ade_node

The node binary + library entry. Owns argv parsing, the node lifecycle, and the mode drivers dispatched by main(): --mode wire_only, --mode admission, --mode key_gen_kes, --mode produce, --mode node (node_lifecycle, the single lifecycle owner), plus the judge-facing ade mithril snapshot fetch acquisition command. Carries the full N-F-C…N-AO --mode node live surface, the AUTOMATIC ECA epoch-boundary activation (maybe_activate_epoch_boundary, keyed on canonical state, NOT a flag — the epoch_* orchestration modules), and the native-Mithril FirstRun route. NEW this refresh — LIVE-FORGE-HARDENING (shell-only): S1 extracted the participant RollBack arm into the shared pub(crate) resolve_and_apply_peer_rollback (in node_lifecycle.rs) and rewired run_node_sync's former _ => UnexpectedRollback (node_sync.rs) to it, so the --mode node forge path now follows a legal within-k within-epoch live rollback through the SAME machinery as the participant path (materialize_rolled_back_state → commit_rollback → WalEntry::RollBack), byte-identical, with the pending_reselection fence set/cleared around the apply; S2 made warm_start_recovery and the forward recovered_node_schedule derive the candidate-freeze RSW from the durable seed sidecar (security_param k → praos_rsw_slots) via the single sidecar_freeze_rsw helper, with the restart-CLI RSW kept ONLY as a fail-closed cross-check. Also NEW: mithril_fetch (RED snapshot ACQUISITION — the only step that talks to Mithril; ade node run then consumes a purely-local verified directory) and ops_log (RED write-only operational telemetry). #![deny(unsafe_code)] preserved with ZERO local allows.

argv (closed mode set); operator key/genesis/opcert paths; a peer's tag-24-wrapped BlockFetch MsgBlock; each peer item as a peer-tagged NodeSyncItem. Rollback (S1): resolve_and_apply_peer_rollback interprets a peer RollBackward Point against the durable store — a within-k within-epoch in-store target is applied durably (canonical target = STORED slot+hash, DC-NODE-29); Point::Origin / unknown hash / peer-slot ≠ stored-slot / deeper than k / below the seed anchor keep their exact typed halts. ECA: epoch_wire::extract_source_window interprets the DURABLE ChainDB range (no peer/network/CLI); derive_authoritative_candidate replays the validated window over a FRESH scratch checkpoint; verify_live_readiness is an INDEPENDENT non-authoritative cross-check. Native Mithril: native_firstrun::native_first_run_bootstrap interprets the operator-supplied files (manifest + V2 state + V2 tables + Shelley genesis) into the bootstrapped authority through the closed native composition; mithril_fetch downloads + verifies a snapshot directory.

All carry-forward --mode node prohibitions (closed mode set; single lifecycle owner via bootstrap_initial_state; durable-tip ONLY via pump_block; content-blind planner; the serve-as-projection / forge-on-followed-tip / receive-idempotency fences; the PHASE4-N-AO DC-NODE-34…41 SELECT-driver fences; the MEM OP-MEM-02 exit-35 fail-closed + ade_mem_diag-behind-the-toggle + #![deny(unsafe_code)] zero-allows fences). ECA (DC-EPOCH-05..14 / DC-EVIEW-08): NO build- or runtime-level switch may decide WHETHER epoch-view activation occurs (there is NO EVIEW_ACTIVATION_ARMED const / armed param / if !armed guard anywhere in crates/); activation is AUTOMATIC and DETERMINISTIC, the ONLY gate being the activation predicate over canonical durable state; the candidate's source window comes from the canonical DURABLE selected chain ONLY (never wall-clock, never a peer fetch); activation is ONE atomic durable-before-visible path holding exactly ONE ActiveEpochAuthority crossed Seed→Promoted IN PLACE; a failure after the predicate is a TERMINAL halt, never a seed fallback; at most ONE canonically-bound view per target epoch (recovery re-derives + promotes only on byte-identical recompute). NATIVE MITHRIL (DC-MITHRIL-07): the native FirstRun route MUST FORBID --json-seed-path / --consensus-inputs-path (NativeRouteForbiddenFlag), require manifest + state + tables + Shelley-genesis, and route through the single native composition — no cardano-cli, no JSON seed, no convenience fallback. NEW — LIVE-FORGE-HARDENING (shell-only, no BLUE edit): (S1, INV-FH-1/2/3/4) the forge path follows ONLY a peer rollback whose target is in the durable store, within k, on the canonical chain, AND at/after the current promoted authority's epoch-start slot; every genuinely-illegal rollback (Origin, unknown hash, slot mismatch, beyond-k, below-anchor, or one that would un-cross an epoch boundary against an already-promoted authority) keeps its exact typed halt — the fail-closed posture is strictly widened-correct, not relaxed; the forge path MUST NOT forge across a pending rollback (pending_reselection set around the apply, DC-NODE-27/28) and MUST reuse the SHARED resolve_and_apply_peer_rollback (no second rollback path). (S2) warm_start_recovery + recovered_node_schedule MUST derive the candidate-freeze RSW from the durable sidecar security_param through the single BLUE praos_rsw_slots (the store is the SOLE freeze authority on both the recovery-replay AND forward-loop paths); the restart-CLI RSW is a fail-closed cross-check ONLY (a mismatch is terminal), never the source; a v5 sidecar surfaces the TYPED ConsensusInputsSchemaUnsupported{required:6} (re-bootstrap, not corruption), and a missing security_param fails closed (MissingField, no fabricated default). mithril_fetch / ops_log MUST NOT influence any authoritative state, transition, replay, or consensus decision.

None (binary + integration tests).

ade_types, ade_core (consensus::{fork_choice::select_best_chain, header_validate, candidate, header_summary, events::Point, era_schedule::{EraSchedule, praos_rsw_slots}, ledger_view::LedgerView, vrf_cert::ActiveSlotsCoeff, SecurityParam}), ade_crypto, ade_ledger (block_validity::*, state::LedgerState, fingerprint::*, rollback::{materialize::*, admission::*}, wal::{WalEntry, event::*}, the reduced-view / native-Mithril families, frozen_leadership::{FrozenLeadershipPoolDistr, to_pool_distr_view}, epoch_accumulator::*, bootstrap_bridge::*, seed_consensus_inputs::{SeedEpochConsensusInputs, SEED_CINPUT_SCHEMA_VERSION}, mempool::ingress::mempool_ingress, pump_block via forward_sync), ade_runtime (chaindb::{ChainDb, ReducedUtxoCheckpoint, reduced_window_driver, transient_epoch_view, epoch_accumulator_store, epoch_accumulator_advance}, mithril_native_assembly::*, mithril_bootstrap, admission::*), ade_network, ade_codec, mimalloc (binary-only), ade_mem_diag (binary-only, behind the toggle), serde, serde_json, tokio. Dev-deps: ade_testkit, tempfile.

main(); ade_node::run_node_lifecycle (--mode node); ade_node::node_lifecycle::{run_relay_loop, ForgeActivation, resolve_and_apply_peer_rollback, sidecar_freeze_rsw, recovered_node_schedule, warm_start_recovery, apply_chain_event, run_participant_sync, dispatch_competing_fork_choice, prove_fork_switch, apply_fork_switch, maybe_activate_epoch_boundary, first_run_native_mithril_bootstrap}; ade_node::node_sync::{NodeBlockSource, NodeSyncItem, run_node_sync}; ade_node::fair_merge::fair_merge; the ECA activation seam (epoch_wire::*, epoch_source_window::*, epoch_candidate::derive_candidate, epoch_activate::activate_at_boundary, epoch_activation::{ActiveEpochAuthority, activation_predicate, recover_active_view}, epoch_rebind::decide_epoch_rebind); ade_node::native_firstrun::native_first_run_bootstrap; ade_node::mithril_fetch::{resolve_mithril_profile, MithrilProfile}; ade_node::mem_measure::*; ade_node::convergence_evidence::*; ade_node::cli::{Cli, ProduceCli, Mode}.

lib.rs, cli.rs, node.rs, main.rs (RED entry + #[global_allocator] mimalloc), node_lifecycle.rs (the --mode node owner + the fork-switch drivers + the AUTOMATIC EVIEW activation call + the native-Mithril route + the shared resolve_and_apply_peer_rollback / sidecar_freeze_rsw / recovered_node_schedule / warm_start_recovery helpers), node_sync.rs (the forge-path rollback rewire), fair_merge.rs, admission/, mem_measure/, the PHASE4-N-AO candidate_aggregator.rs/lca_walk.rs/selector_state.rs/post_switch_continuity.rs/fork_switch.rs, convergence_evidence.rs, admission_log/, epoch_wire.rs/epoch_source_window.rs/epoch_candidate.rs/epoch_activate.rs/epoch_activation.rs/epoch_rebind.rs, native_firstrun.rs, mithril_fetch.rs (NEW), ops_log.rs (NEW), operator_forge.rs/ba02_pass.rs/rehearsal_pass.rs/produce_mode.rs/wire_only.rs/key_gen.rs (RED).

Cli, CliError, ProduceCli, KeyGenKesCli, Mode (closed), NodeStartupInputs, NodeShutdownEvidence, NodeRunError, exit-code constants (incl. EXIT_LIVE_STATIC_UTXO_FP_INVALID = 35). node_lifecycle (RED): NodeStart, NodeLifecycleError (incl. NativeRouteForbiddenFlag, NativeFirstRun), ForgeActivation<'a>, run_relay_loop / run_relay_loop_with_sched, the shared resolve_and_apply_peer_rollback + sidecar_freeze_rsw + recovered_node_schedule + warm_start_recovery helpers, the PHASE4-N-AO RED drivers. node_sync (RED): closed NodeBlockSource, NodeSyncItem { Block { peer, bytes } \| RollBack(Point) }, NodeSyncError. fair_merge (RED): per-peer bounded lanes + deterministic round-robin merge. ECA (RED, NOT canonical-counted): the epoch_wire / epoch_source_window / epoch_candidate / epoch_activate / epoch_activation / epoch_rebind error+outcome+authority types (ActiveEpochAuthority, ActiveEpochView one-way Seed→Promoted, activation_predicate, EpochViewActivationError, …). Native Mithril (RED, NOT canonical-counted): native_firstrun::{NativeGenesisFacts, NativeFirstRunError, NativeGenesisParseError}; mithril_fetch::{MithrilProfile, FetchError}. Plus the carried MEM + PHASE4-N-AO GREEN/RED surfaces.