DC-PUMP-03

DC derived enforced

Wire-pump keep-alive client (PHASE4-N-AM). The admission wire pump (run_admission_wire_pump -- the SOLE per-peer pump, CN-PUMP-01) runs the N2N keep-alive CLIENT (mini-protocol 8): on a cadence STRICTLY under the peer's keep-alive timeout (~97s observed) it sends KeepAliveMessage::KeepAlive(cookie) (Initiator) via the EXISTING outbound OutboundFrame path, advancing the REUSED BLUE ade_network::keep_alive state machine (keep_alive_transition: ClientIdle -> ServerHasAgency{cookie}); on the inbound MsgResponseKeepAlive(cookie') it advances the SAME state machine (ServerHasAgency{cookie} + Server -> ClientIdle, validating cookie' == cookie). WIRE-ONLY: the keep-alive client produces no canonical input, no WAL entry, and NO AdmissionPeerEvent (Block / TipUpdate / RollBackward / Disconnected) -- it never affects admission, the durable chain, fork-choice, the convergence-evidence vocabulary, replay-equivalence, or any BLUE state (the DC-PUMP-01 emit-set stays unwidened). MUST NOT: redefine the BLUE keep-alive grammar (reuse ade_network::keep_alive + ::codec::keep_alive); use a cadence >= the peer timeout; send a new MsgKeepAlive while one is in flight (respect ServerHasAgency agency); block / starve / reorder the chain-sync or block-fetch flow; dispatch a keep-alive frame as a chain-sync/block-fetch event (closed match over AcceptedMiniProtocol); silently swallow a grammar violation (fail closed via AdmissionWirePumpError::KeepAlive -- drop the peer); use rand / wall-clock for the cookie (monotonic u16 counter); implement a keep-alive SERVER/responder (client only -- the responder is a CE-AM-LIVE-gated follow-on). With the client running, a live participant AND single-producer follow sustains past the ~97s keep-alive deadline -- the prerequisite that makes the CE-AI-6 induced-reorg convergence capture runnable. SCOPE: the keep-alive client ONLY; does NOT add multi-peer ChainSel, does NOT flip CN-CONS-03, does NOT broaden CN-PUMP-01 / DC-PUMP-01 / DC-PUMP-02 (cross-refs, preserved).

Source: docs/planning/phase4-n-am-wire-pump-keepalive-sustain-invariants.md + docs/clusters/PHASE4-N-AM/cluster.md
Introduced in: PHASE4-N-AM

Enforcement trace

Code

Tests 3

admission::wire_pump::tests::wire_pump_sends_keep_alive_on_quiescent_cadence
admission::wire_pump::tests::wire_pump_keep_alive_response_validates_cookie_no_event
admission::wire_pump::tests::wire_pump_keep_alive_cookie_mismatch_fails_closed

CI 1

ci_check_keep_alive_wire_only.sh

Cross-references

Strengthened in

Open obligation

ENFORCED at PHASE4-N-AM /cluster-close (2026-06-11). The prior blocked_until_operator_sustain_pass obligation is DISCHARGED -- CE-AM-LIVE (the operator sustain pass) PASSED. Live evidence (FROZEN c2-testnet relay 127.0.0.1:38061, magic 42; transcript OUTSIDE-REPO at ~/.cardano-ceai6/am-camlive/, scrubbed note only): a fresh bare-anchor recover @ slot 202 caught up admitting 5 blocks (slots 209,210,221,237,241) -> agreement_verdict{agreed} @ slot 241 with our_hash == peer_hash (7d4278c4..., EXACT match) -> then IDLE at the frozen tip while the keep-alive client SUSTAINED the link 152s (vs the prior ~96s EOF): 7 MsgKeepAlive on the ~20s cadence (cookies 0..6), 7 MsgResponseKeepAlive cookies VALIDATED, 0 keep-alive grammar failures, 0 idle-EOF / ShutdownPeer(KeepAlive) (the relay held Ade a hot peer the full run; its only disconnect was BearerClosed from the timeout-kill, NOT ExceededTimeLimit(KeepAlive)). Transcript sha256 = b96b842afed7d5d33bcb9279552864689708636764d045775da401ebdd558702; convergence sha256 = a86f764cb31c582818003eeb44fc40896ce729dfe957b4ba521799158c4a94a6. NOT a CE-AI-6 claim -- NO reorg / NO slot regression occurred (CE-AI-6 is a SEPARATE partition->heal reorg pass on a bridge venue). Hermetic backing: CE-AM-1 wire_pump_sends_keep_alive_on_quiescent_cadence (start_paused virtual-time -- the production run_admission_wire_pump select! emits a real proto-8 MsgKeepAlive over a loopback mux during inbound quiescence, no AdmissionPeerEvent), CE-AM-2 wire_pump_keep_alive_response_validates_cookie_no_event, CE-AM-3 wire_pump_keep_alive_cookie_mismatch_fails_closed (cookie mismatch + unsolicited-ClientIdle response + undecodable payload all -> AdmissionWirePumpError::KeepAlive fail-closed), CE-AM-4 ci_check_keep_alive_wire_only.sh GREEN (reuse-not-redefine + wire-only fence), CE-AM-5 existing pump tests unperturbed (13/13 wire_pump). Both close-gate reviews CLEAN (IDD 0 BLOCK; security 0 HIGH/MEDIUM, 1 INFO = a Byzantine bad-cookie forces a self-inflicted peer disconnect, acceptable under fail-closed). Separate (NOT N-AM): a warm-start from a caught-up store hit ReplayFailedAt slot 209 VrfCert VerificationFailed -- a BLUE recover-follow/WAL-replay concern (keep-alive is wire-only, touches no WAL/replay), deferred to its own investigation. Repo gate sweep at close = 156/159 (3 PRE-EXISTING reds byte-unrelated to N-AM: admission_wire_pump_closure / lifecycle_owner_uses_bootstrap_initial_state / node_path_fidelity, deferred to a separate stale-gate hygiene triage) + the new ci_check_keep_alive_wire_only.sh PASSES.