Invariants / T-REC-02

T-REC-02

T true enforced

All authoritative state derivable by replay from inputs

Source: Project constitution §2

Enforcement trace

Code

crates/ade_runtime/src/recovery/mod.rs
crates/ade_runtime/src/recovery/restart.rs

Tests 2

recover_from_snapshot_and_replay_forward
recover_from_genesis_when_no_snapshot

CI 1

ci_check_recovery_contract.sh

Cross-references

Strengthened in

Evidence notes

PHASE4-N-F-A (2026-05-30): the seed-epoch consensus inputs are now part of the replay-derivable recovered surface — A3a records the import as a replay-reconstructable WAL fact (RecoveredBootstrapProvenance) and A3b's warm-start verification CAPABILITY derives the recovered SeedEpochConsensusInputs from it (DC-CINPUT-01, authority surface). PHASE4-N-F-C (2026-05-31): production wiring landed — the --mode node owner replays from the persisted WAL to reconstruct the recovered surface and the L4c kill→warm-start test proves the synced tip is fully replay-derivable through the production path (DC-CINPUT-01 now enforced).