DC-EPOCH-30
DC derived enforcedBounded post-rollback refold. Post-rollback re-derivation is bounded by ~2k and is INDEPENDENT OF NODE UPTIME. The settled rewind point is never more than 2k behind the tip: pending is re-staged only on promotion, so settled is at least k old (reorg-unreachable) and at most 2k old (the next promotion fires as soon as the newly-staged point itself reaches k). The pre-slice behaviour rewound to the bootstrap anchor, whose distance grows without limit -- and because the accumulator is the frozen-leadership authority, a refold that outgrows the inter-reorg interval means leadership can never be promoted at a boundary, i.e. the node cannot forge.
- Source
docs/clusters/ACCUMULATOR-REFOLD-BOUND/SLICE-S1-settled-rewind-point.md (INV-AR-5)
- Introduced in
- ACCUMULATOR-REFOLD-BOUND-S1
Enforcement trace
Code
Tests 2
- settled_point_never_falls_further_than_2k_behind_the_tip
- settled_point_is_only_promoted_once_k_blocks_settled
Cross-references
Evidence notes
The bound test walks a tip forward well past a single buffer window and asserts the settled age stays within [k, 2k] throughout, and that a promotion actually occurred (never vacuously satisfied by never promoting). SUPPORTING live evidence only (never the reason for enforcement): the 2026-08-01 sustained preview run measured the UNBOUNDED pre-slice behaviour -- refold 225s at 25,838 slots from the bootstrap anchor rising to 1595s (26.6 min) at 85,690, per-slot cost climbing 0.009->0.019 s/slot, over 14 reorgs in 18h. CE-AR-6 (a live run showing refold no longer grows with uptime) is still OUTSTANDING. Enforcement rests on the named tests + ci/ci_check_accumulator_refold_bound.sh.