cow: reorg-aware ingestion and submission-policy pass

[mfw78]

Follow-on car to the dispatch pass; stacked.

Harden ingestion and the submission journal for the type-blind wire: K-confirmation event handling, a (watch, uid) journal key with an offchainInput digest, and a refusal policy that never tears down a watch.

Why

Teardown comes only from INVALID (or NextPoll::Never); FILLED/INVALIDATED is per-orderUid and only suppresses the post for that uid while the watch persists, so a filled TWAP tranche never kills the remaining tranches. Orderbook refusals schedule or park, because the old TWAP-tuned teardown assumptions do not survive type-blindness. A uid-only journal key aliases byte-identical orders across watches, and #546's land-schema-early protocol says pay the schema break now: the submission key includes an offchainInput digest even though fan-out is W3. K-confirmation preserves the #54 removal-event behaviour under reorgs.

Scope

• K-confirmation depth before acting on ConditionalOrderCreated/Removed.
• Journal keyed (watch, uid); submission key includes an offchainInput digest; dedup semantics stay per cow: pin down what the intent-id dedup key scopes to #558 and sdk+twap: treat DuplicatedOrder as already-submitted; add errorType→retry classification #121.
• classification.toml audit: far-horizon validTo refusals park with backoff; repeated InvalidEip1271Signature long-backoff park, not teardown (extends twap: one-block retry before dropping on InvalidEip1271Signature (same-block wiring+create race) #320); DuplicatedOrder unchanged per sdk+twap: treat DuplicatedOrder as already-submitted; add errorType→retry classification #121.

Done when

• Created/Removed acted on only at depth K; a reorg test shows no premature teardown or watch loss.
• Journal and submission keys land per schema, goldens regenerated.
• No refusal class and no per-uid FILLED/INVALIDATED verdict maps to watch removal; the audit rationale is recorded in the PR body.

Blocked by: #653.

[mfw78]

Watch-tower harvest delta, one sentence of policy: watch-tower silently reset its registry on a corrupt blob (the swallowed .catch in src/types/model.ts load paths), dropping every watch with no re-backfill; invert it.

Additional done-when:

• A borsh decode failure on a watch row raises a loud typed error and poisons the module; it never silently resets or skips the row, with a test.

[mfw78]

Closing as mis-specified. Analysed from three lenses against the tree at d95ba93, after #675, #677, #678, #679 and #680 landed. Two of the three scope items solve problems that do not exist, and each was sitting next to a real one. Split into #681, #682 and #683.

K-confirmation is redundant, and harmful

bulk_backfill_bounds sets the handoff at head - MAX_REORG_DEPTH, and its own comment states that below the handoff every block is final. Every log the bulk phase delivers, which is exactly what resume = true and start_block produce on a restart, is already at least 64 confirmations deep. Depth gating does nothing for them.

For the live path it is worse than useless. The cursor commits to log.block_number whenever the guest returns Ok, whatever the guest did with the log, so a deferred log has the cursor advance past it and is never re-delivered. Deferring by returning a fault freezes frontier commits for the life of the process with no clearing path.

The runtime is optimistic-delivery-plus-retraction inside the reorg window, and terminal beyond it. What the module actually lacks is a log.removed handler: a retracted ConditionalOrderRemoved currently re-runs remove_commitment and tears down a commitment whose removal was reorged away, while the create is not re-delivered. That is genuine watch loss, and it is the symptom this issue named with the wrong cause. #681.

The journal defect does not exist

The submission journal is not uid-keyed. It is keccak(borsh(order, owner, signature)). The owner is in the body and the EIP-1271 payload embeds the commitment's params, so a collision requires two commitments that would emit the same orderUid, where deduping is correct and splitting them forces a DuplicatedOrder re-submit.

offchainInput is hard-coded empty at its only live call site, so its digest is a constant that distinguishes nothing, and once it is non-empty it is already covered transitively through the returned order and signature. The goldens named in the done-when pin the body codec and header derivation, not journal keys.

The defensible motive is sweepability on teardown, which is stated in #665 rather than here, and needs a secondary index rather than a primary-key break. #683.

The refusal policy is real, and larger than stated

Nine classes drop, InvalidEip1271Signature drops on repeat, and every error type absent from the table drops by default, including ExcessiveValidTo, which has no row at all. Park is inexpressible in three layers: the data table has no park action, RetryAction has no park variant, and classify_denied narrows every outcome to Drop or DropOnRepeat, so a park row would be silently converted.

That makes it a cross-repo change with a pin cascade, not the data-table edit the scope implies. #682.

The FILLED/INVALIDATED half of the done-when is already satisfied, delivered by #679 and #680: a fill maps to Suppress and only INVALID or NextPoll::Never retire a commitment.

Effect on the train

#655 and #665 were blocked by this issue. Neither depends on the rekey, so both are unblocked by the split. #682 is the launch-relevant piece; #681 is a small self-contained bug fix; #683 belongs with #665.

AI Assistance: Claude Code used for the three-lens analysis and the split.