_credential_stake + aggregate_pool_stake -> the candidate view's StakeByPool (the live derive the shadow proof compares to the oracle + that -wire produces the bound view from). The LIVE shadow proof (build the checkpoint from the real ep1335 seed -> derive -> compare {pool_distribution, total, ADE1 sigma} vs an oracle aligned to the SAME snapshot -- the seed-derived MARK at the seed boundary, NOT the leadership/GO stake) is the remaining gate before -wire. S3f-4d-mat-4 DONE (fail-closed readiness gate): ReducedUtxoCheckpoint::verify_ready_at(required_slot, expected_seed_slot) -> CheckpointReadinessError{Read|Unsealed|SeedMismatch|Lagging|Ahead}; admits ONLY an exact-slot, matching-lineage checkpoint -- a missing/corrupt/lagging/wrong-lineage/overshot checkpoint fails closed (the boundary derive at -wire consults it before producing an EpochConsensusView). S3f-4d-mat-3 DONE (reorg re-materialize): the checkpoint seals an IMMUTABLE bootstrap baseline (BOOTSTRAP_TABLE + SEED_SLOT) at build via seal_bootstrap; reset_to_bootstrap clears the live table + copies the baseline back + resets LAST_SLOT to SEED_SLOT; the relay-loop helper detects a rollback (last_advanced_slot > durable tip) and re-materializes before replaying (the reduced delta is not invertible). set_built_at_slot removed (footgun: it set only LAST_SLOT). -mat-1/2a/2b/2c+3 hermetically green (ade_runtime 424, ade_node 358). Introduced at EPOCH-CONSENSUS-VIEW S3f-4d-mat-1 (2026-06-21). The first sub-slice of the live materialization -- the missing live authority so Ade produces its OWN next-epoch view. 1 hermetic proof (build from the seed UTxO -> durable + complete + deterministic redb checkpoint) + ci_check_eview_live_checkpoint.sh; cargo test -p ade_node --lib (358) green, no regression; non-EVIEW bootstrap byte-identical (gated). status=declared: the full live materialization is NOT complete until -mat-2/3/4 + the shadow-derivation proof. The user's verification correction is recorded: the fresh epoch-1335 leader/stake gate proves the IMPORTED view agrees with the node, NOT that the live reduced checkpoint derives that view -- the shadow derivation (-mat-shadow) is the first live proof of the latter, before any activation.