# CCIP mirror flow — Chain 138 ↔ ALL Mainnet (651940)

## Roles

- **Primary reserve writer:** Chain **138** (`ReserveCommitmentStore.commitReserve` or `commitReserveAttested`) after operational attestation signing.
- **One-shot mirror send:** `OMNLMirrorCoordinator.commitReserveAndMirror` on **138** commits then sends CCIP (native fee). Grant `RESERVE_COMMITTER_ROLE` on `ReserveCommitmentStore` to the coordinator address.
- **Mirror chain:** **651940** receives identical commitments via `OMNLMirrorReceiver.ccipReceive`, which calls `ReserveCommitmentStore.applyMirrorCommit` (caller must equal `mirrorReceiver` set on the store).

## Finality

- **138 (QBFT):** treat blocks as final immediately for attestation pipeline (`confirmations: 1` in indexer config).
- **651940:** wait **12 confirmations** before treating mirrored state as binding for **breaker automation** that affects user funds (matches [chains.ts](../../services/token-aggregation/src/config/chains.ts) defaults).

## Payload encoding

Off-chain helper (repo): `services/token-aggregation/scripts/encode-omnl-mirror-payload.mjs`.

`OMNLMirrorReceiver` decodes `message.data` as:

```text
abi.encode(version, lineId, R, validUntil, evidenceHash, merkleRoot)
```

- `version` must be **strictly greater** than the stored version for `lineId` on the mirror store.
- `lineId` is `bytes32`.
- `R`, `validUntil`, `evidenceHash`, `merkleRoot` must match the primary commit being mirrored.

## Router integration

1. Deploy `OMNLMirrorReceiver(router651940, reserveStore651940, admin)` on ALL Mainnet.
2. On `ReserveCommitmentStore` (651940): `setMirrorReceiver(receiverAddr)` (admin).
3. On receiver: `setSourceAllowed(chainSelector138, true)` with the **Chainlink CCIP selector** for Chain 138 as **source**.
4. From Chain 138, send CCIP messages to `receiver` on 651940 with **no token amounts** (data-only message) using the encoded payload above. Fee in native or LINK per router config.

## Replay protection

`OMNLMirrorReceiver` marks `messageId` processed (same pattern as [CCIPRelayBridge](../../contracts/relay/CCIPRelayBridge.sol)).

## Desync breaker

If mirrored `version` / `R` on 651940 lags primary beyond `N` blocks (operator config), automation documented in [RUNBOOK_CIRCUIT_BREAKERS.md](./RUNBOOK_CIRCUIT_BREAKERS.md) should alert and optionally invoke `OMNLCircuitBreaker.setLinePaused` / `setGlobalPaused`.