nautechsystems/nautilus_trader · critical

Verified finalized transaction count advanced without an act

Error message

Verified finalized transaction count advanced without an active owned intent

What it means

During execution-verification bootstrap the node observed an on-chain finalized transaction count one higher than the durable canonical nonce ledger. The nonce-recovery path therefore requires an active execution intent at exactly the stored nonce with one retained recoverable payload, but the ownership query returned no rows. This guard prevents silently advancing the signed-transaction nonce ledger without a matching owned in-flight intent.

Source

Thrown at crates/adapters/blockchain/src/cache/database.rs:4074

                                  'broadcast', 'included', 'replaced', 'dropped', 'reorged'
                              )
                        )
                    FROM execution_intent AS intent
                    LEFT JOIN execution_transaction_hash AS hash
                        ON hash.intent_id = intent.id
                    WHERE intent.chain_id = $1
                      AND intent.wallet_address = $2
                      AND intent.active
                    GROUP BY intent.id, intent.nonce, intent.status
                    ",
                )
                .bind(chain_id)
                .bind(bootstrap.wallet_address)
                .fetch_optional(&mut *transaction)
                .await
                .map_err(|e| anyhow::anyhow!("Failed to validate nonce recovery ownership: {e}"))?;
                let Some((intent_nonce, intent_status, payload_count)) = recovery else {
                    anyhow::bail!(
                        "Verified finalized transaction count advanced without an active owned intent"
                    );
                };
                anyhow::ensure!(
                    intent_nonce == Some(stored_nonce)
                        && matches!(
                            intent_status.as_str(),
                            "broadcast" | "included" | "replaced" | "dropped" | "reorged"
                        )
                        && payload_count == 1,
                    "Verified finalized transaction count advanced without one recoverable retained payload at the durable nonce"
                );
            }
            revision
        } else {
            anyhow::ensure!(
                next_canonical_nonce == observed_canonical_nonce,
                "Initial canonical nonce conflicts with the verified finalized transaction count"

View on GitHub (pinned to 18893faf8b)

Solutions

1. Verify the bootstrap wallet_address matches the wallet of the in-flight (broadcast) transaction and that chain_id is correct
2. Restore the execution_intent row (and its execution_transaction_hash payload) for the stored nonce from backup, or re-create the recovery intent for that nonce
3. If the finalized transaction is genuinely not owned, roll back observed finalized-header state so observed_canonical_nonce equals the stored ledger nonce and re-bootstrap
4. Check that no cleanup job or migration deactivated the intent prematurely; re-activate it and retry

Example fix

// before: bootstrap against wrong wallet, intent not owned
ExecutionVerificationBootstrap { wallet_address: "0xAAA...", .. }
// after: use the wallet that owns the broadcast intent at the stored nonce
ExecutionVerificationBootstrap { wallet_address: signer_wallet.address(), .. }

let recovery = sqlx::query_as::<_, (Option<i64>, String, i64)>(
    "SELECT intent.nonce, intent.status, COUNT(hash.id) \
     FROM execution_intent intent LEFT JOIN execution_transaction_hash hash ON hash.intent_id = intent.id \
     WHERE intent.chain_id = $1 AND intent.wallet_address = $2 AND intent.active GROUP BY intent.id, intent.nonce, intent.status")
    .bind(chain_id).bind(&wallet_address).fetch_optional(&mut *tx).await?;
if recovery.is_none() && observed_nonce > stored_nonce {
    return Err(anyhow!("no active intent to cover finalized nonce advance"));
}

fn has_active_recovery(r: &Option<(Option<i64>, String, i64)>) -> bool {
    matches!(r, Some((Some(_), s, 1)) if matches!(s.as_str(), "broadcast"|"included"|"replaced"|"dropped"|"reorged"))
}

match bootstrap_verification(...).await {
    Err(e) if e.to_string().contains("without an active owned intent") => {
        // inspect execution_intent for the wallet, restore or reconcile before retrying
    }
    Err(e) => return Err(e),
    Ok(v) => v,
}

When it happens

Trigger: Running verification bootstrap (start/execute nonce-recovery check) when observed_canonical_nonce == stored_nonce + 1 but the execution_intent table has no row with chain_id, wallet_address matching the bootstrap signer and active = true — e.g. the intent was deactivated/deleted, the wrong wallet_address is in the bootstrap, or recovery bookkeeping was wiped.

Common situations: Operator restored a database dump that excluded execution_intent rows while finalized-header data survived; bootstrap configured against a different wallet than the one that signed the pending transaction; a prior recovery was manually cleaned up while finalized nonce state was kept; running against a fresh/stale environment with mismatched chain_id.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• Verified finalized transaction count is outside the owned re
• Execution schema version {} is newer than supported version
• Canonical nonce advanced without an authenticated signer tra
• Verified finalized header extension does not start at the du
• Finalized header ledger conflicts at height {}

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/65594088a832b047. Report an issue: GitHub.