AdeAtlas
Invariants / DC-NODE-38

DC-NODE-38

DC derived enforced

Live multi-block fork-anchor discovery (PHASE4-N-AO S7; the live-geometry gap CE-AO-6 surfaced). A live competing branch is eligible for SELECT only when Ade walks its preserved parent links back to a DURABLE STORED fork anchor within k (BLOCK DEPTH, not slot distance), then validates the COMPLETE intermediate header chain from that anchor (S2 validate_and_apply_header) BEFORE selection. The per-peer branch cache is NOT authority -- only an indexed memory of received, preserved headers; each entry self-binds (key_hash == re-derived header block hash, entry.slot == header.slot, entry.prev_hash == header.prev_hash) or the branch fails closed. The last-common-ancestor is the fork anchor, authoritative ONLY when ChainDb confirms slot AND hash (DC-NODE-29) -- never the competing block's immediate parent, never peer-supplied, never slot-only, never hash-only. The walk is k-bounded by BLOCK DEPTH (traversed-header count <= k AND current_tip_block_no minus lca_block_no <= k; no slot subtraction); over-k / branch-gap / no-durable-LCA / cache-self-binding- violation / lying-parent-link all fail closed with no durable mutation. A 1-deep fork degenerates to the prior single-step behavior. CARRY-FORWARD: a competing branch arriving via RollBackward/FOLLOW sequencing rather than competing Block arrivals is a SEPARATE wire-interleaving diagnostic and must not weaken this competing-block LCA invariant.

Source

docs/planning/phase4-n-ao-ce-ao-6-live-gap.md + docs/clusters/PHASE4-N-AO/S7-lca-anchor-walk.md

Introduced in
PHASE4-N-AO

Enforcement trace

Code

Tests 8

  • one_block_fork_walks_in_one_step
  • multi_block_branch_walks_to_durable_lca
  • missing_intermediate_header_fails_closed
  • ancestor_older_than_k_fails_closed_block_depth
  • cache_self_binding_violation_fails_closed
  • lying_parent_link_to_genesis_fails_closed
  • arrival_order_permutation_walks_identical
  • walk_is_deterministic

CI 1

Cross-references

DC-NODE-36DC-NODE-37DC-NODE-29DC-NODE-35DC-NODE-28CN-CONS-01CN-CONS-03

Attack rationale

Without the LCA walk, a live multi-block competing branch fails closed (UnexpectedRollback) because its immediate parent is an intermediate block on the competing branch Ade never stored -- a correctness/liveness gap (SELECT only worked for 1-deep forks), surfaced by the CE-AO-6 live two-producer run. The walk closes it WITHOUT weakening authority: the durable stored LCA (slot+hash, DC-NODE-29) is the anchor, S2 validates the complete chain, S4 proves the bodies -- the cache is evidence only. A peer that lies about parent links, presents a gapped branch, or claims an over-k ancestor fails closed; the cache self-binding prevents a stringly map of peer claims.

Evidence notes

Declared at PHASE4-N-AO S7 (the live-geometry gap CE-AO-6 surfaced; docs/planning/phase4-n-ao-ce-ao-6-live-gap.md). Enforced at S7 close (CE-AO-8) via ci_check_lca_anchor_walk.sh + 8 hermetic tests (1-deep regression, multi-block LCA walk, missing-intermediate, older-than-k by block depth, lying-parent-link, cache-self-binding-violation, arrival-order permutation, S4 body-mismatch-before-commit). Unblocks the CE-AO-6 live retry (CN-CONS-03 flips only on the committed clean two-producer transcript, NOT on hermetic-green).