feat(ethflow-watcher): observe + verify orderbook indexing (BLEU-833 redesign, COW-1076)

[brunota20]

Why this PR exists

Sibling to PR #10. Same base (BLEU-832 decode), different design choice at the BLEU-833 step. Proposes that the M2 review choose observe + verify instead of the original submit + retry approach, on empirical evidence that the submit approach cannot succeed against the real orderbook.

Evidence collected from a 2026-06-22 Sepolia soak

The watcher observed 3 OrderPlacement events during the soak (18:43, 18:53, 21:19 UTC). Each was logged as ethflow dropped … ExcessiveValidTo under the BLEU-833 + COW-1074/1075/1076 patches. Hitting the orderbook for the same UIDs:

UID prefix	status	executedSellAmount	creationDate
0x86de7326…	fulfilled	0.03 WETH	2026-06-22T18:43:36Z
0x873f2083…	fulfilled	0.10 WETH	2026-06-22T18:53:12Z
0x2dc21c6a…	fulfilled	0.01 WETH	2026-06-22T21:19:24Z

All carry validTo: 4294967295 (u32::MAX) — the shape we believed the Sepolia orderbook rejects. It doesn't. The orderbook accepts that shape, but only through its native indexer, not through POST /api/v1/orders.

The fulfilled order entries include fields that do not exist on the OrderCreation request body in cowprotocol-orderbook:

"onchainUser": "0x536a844ef215dd8a13a06023f24a568e4ee3cb6b",
"onchainOrderData": { "sender": "0x536a844e…", "placementError": null },
"ethflowData": { "userValidTo": 1782155600, "refundTxHash": null, "isRefunded": false },

ethflowData.userValidTo is a real Unix timestamp — extracted from the EthFlowOrder.data payload embedded in the on-chain OrderPlacement event. Only the orderbook backend's own indexer writes those fields. The public POST /api/v1/orders endpoint shepherd targets applies the generic validity cap and rejects with ExcessiveValidTo regardless of chain, signing scheme, or from address.

What changes

Replace submit_placement with observe_placement:

Outcome	Marker	Log level
Orderbook GET returns 200	observed:{uid} written	Info — "orderbook indexed"
Orderbook GET returns 404	(none — allow re-check)	Info — "not yet indexed; will recheck on re-delivery"
Orderbook GET returns other err	(none)	Warn with code + message

observed:{uid} makes log re-delivery a no-op once verified. 404 is treated as expected indexer lag — shepherd's WebSocket can deliver the log a few hundred milliseconds before the orderbook's own indexer commits — and intentionally does not write the marker, so a future log re-delivery (or a block-tick poll, out of scope here) can re-verify.

Capability surface trimmed: this revision uses local-store, logging, and the cow-api::request host import. It no longer uses cow-api::submit-order. That call site can be retired entirely once the rest of the stack is updated.

Tests (10 total, all pass natively + wasm32-wasip2)

• BLEU-832 decode tests preserved verbatim: well-formed placement, staging address, wrong contract, wrong topic, truncated address / data, empty topics.
• New: compute_uid_pins_owner_to_ethflow_contract_and_validto — asserts the 56-byte UID layout digest || owner || valid_to, owner = EthFlow contract, valid_to = on-chain validTo.
• New: compute_uid_returns_none_on_unsupported_chain.
• New: gpv2_to_order_data_rejects_unknown_kind_marker — defensive against unrecognised enum markers.

running 10 tests
test result: ok. 10 passed; 0 failed; 0 ignored

cargo clippy -p ethflow-watcher --all-targets clean. cargo fmt --check clean. cargo build -p ethflow-watcher --target wasm32-wasip2 --release clean.

Stack impact

This invalidates the design that PRs #10 (BLEU-833 submit), #47 (COW-1074 appData resolve), #48 (COW-1075 error envelope forwarding for cow-api errors), and #49 (COW-1076 ExcessiveValidTo log downgrade) were patching. Once this lands as the M2 EthFlow design:

• PR feat(ethflow-watcher): build OrderCreation + submit + apply retry_hint (BLEU-833) #10 is replaced (this PR is the sibling proposing the alternative).
• PR feat(sdk + twap-monitor): resolve non-empty app_data via orderbook lookup (COW-1074) #47's resolve_app_data helper is still useful for twap-monitor which legitimately submits orders. ethflow-watcher no longer needs it (UID computation does not need the appData JSON, only the hash).
• PR fix(cow-api): forward orderbook ApiError to HostError.data (COW-1075) #48's forward orderbook ApiError cow-api change is still useful for twap-monitor.
• PR feat(ethflow-watcher): downgrade ExcessiveValidTo drops to Info (COW-1076) #49's ExcessiveValidTo log downgrade becomes moot — there is no submit attempt to fail.

Out of scope (follow-up)

• Block-tick poll for stuck indexer lag. Today the 404 path relies on log re-delivery for a re-check, which is rare. A follow-up can add a [[subscription]] kind = "block" to the manifest and a pending:{uid} marker swept on each block, so persistent indexer downtime surfaces as a Warn after N blocks. Tracked as a new follow-up.
• ADR-0006 prose update. ADR-0006 currently says the EthFlow module "constructs the OrderCreation … and submits the same way" — this needs revision to reflect that on-chain EthFlow orders are outside the host's submit_order contract. Out of scope here, will land in the M2 epic doc bundle.

AI assistance disclosure: drafted by Claude (Opus 4.7, 1M context) following a 2026-06-22 soak inspection.

[linear-code]

COW-1076

[brunota20]

Live validation note (2026-06-23 14:00 UTC)

Combined with the rest of the redesign + fix bundle on deploy/cow-1076-observe-on-m5 and deployed to the Sepolia soak VM. Container Up healthy with the new image since 13:56:50 UTC. Will accumulate live evidence in the next observation window.

Companion PRs (same redesign / soak deploy bundle)

PR	Concern	Layer
#62	ethflow-watcher: observe + verify (replaces submit)	M2 (BLEU-833 alternative)
#63	ethflow-watcher: same redesign with BLEU-855 split	M3/M4 (COW-1074 base)
#64	twap-monitor: skip submit on already-submitted UID	M5 (COW-1085)
#65	nexum-engine: gap-closed log on alloy-internal reconnect	M5 (COW-1086)

Each is single-concern; the deploy branch is the cumulative integration point and will fold into latest once the stack lands.

[brunota20]

Superseded by deploy branch commit 6215810 deploy: ethflow-watcher observe + verify redesign rebased onto M5 (now squashed into dev/m5-base). Closing as merged via different commit.