Invariants / DC-LEDGER-PHASE2-03

DC-LEDGER-PHASE2-03

DC derived enforced

A phase-2-invalid transaction contributes its consumed collateral and NOTHING else. For a tx in the block's invalid_transactions set the accumulator applies exactly one effect: the fee pot gains collAdaBalance (the resolved collateral inputs minus the collateral return read from the block). Its certificates, withdrawals, voting procedures and proposal procedures contribute nothing to any accumulator authority state -- not because they are refused, but because Cardano DISCARDS them (Cardano.Ledger.Babbage.Rules.Utxo, Phase2Invalid). The cert walk (process_block_certificates) skips a discarded tx's certs at the single cert walk, so no caller-side guard is load-bearing. When no resolver is supplied the transition refuses, and that refusal is about the MISSING VALUATION, never about the tx carrying effects. total_collateral is never read: block validity, including IncorrectTotalCollateralField, is established upstream and the accumulator reproduces the transition of an already-valid block rather than re-adjudicating one.

Source

docs/clusters/PREPROD-LIVE-2-FORGE-READINESS/SLICE-BND-2c-invalid-tx-accumulator-transition.md (INV-BND-2c)

Cluster
PREPROD-LIVE-2-FORGE-READINESS
Introduced in
PREPROD-LIVE-2-BND-2c
Authority surface
BLUE accumulator within-epoch transition for discarded transactions

Enforcement trace

Tests 5

  • invalid_tx_fee_is_resolved_collateral_not_declared_fee
  • an_invalid_txs_certs_are_discarded_not_refused
  • an_invalid_tx_without_a_resolver_still_refuses
  • s3_invalid_tx_proposal_is_discarded_leaving_gov_state_unchanged
  • s3_invalid_tx_vote_is_discarded_leaving_gov_state_unchanged

Cross-references

Evidence notes

STATUS FLIPPED partial -> enforced at BND-2d (2026-08-16) on the live evidence cited above; the transition itself was never in question, only whether the resolver could be POSITIONED to feed it, which is what BND-2d fixed. Originally recorded as: STATUS IS partial DELIBERATELY: the in-tree proof is complete (2252 tests green, four gates passing) but the LIVE bar is not yet met. Live closure requires, on a fresh v5 store: the real accumulator walk resolving the collateral input at 130,350,133 through the reduced checkpoint, the cursor advancing THROUGH that block past 130,350,114, and a warm restart reproducing the resulting accumulator state -- none of which a unit test can stand in for. Flip to enforced only on that evidence. The four rewritten unit tests replaced assertions that encoded the UNIMPLEMENTED state ('fail closed because discarding is not implemented'); each now asserts the Cardano rule itself and carries a non-vacuous control (the governance ones assert gov state is UNCHANGED and that the SAME block with the tx valid DOES capture the proposal). A load-bearing discovery during implementation: process_block_certificates walked every tx and applied its certs, relying entirely on the removed guard firing first -- removing the guard without gating that walk would have silently applied a discarded tx's certificates, which is the exact bug class BND-2a fixed on the UTxO side. ID CORRECTION (BND-2d): this rule was first recorded as DC-LEDGER-03, an id already held by a long-standing rule, which broke registry uniqueness (ci_check_registry_unique_ids.sh was red from that commit until BND-2d). The older holder keeps the id; this entry -- three commits old and referenced only by its own slice doc -- takes the fresh DC-LEDGER-PHASE2-03.

Evidence

  • Reference rule from Cardano.Ledger.Babbage.Rules.Utxo (Phase2Invalid) + Babbage.Collateral -- docs/evidence/run-stores/preprod-live2c/bnd2-oracle-extraction.md.

  • LIVE BAR MET on a fresh v6 store (preprod 2026-08-16, binary 56e0a4e4) -- docs/evidence/run-stores/preprod-live2c/bnd2d-v6-live-proof-collateral-retention.txt: the accumulator applied the Phase2Invalid transition at 130,350,133, the cursor advanced 130,350,114 -> 130,550,399, epoch_fees moved by +4,431,065,989 and acc_fp changed 6e88b763 -> 001e4bf6, and a warm restart recovered the accumulator to exactly 130350114/5024325/c16626fe first.