Verify ledger recovery from snapshot suffixes

[kaikisegfault]

Linked work

Advances #11

Outcome

Every retained snapshot now drives an independent recovery path: reopening starts a second ledger from the decoded snapshot, replays only later journal rows through fresh ordered queries, and requires the recovered head to equal authoritative full-genesis replay.

Scope

Included:

• fresh suffix block and admitted-transaction queries after the snapshot height;
• exact comparison of every replayed transaction ID, receipt, state/transaction root, header, and block ID;
• final complete state and root comparison with full replay;
• restart coverage for genesis, behind-head, and current-head snapshots with nonempty and empty suffixes;
• verified PR Persist canonical version-one ledger snapshots #15/main matrix evidence and updated architecture/handoff.

Excluded:

• portable archive export/import;
• pruning or trusting snapshots instead of full replay;
• ambiguous-commit reopen, fault injection, and storage migration;
• consensus-visible changes.

Protocol and compatibility impact

None. Full genesis replay remains the M1 startup and audit authority. This adds the independent snapshot-plus-suffix recovery check required by ADR 0007 without changing canonical ledger outputs or stored bytes.

Verification

Candidate: f5a137a1df1d901067cd11531211bfa90a20dac6

Passed locally:

• cmake --build --preset gcc-debug --target storage_snapshot_v1_tests storage_sqlite_history_tests storage_sqlite_ledger_tests
• ctest --test-dir out/build/gcc-debug --output-on-failure -R '^storage-(sqlite-ledger|sqlite-history|snapshot-v1)$' — 3/3 passed
• git diff --check

GitHub Actions run 30164373238 passed on the exact candidate:

• GCC debug: 17/17 tests
• GCC ASan/UBSan: 17/17 tests
• Clang debug: 17/17 tests
• Clang ASan/UBSan and four bounded fuzz targets: 21/21 tests

Risks and follow-up

The second recovery path intentionally duplicates history reads and kernel execution for audit independence. Full replay still constructs the published head. The next issue #11 slice is the canonical portable archive codec and serialized export/import boundary.

Checklist

• The change is focused and contains no unrelated user work.
• Specifications and ADRs match consensus-visible behavior.
• Negative, boundary, property, differential, and fuzz checks were added where applicable.
• All required verification passed in the current working state.
• Documentation and current-state.md are accurate.
• No AI author, committer, or co-author attribution was added.