Invariants / DC-EPOCH-20

DC-EPOCH-20

DC derived declared

Atomic-or-rematerialized selected-block admission -- no RESUMED split authority. For every selected block admitted to the durable chain, four derived authorities advance from the SAME selected-chain prefix: the ChainDB/WAL block record, the Praos chain-dep state, the EpochAccumulator transition (DC-EPOCH-19), and the reduced-UTxO-checkpoint advancement (DC-EPOCH-11). The WAL tail is the single admission authority: recovery drops every block above the WAL-tail slot and reconciles the ChainDB tip TO it, so the authoritative selected-chain prefix is DEFINED as the WAL tail. The chain-dep, the reduced checkpoint, and the accumulator are derived stores -- each a pure function of that prefix. (a) IN-FLIGHT LAG ALLOWED: a derived store may momentarily lag the WAL tail (a torn write, a lazy advance cadence) during live admission, gated by DC-SYNC-01 (the tip is not advanced before the block bytes + WAL record are durable). (b) RECOVERY REMATERIALIZES: on any restart or rollback, every lagging derived store is rebuilt up to the WAL tail by folding its transition over the canonical durable blocks (the accumulator folds apply_selected_block, the reduced checkpoint folds reduced_block_delta, the ledger/chain-dep fold the trusted replay) -- never an ad hoc inverse mutation. (c) FAIL-CLOSED READINESS: validation and forging do not resume until a readiness gate confirms each derived store's last-advanced slot equals the WAL tail (Lagging / Ahead / SeedMismatch / Unsealed are terminal). The only RESUMED state is "all four at the WAL tail"; a mixed prefix (ChainDB at N, accumulator at N-1, checkpoint at N-2) is caught and rematerialized, never run on.

Source

docs/clusters/LIVE-LEDGER-EPOCH-TRANSITION/SLICE-S2-live-within-epoch-wiring.md. Generalizes the WAL-is-admission-authority recovery (recovery/restart.rs) + the reduced-checkpoint LAST_SLOT lockstep (DC-EPOCH-11) + the materialize_rolled_back_state replay-equivalence pattern to INCLUDE the EpochAccumulator as a fourth derived store, so the live within-epoch wiring (S2) cannot create a recoverable split-authority prefix. The dangerous failure mode is not memory; it is a resumed mixed prefix across the four authorities.

Introduced in
LIVE-LEDGER-EPOCH-TRANSITION-S2

Enforcement trace

Code

no enforcing code — gap

Tests 2

  • ade_runtime::chaindb::epoch_accumulator_advance::tests (over_chaindb_folds_durable_prefix_to_tip -- warm-start catch-up folds the durable prefix to the tip; over_chaindb_rewalk_is_idempotent -- replay-safe resume advances nothing; over_chaindb_stops_at_boundary_observe_only -- the store freezes at the last within-epoch slot, MissingBoundaryStake; reset_then_rewalk_rematerializes -- reorg = reset-to-seed + forward replay re-materializes the SAME tip, no inverse mutation)
  • ade_runtime::chaindb::epoch_accumulator_store::tests (seal_advance_reset_round_trip_is_exact; advance_is_strictly_forward -- NonMonotonicAdvance fail-closed; readiness_gate_fails_closed -- Lagging/Ahead/Unsealed terminal)

Cross-references