DC-PUMP-07

DC derived enforced

Bounded deferral, fail closed. Peer frames held while the pump waits for downstream capacity are bounded by the fixed, closed, non-configurable MAX_DEFERRED_PEER_FRAMES; exceeding it fails closed with the typed AdmissionWirePumpError::DeferredFrameOverflow. Deferral is never unbounded buffering. The bound HOLDS because the pump issues no new chain-sync RequestNext / block-fetch RequestRange while backpressured (outbox_payloads is drained only by the outer loop, which is not running), so a well-behaved peer quiesces after its in-flight batch and only keep-alive traffic continues.

Source: docs/clusters/LIVE-WIRE-LIVENESS/SLICE-S1-keepalive-under-backpressure.md + docs/clusters/LIVE-WIRE-LIVENESS/SLICE-S2-live-feed-reconnect.md (INV-WL-3)

Enforcement trace

Code

Tests 1

ce_wl_3_deferred_frames_are_bounded_and_fail_closed

CI 1

ci_check_wire_liveness.sh

Cross-references

Evidence notes

The no-new-demand-while-backpressured mechanism (INV-WL-4) is the REASON the bound holds and is asserted structurally by the gate; it is not separately claimed as an independently tested invariant. SUPPORTING live evidence only (never the reason for enforcement): a sustained preview run 2026-08-01 (~/.cardano-live1/ade-1376-s1s2.log) held the live tip for 8h+ with 1400 consecutive keep-alive round trips, max observed inter-line stall 20.0s (the cadence itself) against the peers ~97s limit, and recovered a deliberate docker restart of cardano-node-preview in 1m48s. Enforcement rests on the named tests + ci/ci_check_wire_liveness.sh, not on this run.