final-qa → develop: grant review fixes, performance improvements, and infrastructure

[lgahdl]

Summary

93 commits ahead of develop, covering all grant review findings (F1–F21), five performance improvements, three new order types, two data model fixes, a Ponder engine patch, and a full CI/deploy pipeline rewrite.

---

Grant Review Fixes

Correctness

• F1 (COW-988): OrderStatusTracker now batch-upserts open discrete orders instead of N sequential await update() calls; added MAX_DISCRETE_ORDERS_PER_BLOCK per-block cap (default 200)
• F11 (COW-989): stale TWAP candidates whose orderbook records aged out of /by_uids now fall back to /account/{owner}/orders before deletion — recovers fulfilled parts that would otherwise be permanently lost
• F16 (COW-990): parent-cancelled cascade now runs a pre-flight /by_uids check before writing status=cancelled, catching the ~0.17% case where a solver filled the order between generator creation and cancellation
• F8 (COW-991): wrapped all four RPC calls in settlement.ts (getTransactionReceipt, getCode, call, readContract) with withTimeout; moved settlement work inline into the event handler (eliminates block-handler queue)
• F9 (COW-991): wired GPv2Settlement registration for gnosis — was mainnet-only despite gnosis having gpv2Settlement + flashLoanRouter addresses in src/data.ts
• F12/F13 (COW-992): excluded stale (past-validTo) candidates from the /by_uids confirmation batch to reduce per-block API load; documented dedicated RPC as a hard production requirement
• F15 (COW-993): added hash field to the generator object in GET /api/orders/by-owner REST response
• F4 (COW-997): removed dead orderbook_cache table from setup.ts (live cache is order_uid_cache in cow_cache schema)
• F6 (COW-998): replaced raw SQL string interpolation for UID cache reads with parameterized Drizzle eq() queries
• F2 (COW-999): synced DETERMINISTIC_ORDER_TYPES to include CirclesBackingOrder, matching all types handled by uidPrecompute.ts
• F7 (COW-1000): renamed all five block handlers to semantic names (OrderDiscoveryPoller, CandidateConfirmer, OrderStatusTracker, OwnerBackfill, CancellationWatcher)
• F5 (COW-886): added three composite indexes on conditional_order_generator (C1/C5 poll pattern, C3 open-order pattern) and candidate_discrete_order (C2 stale-sweep pattern)
• F19 (COW-994): structured JSON logging via cowLog helper; documented /healthz for liveness vs /ready for readiness with K8s manifest snippet
• F21 (COW-1001/1002): removed hardcoded counts from docs/architecture.md; fixed stale "Five tables" → dynamic description (schema now has six tables)

Data Model

• COW-1007: typed ComposableOrder.creationDate as bigint to match on-chain timestamp precision
• COW-1008: derived isComplete from isRealtime && historicalBlocksFetchedPct === 100 instead of the unreliable ponder_sync_is_complete field

---

New Order Types (COW-1006)

Classified Curve/Balancer fee burners and CoW AMM constant-product pools as named order types (CurveCowSwapBurner, BalancerCowSwapFeeBurner, CowAmmConstantProduct) instead of Unknown. These are non-deterministic single-shot types handled by C1.

---

Performance Improvements (COW-1017 umbrella)

• COW-1014: uniform interval: 10 on gnosis (50 s window) and interval: 4 on mainnet (48 s window) — eliminates handler-stacking lag from all handlers firing on the same block every 5 s
• COW-1015: capped fetchComposableOrders at 4 pages × 25 orders with signingScheme=eip1271 filter; added BOOTSTRAP_MAX_RETRY_COUNT=5 to abandon permanently timing-out owners
• COW-1016: replaced N sequential DB inserts with single multi-row upserts using excluded.*; parallelized /by_uids HTTP chunks with Promise.all
• COW-1018: OwnerBackfill now marks owners with 0 composable orders as lastPollResult='bootstrap:noop' and skips them on future restarts — eliminates 30–40 s block stalls
• COW-1019: chunked candidateRows/discreteRows inserts at 500 rows per INSERT — fixes node-postgres silent bind-parameter drop above ~29k params (stalled re-index for >1 h at 29.3%)

Verified in production (2026-06-16): gnosis lag ≤ 4 blocks, heavy event blocks 1.3–2.3 s.

---

Ponder Engine Patch (COW-1009)

Upgraded Ponder from 0.16.3 → 0.16.6 and applied two patches:

• Unique savepoint names in flush(): prevents ROLLBACK TO SAVEPOINT crashes when multiple handlers flush concurrently in multichain mode
• qb snapshot at flush start: prevents mid-flush external mutation of the query builder in multichain handlers

Also refactored settlement adapter discovery: inlined into the GPv2Settlement:Settlement event handler and removed the SettlementResolver block handler (eliminated a source of context.db.sql calls that triggered unwanted flush() invocations).

---

CI/Deploy Pipeline

• Rewrote deploy.yml to run docker commands directly via SSH — server has no Node.js so manage.ts could not run remotely
• Added monitor_only input: check server status without deploying (gh workflow run deploy.yml --ref <branch> -f monitor_only=true)
• Added skip_schema_drop input: resume from existing checkpoint without re-indexing (PONDER_EXPERIMENTAL_DB=platform)
• Added PONDER_EXPERIMENTAL_DB: platform permanently to docker-compose.yml
• Increased ponder container nofile ulimit to 65,536

---

Test plan

• pnpm typecheck passes
• pnpm lint passes
• All grant review findings validated in production — see thoughts/grant-review-fix-tracking.md
• Deployed to production on 2026-06-16; indexer live at chain tip on both chains
• Gnosis lag ≤ 4 blocks sustained over hours of live monitoring
• OwnerBackfill noop: verify OwnerBackfill:owner_noop on first restart after COW-1018 deploys fresh, then OwnerBackfill:no_bootstrap_needed on the subsequent restart

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ponder@​0.16.3 ⏵ 0.16.6	+3		+1	-7

View full report