Escalated while executing the store-APIs follow-up plan (delivered as draft PR #1155). Both surfaced while diagnosing the strict-feature test failures; neither is touched by that PR, per the plan's scope decision that a potential ledger defect is a finding to escalate, not something to absorb.
1. An Empty work buffer re-runs the Genesis work unit on the first imported block
ToyDomain's constructor executes the Genesis work unit out of band, leaving CardanoLogic's WorkBuffer at Empty. The first block then imported takes WorkBuffer::on_genesis_boundary — re-running Genesis — and no Ewrap/Estart pairs are emitted for any epochs between genesis and that block. Downstream, EpochStatsUpdate::apply calls EpochValue::live_mut (crates/cardano/src/model/epoch_value.rs:236) with the block's epoch against an EpochState still at Epoch(0): a panic under strict, silent mis-attribution of epoch stats under default features. This is what breaks the dolos-minibf/dolos-minikupo/dolos-trp fixtures under --all-features (266 tests, currently excluded with the reason recorded in AGENTS.md); the fixture-side repair is filed as a follow-up plan. The open question is whether the Empty-buffer path itself should behave differently, which is pipeline code and out of that plan's scope.
2. pallas_extras::epoch_boundary collapses a multi-epoch gap into a single Ewrap/Estart pair
crates/cardano/src/pallas_extras.rs:309: when two consecutive blocks are more than one epoch apart, the boundary logic emits one Ewrap/Estart pair instead of one per skipped epoch, so every epoch-keyed entity under-transitions. Unreachable on mainnet (no epoch passes without blocks); reachable on sparse devnets and in synthetic chains. Blast radius is epoch boundary handling, so per the plan's risk note this stops being a housekeeping item and wants its own decision and plan.
Refs: PR #1155.
Escalated while executing the store-APIs follow-up plan (delivered as draft PR #1155). Both surfaced while diagnosing the
strict-feature test failures; neither is touched by that PR, per the plan's scope decision that a potential ledger defect is a finding to escalate, not something to absorb.1. An
Emptywork buffer re-runs the Genesis work unit on the first imported blockToyDomain's constructor executes the Genesis work unit out of band, leavingCardanoLogic'sWorkBufferatEmpty. The first block then imported takesWorkBuffer::on_genesis_boundary— re-running Genesis — and no Ewrap/Estart pairs are emitted for any epochs between genesis and that block. Downstream,EpochStatsUpdate::applycallsEpochValue::live_mut(crates/cardano/src/model/epoch_value.rs:236) with the block's epoch against anEpochStatestill atEpoch(0): a panic understrict, silent mis-attribution of epoch stats under default features. This is what breaks thedolos-minibf/dolos-minikupo/dolos-trpfixtures under--all-features(266 tests, currently excluded with the reason recorded inAGENTS.md); the fixture-side repair is filed as a follow-up plan. The open question is whether theEmpty-buffer path itself should behave differently, which is pipeline code and out of that plan's scope.2.
pallas_extras::epoch_boundarycollapses a multi-epoch gap into a single Ewrap/Estart paircrates/cardano/src/pallas_extras.rs:309: when two consecutive blocks are more than one epoch apart, the boundary logic emits one Ewrap/Estart pair instead of one per skipped epoch, so every epoch-keyed entity under-transitions. Unreachable on mainnet (no epoch passes without blocks); reachable on sparse devnets and in synthetic chains. Blast radius is epoch boundary handling, so per the plan's risk note this stops being a housekeeping item and wants its own decision and plan.Refs: PR #1155.