T-REC-06

T true enforced

Rollback-materialization replay-equivalence (PHASE4-N-AN). A block that validates during live admit (against the eta0-overlaid chain_dep, T-REC-04) MUST NOT fail rollback-materialize replay because materialization substituted a different nonce source. materialize_rolled_back_state (the SOLE rolled-back-state authority, CN-STORE-07) MUST reconstruct the replay chain_dep with the SAME recovered eta0 (epoch nonce) the live-admit path uses (praos_vrf_input(slot, eta0), DC-CINPUT-03); the persisted snapshot's placeholder / genesis epoch_nonce MUST NOT reach VRF verification on the rollback-replay path. Same recovered store + same ordered WAL/feed => same chain_dep inputs => same block_validity result on the live-admit and rollback paths. eta0 is the recovered canonical input (the seed-epoch SeedEpochConsensusInputs.epoch_nonce sidecar) -- never peer data, wall-clock, CLI re-supply, or a re-query. VRF validation strength is UNCHANGED on the rollback path (no bypass / skip / loosening). SCOPE: the recovered seed epoch (no epoch-boundary crossing within the follow window -- eta0 is the constant epoch nonce); a multi-epoch rollback nonce-evolution is a named out-of-scope follow-on. Surfaced by the CE-AI-6 reorg (the rollback-follow died at ReplayFailedAt VrfCert); unblocks CE-AI-6.

Source: docs/planning/phase4-n-an-rollback-materialize-eta0-invariants.md + docs/clusters/PHASE4-N-AN/cluster.md
Introduced in: PHASE4-N-AN

Enforcement trace

Code

Tests 2

rollback_materialize_overlays_recovered_eta0_replay_equivalent (crates/ade_ledger/src/rollback/materialize.rs -- None overlay => VrfCert; Some(eta0) => Valid + materialized epoch_nonce == eta0 == the live-admit nonce basis)
rollback_materialize_does_not_bypass_vrf_on_wrong_eta0 (crates/ade_ledger/src/rollback/materialize.rs -- a WRONG eta0 still fails the header VRF: the overlay is not a bypass)

CI 1

ci_check_rollback_materialize_eta0.sh

Cross-references

Open obligation

ENFORCED at PHASE4-N-AN AN-S2 (2026-06-11). materialize_rolled_back_state overlays the recovered seed-epoch eta0 (PraosChainDepState::overlay_recovered_eta0 -- the SINGLE overlay authority shared with WarmStart bootstrap) onto the nearest-snapshot chain_dep BEFORE the replay-forward block_validity fold, so rollback replay validates each block's header VRF against eta0, NOT the snapshot Nonce::ZERO placeholder. Threaded from the recovered sidecar via ForwardSyncState.recovered_eta0 (apply_chain_event -- the live rollback-follow that the CE-AI-6 reorg hit) AND the bootstrap WarmStart materialize (seed_epoch_consensus_inputs.epoch_nonce -- ALSO fixes warm-start replay from a NON-bare store, the SAME root cause). Repro-first: AN-S1 (commit dbf31c7a) reproduced the VrfCert mechanically; AN-S2 flipped it to Valid. Hermetic backing: CE-AN-2/3 rollback_materialize_overlays_recovered_eta0_replay_equivalent, CE-AN-4 rollback_materialize_does_not_bypass_vrf_on_wrong_eta0, CE-AN-5 ci_check_rollback_materialize_eta0.sh, CE-AN-6 no collateral (ade_ledger materialize 7/7, ade_runtime bootstrap 36/36 + receive_rollback_integration 5/5, wal_rollback_ai_s1 13/13, ade_node 338/338, ci_check_warmstart_eta0_overlay still OK). CE-AN-LIVE PASSED (2026-06-11, fresh hermetic 2-pool bridge venue, magic 42): bare-anchor recover @ slot 162 -> follow cn2 -> induced peer reorg (short partition of cn1 + re-peer via docker network connect; cn1 led a SHALLOW round, depth 2 <= k=5, so cn2 reorged to cn1) -> Ade received the RollBackward and FOLLOWED it: strict slot REGRESSION admit 371 -> 361, then re-converged to agreement_verdict{agreed} @ slot 383 with our_hash_hex == peer_hash_hex (5b65db35..., the reorged cn1 tip) -> 16 admits, 2 agreed (initial @ 212 + post-reorg @ 383), 0 diverged, Ade ALIVE, 0 VrfCert/ReplayFailedAt -- the eta0 overlay HELD through the live rollback (without AN-S2 Ade died here with ReplayFailedAt VrfCert; this is the live proof of the fix). Transcript OUTSIDE-REPO at ~/.cardano-ceai6/ceai6-capture/ceai6-convergence.jsonl (bridge-venue methodology stays internal; scrubbed note only), convergence sha256 = f3553aaa948f43b08c55a859421dcb8b048d16680e97ca20b9f8acd27aa28b01; ci_check_convergence_evidence_schema.sh OK. SCOPE: the recovered seed epoch (no epoch-boundary crossing in the follow window); a multi-epoch rollback nonce-evolution is a named out-of-scope follow-on.